Skip to content
Stay safe

Calls, codes and messages

KYC update SMS: is your bank account really about to be blocked?

Almost certainly not. A text or WhatsApp message that says your account will be blocked unless you update KYC or PAN through a link, or install an app, is one of the most common ways bank fraud starts. RBI says to confirm any KYC request directly with your bank, using a number from its official website, and never to share OTPs, PINs, passwords, card details or KYC documents with unknown people or through unverified links. If you already entered details, call your bank at once.
Black and white close-up of two hands typing on a smartphone keyboard
Photo: relexahotels on Pixabay

Before you act on a KYC update message

Tap each one as you check it.

What a fake KYC message looks like

RBI says these frauds usually start with an unexpected call, SMS or email. The message creates urgency and threatens that your account will be frozen, blocked or closed, then asks for personal or login details, or asks you to install an app from a link. With those details, fraudsters can get into your account.

Example. Names and numbers are made up.
RBI's name for scam calls like this is vishing: calls pretending to be from a bank, wallet or phone company asking for confidential details for “KYC updation” or to unblock an account.

The PAN update and APK file versions

PIB Fact Check has flagged several fake messages in SBI's name. Older ones said a customer's YONO account had been closed and asked them to update their PAN through a link. In March 2026, one claimed YONO accounts would be blocked over incomplete Aadhaar details and told people to install an APK file called “SBI KYC AADHAR UPDATE”.

PIB said these were not from SBI and warned against installing apps or APK files sent by email, SMS or WhatsApp. An app sent as a file in a message is not your bank's app, whatever its name or logo.

How to check a real KYC request

  • Contact your bank directly: open its own app, visit the branch, or call the number from its official website or the back of your card.
  • Never use a number, link or app that came in the message.
  • Under an RBI circular of January 2025, banks are to make service and transaction calls from numbers in the 1600 series. A “KYC” call from an ordinary 10-digit mobile number is a warning sign.

Signs it is a scam

  • Says your account will be blocked today
  • Has a link to update KYC, PAN or Aadhaar
  • Sends an app or APK file to install
  • Asks for an OTP, PIN, password or card number
  • Comes from a personal mobile number

What a real bank does

  • Lets you check the request in its own app or branch
  • Gives its number on its official website and your card
  • Calls about service from 1600-series numbers
  • Never needs your OTP, PIN or password
  • Does not mind you hanging up to call back

Speed matters. Under RBI's rules on unauthorised electronic transactions, if a loss happens because you shared payment credentials, you bear the loss until you report it to your bank, and the bank bears any loss after you report it.

Call your bank on the number from its official website or your card and ask it to block your cards, net banking and UPI. RBI also asks victims to report financial cyber fraud on 1930 or at cybercrime.gov.in straight away.

If it already happened

  1. Call your bank now on the number on your card or its official website, and ask it to block your cards, net banking and UPI.
  2. If you installed an app from the message, uninstall it, then change your net banking password and UPI PIN from a device you trust.
  3. Check your statement for transactions you did not make and report each one to the bank in writing.
  4. Report the SMS and the sender on Chakshu at sancharsaathi.gov.in, and keep screenshots of the message and link.
  • Call 1930The national cyber fraud helpline. Call within hours if money left your account.
  • cybercrime.gov.inFile a complaint online and keep the acknowledgement number.
  • Chakshu on Sanchar SaathiReport a fraud call, SMS or WhatsApp number.

Questions

Will my bank account really be blocked if I do not update KYC?
Banks do ask customers to update KYC from time to time, but you can always confirm it directly in the bank's own app, at the branch or on its official number. A message that demands action through a link within hours is the scam.
Is the SBI PAN update message real?
No. PIB Fact Check has flagged SMS messages asking SBI customers to update PAN through a link as fake, and in 2026 a message asking people to install a “KYC Aadhaar update” APK.
I entered my OTP on the link. What should I do?
Call your bank immediately and ask it to block your accounts and cards. Under RBI rules, losses after you report an unauthorised transaction fall on the bank, so the sooner you report, the better.
How can I tell if a call is really from my bank?
RBI has told banks to make service and transaction calls from 1600-series numbers. Even then, never share an OTP or PIN on a call, and if in doubt hang up and call the number on your card.

Realr does not check messages or links, but when you are dealing with a stranger you met online, you can ask them to prove who they are with a Realr check before you pay.

Ask them to verify

Sources

Checked against the sources above on 17 October 2026. By Manav Sharma, Marketing Team, Realr. This is general guidance, not legal advice.

Ask them to prove who they are, before you pay or meet.

Try Realr, free