"Your KYC has expired" and "account will be blocked" messages

Banks do not block accounts by text message, and they never ask for KYC through a link, a WhatsApp chat or an app sent by a caller.

How it works

A text, WhatsApp message or call says your KYC is pending or expired and your bank account, wallet, card, FASTag or SIM will be blocked today. It gives a link or a phone number.

The link opens a page that copies your bank's look and asks for your customer ID, password, card number, expiry date, CVV, ATM PIN and then the OTP.
The phone number is answered by a polite "executive" who asks you to read out an OTP, or to install an app "for video KYC". The app is a screen-sharing or SMS-forwarding tool that lets him see your OTPs.
A file named like "KYC update.apk" arrives on WhatsApp. Installing it gives the sender control of your messages.

With those details the fraudster logs in, adds himself as a payee or sets up UPI on his own phone, and empties the account.

The signs

A threat with a deadline: "will be blocked within 24 hours".
A link that is not the bank's own address. Look at the part just before the first single slash. See how to check a link.
Sent from an ordinary mobile number, or a WhatsApp account with the bank's logo.
A request for PIN, CVV, password or OTP. No bank employee needs them, ever.
An app to install from a link or a file instead of the official app store.
Spelling slips and odd greetings such as "Dear costumer".

The safe way to deal with KYC

Ignore the message. Do not tap the link or call the number in it.
If you think your KYC may really be due, open your bank's app yourself, or visit the branch, or call the number printed on the back of your card or in your passbook.
Real re-KYC is done in the bank's own app or net banking after you log in, at the branch, or through channels the bank lists on its official website. It does not need your PIN or CVV.
Report the message on Chakshu at the Sanchar Saathi portal so the number can be acted on, then delete it.

If you already entered details or installed the app

Uninstall the app and switch the phone to flight mode while you act from another phone.
Call your bank's official helpline to block the card, net banking and UPI, and change your passwords and PINs.
Follow every step under "If money has already gone" below, even if no money has moved yet.

Will my account really be frozen if I do not update KYC?

Banks do restrict accounts when KYC is long overdue, but only after repeated notice through their official channels, and the fix is done at the branch or in the bank's own app, never through a link in a text.

The message used my name and the last digits of my account. Is it genuine?

Not necessarily. Such details leak. Judge the message by what it asks you to do.

If money has already gone

Dial 1930 at once. It is the national helpline for victims of financial cyber fraud. Give the transaction details; the earlier the report, the better the chance that the money can be held before it is moved on.
Call your bank or card company on its official number and block the card, UPI or account. Report the transaction as unauthorised and note the complaint number.
File the complaint on the National Cyber Crime Reporting Portal, cybercrime.gov.in, and keep the acknowledgement number.
Keep everything: screenshots, numbers, UPI IDs, account numbers, transaction references, links, the app's name. Do not delete chats.

The full checklist, with what to keep ready, is on what to do after a fraud. Helpline and portal checked on 12 November 2026.

Independent guide. This is not a government, bank or police website. Helplines and rules were checked at official sources on 12 November 2026; confirm on the official site before relying on them.