Phishing, Smishing & Fake KYC Scams
Urgent SMS messages warning of bank account blocks, electricity disconnection, or pending traffic challans trick victims into entering OTPs on lookalike fake websites.
At a Glance
What is it?
What is it?
Phishing (via email), Smishing (via SMS), and Vishing (via voice calls) are deceptive communications designed to impersonate trusted institutions. Scammers mimic banks, telecom companies, tax departments, and state electricity boards to induce voluntary disclosure of passwords, card numbers, and one-time passcodes (OTPs).
Why the Padlock Icon is Not Enough
A common myth is that a green padlock or “HTTPS” in the browser address bar certifies that a website is genuine. This is false. HTTPS only guarantees that communication between your browser and the server is encrypted. Anyone, including a criminal syndicate, can obtain a free SSL certificate for a fraudulent website. Always verify the domain name spelling (e.g. sbi.co.in vs sbi-net-banking.invalid).
How it Works (Step by Step)
Written from the victim's perspective to help you spot each stage before damage occurs.
- 1Step 1: Scammers blast automated SMS or WhatsApp messages containing manufactured emergencies (KYC expiry, bill default, lottery).
- 2Step 2: You tap the included link and are directed to a cloned website that copies the visual design and logo of your bank or utility.
- 3Step 3: The page prompts you to enter your mobile number, net banking credentials, or debit card number and CVV.
- 4Step 4: The scammer's automated script attempts a bank transfer using your credentials, triggering an OTP to your phone.
- 5Step 5: You enter the OTP into the fake website believing it validates your KYC, while the script uses it to execute an unauthorized debit.
Red Flags to Watch For
- Urgent text messages warning: 'Your bank account/SIM card/electricity will be suspended tonight within 24 hours'.
- Messages sent from ordinary 10-digit mobile numbers (+91-9XXXXX) rather than official corporate SMS sender headers.
- Shortened URLs (bit.ly, tinyurl) or misspelled domains (e.g., 'sbi-update-kyc.invalid' instead of 'sbi.co.in').
- Web pages that immediately ask for your Net Banking password, debit card PIN, CVV, or Aadhaar OTP.
- Callers claiming to be 'customer support' demanding the OTP you just received to 'cancel an unauthorized charge'.
Example (made up): The 'Urgent Electricity Disconnection' SMS
Fictional Scenario"Sunil received an SMS at 7 PM: 'Dear consumer, your electricity will be disconnected tonight at 9:30 PM due to unpaid bill. Immediately update via http://power-board.example.invalid'. Anxious about losing power with guests over, Sunil clicked the link. The site looked identical to his state electricity board. It asked for a nominal Rs 10 verification payment. When he entered his debit card details and received an OTP, he typed it in. Immediately, Rs 48,000 was debited. He called 1930 within 20 minutes to block the beneficiary account."
Why this was a trap:
- ⚠️Night-time disconnection deadline -> Creates panic to prevent independent verification.
- ⚠️Unverified domain name -> Electricity boards do not host billing on unofficial domains.
- ⚠️OTP entered for a nominal fee -> Scammers change the backend transaction amount while you think you are paying Rs 10.
What to Do
- ✓Open your official banking or utility app directly by typing the known address yourself.
- ✓Check the sender ID: genuine bank communications arrive with trusted telecom alpha headers (e.g. VK-HDFCBK, AX-SBINB).
- ✓Report suspicious SMS and WhatsApp phishing messages to Chakshu at sancharsaathi.gov.in.
- ✓Call 1930 immediately if you accidentally entered an OTP or debit card details on a fake website.
What NOT to Do
- ✕Do NOT click on links in unsolicited messages claiming your electricity or SIM is expiring.
- ✕Do NOT share OTPs with anyone, even if the caller correctly recites your name or partial account number.
- ✕Do NOT assume HTTPS / padlock in the browser proves a website is legitimate.
- ✕Do NOT call the phone number listed inside the suspicious SMS.
If It Already Happened: Immediate Steps
View Full Emergency Flow- 1Call 1930 immediately: Report the fraudulent debit within the Golden Hours to freeze the recipient bank lines.
- 2Call your bank immediately: Block your debit/credit card and freeze internet banking credentials.
- 3Change passwords: Change your net banking, email, and UPI passwords immediately from a secure browser.
- 4Report the phishing link on Chakshu (sancharsaathi.gov.in) to take down the fraudulent domain.
💬 Tell Your Family (WhatsApp Message)
< 60 wordsPhishing alert: Banks never send SMS links threatening account suspension within 24 hours for KYC. Never share an OTP or click SMS links for electricity bills. Always check the official banking app directly.
Related Scams
Digital Arrest Scam
Criminals pose as police, CBI, or customs on video calls, threatening immediate arrest unless you transfer money to a 'safe account'. Real police never do this.
UPI & QR Code Fraud
Scammers abuse QR codes and UPI collect requests, tricking you into believing you must enter your UPI PIN to receive a payment or refund. Entering a PIN always sends money.
Verified Primary Sources & Evidence
Facts verified on: 2026-10-22- CERT-In Advisory: Phishing and Smishing Campaigns Targeting Banking CustomersPublisher: Indian Computer Emergency Response Team (CERT-In) (primary source)Accessed 2026-10-22