How to identify banking SMS scams before they empty your bank account

Verify alerts through official channels, never install files sent by text, and report fraud immediately

Text-message scams targeting Indian bank customers have risen sharply as fraudsters abandon voice calls in favour of short message service (SMS). They exploit the trust that consumers place in banking alerts. According to BioCatch, a company that provides fraud-detection technology, such scams affecting Indian banks rose 146 per cent between the second half of 2025 and the first half of 2026 compared with the same period a year earlier.

 

This increase reflects a shift in cyber fraud tactics. Banks, telecom operators and regulators have tightened controls on fraudulent calls, so criminals now use text messages to trick customers into revealing banking credentials, downloading malware or authorising fraudulent transactions. Cybersecurity experts say inexpensive mass messaging and content generated by artificial intelligence (AI) help criminals. India’s digital payments ecosystem has also expanded rapidly. As a result, SMS has become an effective channel for financial fraud.

 

Why fraudsters prefer text messages

 

SMS gives fraudsters a distinct advantage because it reaches almost every mobile user without an app or an internet-based messaging platform. Scam messages also arrive in the same inbox as genuine banking alerts and one-time passwords (OTPs), making them appear credible.

 

“Text is the cheapest way to reach a hundred million people,” says Srinivas L, joint managing director (MD) and joint chief executive officer (CEO), 63SATS Cybertech. Text works on every phone and appears alongside legitimate banking messages, allowing fraudsters to exploit customers’ trust. Srinivas says AI enables criminals to create convincing messages in any Indian language at scale, while rapid growth in mobile payments means one successful message can pay for a lakh failed attempts.

 

“A text campaign costs next to nothing and reaches victims instantly,” says Subhashish Bose, director, global advisor, BioCatch. Bose says text messages attract fraudsters because they bypass email filters and put immediate pressure on recipients. Messages that appear to come from banks or government agencies also carry perceived authority. India’s high Android penetration makes it easier for criminals to distribute malware through sideloaded applications.

 

Familiar messages hide sophisticated traps

 

Scams now take many forms, but they all create urgency and persuade victims to act before they verify the message.

 

Fake know-your-customer (KYC) update and account-suspension alerts remain among the most common. They redirect users to lookalike banking websites that steal login credentials and OTPs. Other messages impersonate courier companies, promise refunds, or claim that electricity bills or traffic challans remain unpaid. They persuade users to install malicious Android Package Kit (APK) files that silently capture incoming OTPs.

 

Investment scams have also become more sophisticated. Fraudsters send messages that promise unusually high returns and direct victims to fake trading platforms. These platforms display fabricated profits before blocking withdrawals.

 

Another threat is the digital arrest scam. Fraudsters impersonate the police or investigative agencies, falsely accuse victims of financial crimes and pressure them to transfer money to purported holding accounts while an investigation is under way.

 

Bose says criminals also recruit unsuspecting people as money mules through work-from-home offers. They persuade victims to receive and transfer money through their bank accounts, often without realising that they are facilitating money laundering.

 

Warning signs that demand caution

 

Most SMS scams share several warning signs. “Anything saying today, within two hours, or account will be blocked is engineered to stop you from thinking,” says Srinivas. Messages that create urgency deserve immediate suspicion.

 

Banks and government agencies use registered sender headers rather than ordinary mobile numbers. Genuine organisations never ask customers to download files, share OTPs or enter personal identification numbers (PINs) through SMS.

 

Bose says fraudsters use AI to create convincing phishing messages and fake websites that can be difficult to distinguish from genuine communication. However, shortened links, suspicious web addresses and unsolicited offers remain important warning signs. “If you didn’t apply for a loan or request investment materials, cold outreach offering them should be treated with extreme caution,” says Bose.

 

Fraudsters primarily use fear to manipulate victims, says Vikram Babbar, partner, EY Forensic & Integrity Services – Financial Services. Messages often threaten account suspension, mention undelivered parcels, impersonate tax authorities or law enforcement agencies, or fabricate family emergencies. Babbar says fraudsters then use carefully scripted conversations to manipulate victims into sharing OTPs, authentication codes or sensitive KYC information.

 

“Banks never ask customers to install remote access applications or APK files to resolve account issues,” says Prashant Mali, cybersecurity expert. Mali says customers should treat unsolicited messages received through SMS, Rich Communication Services (RCS), WhatsApp or other messaging platforms with caution. He also says quick response (QR) codes allow users to make payments, not receive money, and customers should never scan them merely to collect funds.

 

Verify every suspicious message

 

Customers should never verify a suspicious message by using information within the message.

 

Srinivas says users should close the message and access their bank through its official mobile application or call the customer care number printed on their debit card or passbook. “If the bank really needs something from you, it will appear there too,” says Srinivas.

 

“Did I initiate this?” Customers should ask themselves this question before responding. Legitimate alerts generally follow actions such as login attempts or large transactions, while unsolicited requests for credentials or payment approvals are usually fraudulent. Bose says customers should contact banks only through official customer care numbers and verify messages that claim to come from regulators on their official websites.

 

Babbar says official mobile banking applications remain the safest channel for customer service requests. Legitimate banking messages generally do not contain links asking customers to update personal information.

 

Act fast after a fraud 

•    Report the fraud immediately on 1930 or cybercrime.gov.in 

•    Notify your bank or payment provider without delay 

•    Preserve screenshots, call logs and other evidence 

•    Scan your mobile phone for malware and switch on flight mode if a remote-access application was installed 

•    Act quickly, as recovery depends on whether banks can freeze the funds before they are transferred