Fake KYC alerts can empty bank accounts: five common scams and how to stay safe

Digital transactions in India have grown very fast, and the risk of cyber crime has grown at the same pace. The rate of digital fraud in the country has risen by 7.1 per cent, about twice the global average. More than 60 per cent of all cyber crime complaints recorded relate to financial fraud. Identity theft and fake "re-KYC" alerts are emerging as the biggest threats.

In KYC, or "Know Your Customer", checks, banks and fintech platforms verify a person's identity through authorised documents such as a PAN card or a government identity card. In digital KYC, documents are checked through a live photograph and a video call so that an account can be opened quickly. Once KYC is complete, the user gets full control of the account. For this reason, fraudsters mainly use two methods to exploit the process.

The first is identity theft. Scammers steal personal information or create a fake identity to complete KYC by deceit. New accounts are then opened in your name, loans are taken or credit cards are issued. The second is the account suspension scam. SMS alerts are sent claiming that if KYC is not updated, your account or digital wallet will be blocked permanently within a few hours. Fear is spread among people in this way.

Five common methods of fraud are as follows. First, the lure of money for completing KYC: fraudsters pay people in advance to get KYC checks done on their accounts, then take full control of those accounts and carry out illegal transactions. Second, phishing through fake re-KYC links: messages demanding immediate identity verification are sent, and users are made to submit confidential documents and OTPs on the pretext of a KYC update, which lets the fraudsters hijack their accounts.

Third, fake loan processes and sham onboarding: people are lured with the promise of a sanctioned loan and made to complete video-KYC on accounts controlled by the fraudsters. All the responsibility falls on that person, while full control of the account stays with the scammer. Fourth, SMS alerts and phishing KYC portals: SMS messages threaten to close the account or wallet permanently if the recipient does not click an external link for "mandatory re-KYC", and people's identity and personal data are stolen directly. Fifth, misuse of remote access: callers pose as bank officials and, in the name of "completing a pending KYC check", get people to download screen-sharing apps. This gives the fraudsters remote access to the device, and they approve illegal transactions themselves.

PhonePe has in-built security features such as PhonePe Device Guard. These detect active screen mirroring, automatically hide sensitive data and stop the session there. Security engines such as PhonePe Protect detect device changes and suspicious location jumps, and block unfamiliar login attempts in real time.

Users should keep a few points in mind for protection. Be wary of messages that create haste or fear, especially unsolicited calls, emails or messages threatening to close an account immediately. Do not share an OTP, UPI PIN or password with anyone, whether over the phone or on a messaging app. A genuine, authorised financial institution completes KYC updates only inside its official app, never through an external SMS link. Customer support never asks you to install unfamiliar remote desktop or screen-sharing software. Contact customer service only on the number given in the official app.

Know where to complain if you suspect fraud. For PhonePe support, call 080-68727374 or 022-68727374. You can also contact the official Twitter handle (@PhonePeSupport) or the Facebook handle, or escalate an open ticket at grievance.phonepe.com. For the National Cyber Crime cell, dial 1930 immediately or file a complaint at cybercrime.gov.in. Fake calls or messages can be reported through the Chakshu portal on the Department of Telecommunications' Sanchar Saathi website, sancharsaathi.gov.in.