Do not share OTPs, PINs, authentication codes, card numbers, card verification values (CVVs), KYC details, security answers, Internet-banking passwords or Aadhaar-based authentication credentials through SMS, e-mail or phone calls.
Text-message scams affecting Indian banks rose 146 per cent between the second half of 2025 and the first half of 2026 compared to the year-earlier period, according to BioCatch, a fraud-detection technology company used by banks and financial institutions.
Beware of such messages as they often try to prompt users to disclose credentials, approve payments, install malware or surrender phone access.
Key Points
- Fraudsters exploit trusted bank communication channels to trick users into revealing credentials, approving payments or installing malware.
- Fake investment apps, banking impersonation, digital arrests, malicious APKs and UPI fraud are common scam methods.
- Urgent messages, shortened URLs, suspicious domains and requests for OTPs or PINs can signal fraudulent communication.
- Users should independently verify messages, avoid unsolicited links and report suspicious texts through the Sanchar Saathi portal.
Why text scams work
Texts bypass e-mail filters and reach every phone instantly. They are cheap to distribute widely, offer high returns even at low conversion rates, and benefit from the growing volume of monetary transactions over mobile phones.
Fraudsters misuse the credibility enjoyed by trusted institutions.
"Their messages land in the same inbox where banks send OTPs and transaction alerts, allowing them to borrow the trust associated with genuine communication," says Srinivas L, joint managing director and joint chief executive officer, 63SATS Cybertech.
Text has also gained ground because voice calls are easier to trace and block.
Common scams
Investment scams involve fake trading applications that show fictitious profits but block withdrawals.
Romance scams build trust before introducing bogus investments.
Banking impersonation scams try to harvest one-time passwords (OTPs).
"UPI (Unified Payments Interface) impersonation scams induce users to approve fraudulent payment requests," says Subhashish Bose, director, global advisor, BioCatch.
Digital-arrest scams impersonate the police or Central Bureau of Investigation (CBI) and demand transfers to a supposed holding account.
"Messages impersonating law-enforcement agencies or tax authorities use the threat of official action," says Vikram Babbar, partner, EY Forensic & Integrity Services — financial services.
Malicious Android Package Kit (APK) files may appear as traffic challans, electricity bills or wedding invitations.
Once downloaded, they can read OTPs and harvest bank credentials.
Mule scams disguise illicit transfers as work-from-home jobs.
Some scamsters ask victims to scan a QR code supposedly to receive money.
Spot warning signs
Short deadlines, shortened URLs, misspelt domains and odd web addresses should raise suspicion.
"A message creating urgency is the hallmark of a scam," says Prashant Mali, cybercrime lawyer.
Requests for OTPs, passwords or a personal identification number (PIN), unsolicited loan or investment offers, and 10-digit numbers claiming to represent banks or government bodies are warning signs.
Treat with suspicion requests to download files.
"A scripted conversation seeking OTPs, phone access, or KYC information indicates fraud," says Babbar.
Verify independently
Never verify a message using the links or contact details in it.
"Verify a request through the bank's official web site, mobile application, or customer care number," says Mali.
Users may also call the number on their debit card or passbook.
Check alerts on the bank's official app or website.
"Verify messages claiming to come from the Reserve Bank of India or the Indian Cyber Crime Coordination Centre (I4C) through their official web pages," says Bose.
Check challans and bills on official portals.
Confirm whether a sender indeed uses a particular promotional, service or transaction sender identifier.
Keep your guard up
Pause before responding.
Never click an unsolicited link or use one to update banking information, whether it arrives through short message service (SMS), WhatsApp or another messaging application.
Reject requests for your UPI PIN.
"Remember that a UPI PIN is used only for sending money, not receiving it," says Srinivas.
Download applications only from Google Play or the Apple App Store.
Never install a file, remote-access application or APK sent by a supposed bank representative.
Do not share OTPs, PINs, authentication codes, card numbers, card verification values (CVVs), KYC details, security answers, internet-banking passwords or Aadhaar-based authentication credentials through SMS, email or phone calls.
Do not grant phone access in response to a scripted conversation.
Finally, report doubtful messages through the Sanchar Saathi portal and block suspicious senders.
Disclaimer: This article is meant for information purposes only. This article and information do not constitute a distribution, an endorsement, an investment advice, an offer to buy or sell or the solicitation of an offer to buy or sell any securities/schemes or any other financial products/investment products mentioned in this article to influence the opinion or behaviour of the investors/recipients.
Any use of the information/any investment and investment related decisions of the investors/recipients are at their sole discretion and risk. Any advice herein is made on a general basis and does not take into account the specific investment objectives of the specific person or group of persons. Opinions expressed herein are subject to change without notice.
Feature Presentation: Ashish Narsale/Rediff
