Update your KYC now: why that link is a trap

“Dear customer, your account will be blocked today. Update your KYC now.” There is a link, or sometimes a file to install.

KYC (“know your customer”) is a real process. Banks and wallets do ask people to update it from time to time. That is exactly why this message is so effective, and why you need to know what a real request looks like and what a fake one asks for.

What the scam looks like

• An SMS or WhatsApp message about a blocked account, an expired KYC, or a suspended wallet.
• A link to a page that looks like your bank, asking for your customer ID, password, card details and OTP.
• Or a file, often ending in .apk, called something like “Bank KYC”. It asks you to install it.
• Sometimes a phone number to call, answered by someone who sounds like “customer care” and guides you through the same steps.

The message is usually sent to thousands of people at once. Some of them really do have an account at that bank, and a few of those are in the middle of a real KYC update. That is all the scammer needs.

Why the pressure works

Nobody wants to lose access to their bank account. A deadline of “today” or “within two hours” makes you act before you think. The message also sounds routine, so it does not set off the alarm that a strange request would.

Why the file is dangerous

An app installed from a message can ask for permission to read your SMS messages. That lets the scammer see your OTPs the moment they arrive. They can then approve payments from your account while you are still looking at the screen.

Apps you can trust come from the official stores. An app sent to you as a file or link is not one of them. Installing it often means switching on a setting that allows apps from unknown sources, which is a warning sign in itself.

What a real KYC request looks like

• It reaches you through your bank’s own app, your net banking after you log in yourself, or a branch.
• It gives you reasonable time, and does not demand action within hours on pain of blocking.
• It asks for documents, not secrets. It does not ask for your OTP, UPI PIN, card PIN or CVV. Updating KYC never needs these.
• If you are unsure, you can call the number printed on the back of your card, or on the bank’s official website.

Signs the message is fake

• It came from a normal mobile number, or a sender name you do not recognise.
• The link is not your bank’s own address, or it is a shortened link. Here is how to read an address.
• It asks for sensitive details in a form on a web page.
• It tells you to install an app from a link or file.
• It threatens to block, freeze or close your account very soon.

What to do

• Ignore the message, and do not tap the link or install anything.
• Open your bank’s app yourself and look for any real notice there.
• Check the link without opening it if you want to see what it is.
• If you entered details, call your bank immediately and change your password. Here is the full checklist.
• If you installed the file: switch off mobile data and Wi-Fi, uninstall the app, then call your bank and block your cards. Change your passwords from a different device.
• Report it. You can also report the sender’s number on the Sanchar Saathi portal.

Telling the people around you

Forward this guide, not the scam message. Older relatives and anyone new to digital banking are the usual targets, and a short conversation can save them a lot of trouble. The one sentence to share: a real bank will never ask you for an OTP or PIN, and will never send an app as a file. For more on how the same trick travels over SMS, calls and QR codes, read smishing, vishing and quishing explained.