How to identify banking SMS scams before they empty your bank account

Verify alerts through official channels, never install files sent by text, and report fraud immediately

Text-message-based scams affecting Indian banks rose 146 per cent between the second half of 2025 and the first half of 2026 compared with the corresponding year-earlier period, according to a recent release by BioCatch, a fraud-detection technology company used by banks and financial institutions. 

This development calls for caution on the part of mobile phone users. A fraudulent message can lead them to disclose credentials, approve a payment, install malware or give criminals access to their phones. 

Why text message scams work 

Text messages bypass email filters and reach customers instantly on a device that usually remains close at hand. They work on every phone without requiring an application. “The growing volume of money moving through phones increases the payoff from a successful message,” says Srinivas L, Joint managing director & joint chief executive officer, 63SATS Cybertech. 

Text is also a cheap way to reach a large number of people. “Campaigns cost next to nothing and can generate high returns even when conversion rates are low,” says Subhashish Bose, director, Global Advisor, BioCatch. 

Fraudsters exploit the credibility of banks and government organisations. “Their messages land in the same inbox where banks send OTPs and transaction alerts, allowing them to borrow the trust associated with genuine communication,” says Srinivas.

Scamsters have also shifted towards text because voice calls are easier to trace and block. 

Common scams 

Investment scams direct victims to fake trading applications that display fictitious profits and later prevent withdrawals. Romance investment scams take a slower route: criminals build trust through social or dating applications before introducing bogus investment opportunities. 

Banking impersonation scams mimic security alerts and seek OTPs. “Unified Payments Interface (UPI) impersonation scams induce users to approve fraudulent payment requests,” says Bose. 

Digital-arrest scams impersonate the police or the Central Bureau of Investigation (CBI) and pressure victims to transfer money to a supposed holding account. “Messages also impersonate law-enforcement agencies or tax authorities and use the threat of official action,” says Vikram Babbar, partner, EY Forensic & Integrity Services – Financial Services. 

Fraudulent loan or credit-card offers may collect processing fees and disappear. 

Malicious Android Package Kit (APK) files may appear as traffic challans, electricity bills or wedding invitations. “Some scams involve asking customers to install remote access applications or APK files to resolve supposed account problems,” says Prashant Mali, cybercrime lawyer, Bombay High Court. Once installed, they can read incoming OTPs or harvest banking credentials. 

Mule-recruitment scams disguise the transfer of illicit funds as work-from-home payment-processing jobs. “Recruited money mules receive and transfer illegal funds through their bank accounts,” says Bose. 

Know Your Customer (KYC) or account-block scams direct victims to lookalike bank pages that capture login credentials and OTPs. 

“Account-suspension or account-lock messages use the fear of losing access to banking services,” says Babbar.

Job or investment scams may pay small initial returns before soliciting one large deposit. “Family-emergency scams make recipients believe that a relative needs urgent help,” says Babbar. 

QR-code scams falsely claim that users must scan a code to receive money. 

Spot the warning signs 

Urgent phrases such as ‘immediate action required’ or ‘your account will be blocked’ should raise suspicion. Limited-time offers and messages demanding action within a short deadline are designed to prevent careful thought. 

“A message creating urgency is the hallmark of a scam,” says Mali. 

Examine closely any link that you receive through a message. Shortened URLs, misspelt domain names and odd web addresses should be treated as warning signs. 

“A request for an OTP, password or personal identification number (PIN) through a text message or phone call is another warning sign,” says Bose. Treat unsolicited loan or investment offers as well with extreme caution. 

“A message claiming to be from a bank or government body but sent from a 10-digit mobile number may be fraudulent,” says Srinivas . 

“Requests to install a remote-access application or APK file are suspicious,” adds Mali. Claims involving undelivered parcels, account suspension, official notices or family emergencies frequently seek to provoke an immediate response. 

“A scripted conversation seeking OTPs, phone access, or KYC information indicates fraud,” says Babbar. 

Verify independently 

Never verify a message using the contact details or links contained in it. “Verify a request through the bank's official website, mobile application, or customer care number,” says Mali. You may also use the numbers printed on the debit card or passbook. 

If you have received an alert, confirm it using the bank’s official app or website as well. “Verify messages claiming to come from the Reserve Bank of India (RBI) or the Indian Cyber Crime Coordination Centre (I4C) through their official webpages,” says Bose. Check challans and bills directly on the relevant official portal. 

“Also examine whether the sender uses the registered promotional, service or transactional identifier,” says Babbar. 

Keep your guard up 

Pause for a while before responding to a message. Never click a link in an unsolicited message or use an embedded link to update banking information. This precaution applies to messages received through short message service (SMS), WhatsApp and other messaging applications. 

Reject UPI requests from unknown senders and do not approve a request that you did not initiate. “Remember that a UPI PIN is used only for sending money,” says Srinivas. 

Download applications only from Google Play or the Apple App Store. Never install a file sent through a message or a remote-access application or APK file at the request of a supposed bank representative. 

Do not share sensitive banking information through SMS, email or phone calls. This includes OTPs, PINs, authentication codes, card numbers, card verification values (CVVs), KYC information, answers to security questions, internet-banking passwords, and Aadhaar-based authentication credentials. 

Do not grant phone access in response to a scripted conversation. Report doubtful messages through the government’s Sanchar Saathi portal, and finally, block suspicious numbers or senders.

 

Act fast after a fraud 

•    Report the fraud immediately on 1930 or cybercrime.gov.in 

•    Notify your bank or payment provider without delay 

•    Preserve screenshots, call logs and other evidence 

•    Scan your mobile phone for malware and switch on flight mode if a remote-access application was installed 

•    Act quickly, as recovery depends on whether banks can freeze the funds before they are transferred