A message saying “your KYC is expiring today” can create exactly the urgency a scammer wants. The important distinction is that KYC updates are real banking processes, but a message claiming to be from your bank is not automatically genuine.
RBI’s 2025 KYC amendments require regulated entities to give customers advance intimations before periodic KYC updation is due, followed by reminders after the due date when necessary. RBI also says the ultimate responsibility for periodic KYC updation remains with the bank concerned. RBI KYC Amendment Directions, 2025.
Why KYC Messages Create Panic
Fraud attempts often combine a legitimate concept—KYC—with an artificial deadline. The message may threaten account blocking, ask you to click a link, request an OTP, or direct you to a person claiming to be “bank support.” A real KYC requirement does not make those instructions legitimate.
Use the Four-Step Verification Rule
1. Stop the action
Do not click the link, install an app, share an OTP, reveal a card PIN, disclose your internet-banking password or transfer money simply because a message says KYC is urgent.
2. Identify the claimed bank
Read the message without interacting with its links. Note the bank name and stated reason. Do not treat the sender name alone as proof.
3. Verify through a channel you opened yourself
Open your bank’s official app yourself, type the bank’s website address manually, or use the telephone number printed on your card or official statement. Do not use contact details supplied by a suspicious message.
4. Ask the bank whether action is actually due
If unsure, ask the bank to confirm whether your KYC is due and which official method it accepts for updating it.
What RBI’s Current Rules Tell You
RBI’s June 2025 amendment introduced requirements for advance KYC-update intimations and reminders. For low-risk individual customers, the amendment also provided additional time in specified circumstances, including an extension up to June 30, 2026, whichever is later. That is a regulatory rule—not permission for a random SMS, WhatsApp message or caller to collect your credentials.
Red Flags in a KYC Message
- “Update within 30 minutes or your account will close.”
- A shortened or misspelled web address.
- Request for OTP, PIN, CVV or internet-banking password.
- A request to install remote-access software.
- Payment requested to “reactivate” an account.
- A personal phone number presented as bank support.
- Pressure to move the conversation to an unrelated messaging account.
What a Safer Verification Process Looks Like
Suppose you receive a KYC message at 9 AM. Instead of clicking it, open your bank’s app. Look for a KYC notification. If nothing appears, call the official number independently. If the bank confirms that an update is required, use the bank’s documented process.
Do Not Confuse KYC With Payment Requests
Updating KYC and transferring money are different activities. A request to pay a fee into a personal account, approve an unexpected UPI collect request or disclose a one-time password should be treated as a separate fraud warning sign.
For related scam patterns, see our guides on electricity-bill disconnection SMS scams and fake customer-care Google ads.
If You Already Clicked
If you entered credentials, immediately contact your bank through an independently verified channel and follow its account-security instructions. If money has moved or you suspect financial fraud, report it promptly through the appropriate official Indian fraud-reporting channels and preserve screenshots, transaction IDs, phone numbers and messages.
Quick KYC Safety Checklist
- Did I independently verify the bank?
- Am I using the bank’s official app/site?
- Have I avoided sharing OTP/PIN/CVV/password?
- Is there a genuine KYC notification inside my authenticated banking channel?
- Did I avoid installing remote-access software?
- Did I verify any phone number independently?
Bottom Line
KYC can be a genuine banking requirement. The safest response to an alarming KYC message is to verify it independently before taking any action. RBI’s framework makes clear that regulated entities have formal responsibilities around KYC reminders; scammers do not get to define your deadline or the channel you must use.
Frequently Asked Questions
Can a genuine bank ask me to update KYC?
Yes. KYC updation is a legitimate banking process. The safe response is to verify the request through the bank’s official app, website, branch or independently verified contact channel.
Should I share an OTP for KYC?
Do not share an OTP with a caller, message sender or unknown person. Use only the authentication flow inside the bank’s official channel.
What if a KYC message says my account will be blocked today?
Do not let the deadline force a risky action. Independently verify whether your KYC is actually due and what action your bank requires.
See our logistics phishing guide for another example of how urgency is used in scam messages.
Information checked September 29, 2026. Banking procedures can vary by regulated entity; follow your bank’s current official instructions.
