Branch Stories: names and personal details have been changed. Based on situations we see in Indian bank branches.
Mr. Sharma was waiting outside before the branch shutter even went up. 9:40 in the morning, phone in hand, still in his night kurta.
“Sir, five transactions last night. 2 a.m., 2:05, 2:11… I was sleeping! I didn’t give any OTP to anyone!”
He was right. He hadn’t given any OTP to anyone. His phone had.
The message that looked official
The evening before, he got an SMS: “Dear customer, your account will be blocked today due to pending KYC. Update now: [link]”. The message even had the bank’s name.
He clicked. It opened a page that looked like our bank’s website and said: “Download the KYC Update app to continue.” His phone warned him: “This type of file can harm your device.” He tapped “Download anyway”. Then “Allow” on every permission it asked for, including reading SMS.
The app asked for his customer ID, password and debit card details “for verification”. Then it showed a spinning circle and said “KYC under process, please wait 24 hours.”
He went to sleep feeling relieved.
What really happened at 2 a.m.
The file was an APK, an app installed from outside the official app store. It was malware. Once it had permission to read SMS, it could quietly read every OTP that came to his phone and send it to the fraudsters.
With his login details and card details already captured, they simply started transactions at night. Each OTP arrived, the app read it, forwarded it, and deleted it from his inbox. He never saw a thing.
The first hour
We moved fast:
- Blocked his debit card and net banking immediately, and reset his credentials.
- Called 1930 and filed a complaint on cybercrime.gov.in with the transaction details.
- Logged a formal fraud complaint with the bank. Reporting unauthorised transactions quickly matters a lot for how the bank handles the customer’s liability.
- Told him to uninstall the app, then factory reset the phone after backing up photos, because malware can hide.
He kept saying one thing: “But it had the bank’s name.” Anyone can type a bank’s name into an SMS. That’s the whole trick.
How to spot fake KYC messages
- Threat + deadline: “account blocked today”, “PAN not linked”, “KYC expired”.
- A link in an SMS or WhatsApp, often a short or strange web address.
- An app to download from a link instead of the Play Store or App Store.
- Requests for SMS permission, card number, CVV, PIN or passwords.
Banker’s advice
- Banks don’t send links to download KYC apps. KYC updates happen at the branch or inside your bank’s official app or website.
- Install banking apps only from the official Play Store or App Store. Never tap “install anyway” on a downloaded file.
- Never give SMS-reading permission to an app you don’t fully trust.
- Turn on transaction alerts and keep transaction limits low for cards and UPI if you don’t need high limits.
- Report unauthorised transactions immediately to the bank and on 1930. The sooner, the better.
Mr. Sharma now forwards every suspicious SMS to his son before doing anything. “Pehle beta dekhega,” he told me. Honestly, that’s a good rule for all of us.
This story is for awareness. If you are a victim of online fraud, call 1930 or report at cybercrime.gov.in and inform your bank immediately.