KYC Update Scam: What It Is and How It Works in India

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Online fraud

A KYC update scam is a type of phishing fraud in which criminals pose as bank, telecom, or wallet company representatives and ask you to update your Know Your Customer details. The fraudster typically sends a link to a fake website or asks you to download an app that captures your credentials, OTP, or screen. Once the fraudster gains access, they can drain your bank account, open fraudulent accounts in your name, or misuse your identity documents. In India, these acts are prosecuted under Section 66D of the Information Technology Act, 2000 for cheating by personation using a computer resource, and Section 318 of the Bharatiya Nyaya Sanhita, 2023 for cheating.

The scam works because KYC updates are a routine requirement. Banks and telecom companies periodically ask customers to update their KYC documents, and fraudsters exploit this familiarity. They create a sense of urgency by claiming that the account will be frozen or the SIM card will be deactivated if the KYC is not updated immediately. The victim, fearing disruption, clicks the link or shares the OTP without verifying the sender. The fraudster then uses the information to access the account or sell the identity data on the dark web. Understanding how the scam operates is the first step to protecting yourself and reporting the fraud effectively.

What the law says

The Information Technology Act, 2000 provides the primary criminal provisions for KYC update scams. Section 66 covers computer-related offences, including unauthorized access to computer resources. Section 66C punishes identity theft, which applies when the fraudster uses stolen credentials or identity documents. Section 66D specifically addresses cheating by personation using a computer resource or communication device. Section 67 and 67B deal with publishing obscene material and may apply in cases involving sextortion linked to the scam. These provisions carry imprisonment and fines.

The Bharatiya Nyaya Sanhita, 2023 contains the general criminal law provisions. Section 318 covers cheating, Section 316 covers criminal breach of trust, Section 336 covers forgery, and Section 351 covers criminal intimidation. These sections apply when the fraudster deceives the victim into sharing information or transferring money. The Bharatiya Nagarik Suraksha Sanhita, 2023 provides the procedural framework. Section 173 allows a police officer to register an FIR. Section 175(3) allows a magistrate to direct an investigation. Section 35 covers arrest procedures. Section 187 deals with bail. Section 480 allows compounding of offences. Section 482 covers appeals. Section 528 grants inherent powers to the High Court.

The Bharatiya Sakshya Adhiniyam, 2023 Section 63 governs the admissibility of electronic records. This provision is critical because KYC scams rely on digital communication. Screenshots, call logs, and transaction records must be preserved and authenticated to be admissible in court. The RBI has issued directions on KYC norms and unauthorized electronic transactions. The 2017 circular on customer protection limits customer liability based on the speed of reporting. The 2019 circular on Harmonisation of Turn Around Time sets timelines for resolving failed transactions. The RBI's KYC norms require banks to verify customer identity and periodically update the records. Fraudsters exploit the gap between the regulatory requirement and the customer's ability to verify the communication.

How the fraud actually runs

The scam typically begins with a phone call, SMS, or WhatsApp message. The fraudster claims to be from the bank's KYC department or the telecom company's customer care. They state that the customer's KYC is incomplete or expired and that the account will be frozen or the SIM will be deactivated. They offer to help update the KYC online. The victim is asked to click a link, download an app, or share a screen. In some cases, the fraudster asks the victim to send a copy of their Aadhaar card, PAN card, or photograph.

Once the victim clicks the link, they are directed to a fake website that looks like the bank's portal. The website asks for the customer's name, account number, password, and OTP. When the victim enters the details, the fraudster captures them and uses them to log into the real bank account. In other cases, the fraudster asks the victim to install a screen-sharing app, which allows the fraudster to see the victim's screen and capture the OTP. The fraudster may also ask the victim to scan a QR code or approve a UPI collect request. Once the money is transferred, it is quickly moved through multiple accounts to evade tracing.

The scam can also involve the misuse of identity documents. If the victim shares their Aadhaar or PAN details, the fraudster may use them to open a new bank account, obtain a loan, or register a SIM card in the victim's name. This can lead to long-term financial and legal consequences. The victim may receive notices from banks or law enforcement for transactions they never authorized. It is therefore essential to report the fraud immediately and monitor your credit report for unauthorized activity.

Red flags versus legitimate KYC process

The table highlights the key differences between a scam and a legitimate KYC process. The most important red flag is the request for an OTP. No bank or telecom company will ask for an OTP over the phone or through a message. If someone asks for an OTP, it is a scam. Another red flag is the link to a website. You should always verify the domain name before entering any information. Legitimate banks use secure, official websites and apps. If the communication comes from an unknown number or email address, treat it with suspicion.

Step-by-step procedure to report a KYC update scam

1. Contact your bank immediately. Call the bank's 24-hour customer care hotline and report the fraudulent communication. Request a freeze on your account or card if you have shared any credentials. Ask the bank to flag the account for suspicious activity.
2. Call 1930. The National Cyber Crime Helpline can guide you on filing a complaint and may help freeze the recipient's account. Provide the phone number that called you, the link you clicked, and the details you shared.
3. File a complaint on cybercrime.gov.in. Register your details, upload screenshots of the fraudulent message or call log, and submit the complaint. Keep the acknowledgement number for tracking.
4. File an FIR under Section 173 of the BNSS 2023. Visit the local police station with the online complaint, bank statements, and identity proof. Obtain a copy of the FIR for your records.
5. Report to the telecom company. If the fraudster claimed to be from a telecom company, report the incident to the company's customer care. They can block the fraudulent number and help prevent further misuse of your SIM.
6. Monitor your credit report. Check your credit report for unauthorized loans or credit inquiries. If you find suspicious activity, report it to the credit bureau and the lender immediately.
7. Approach the magistrate under Section 175(3) if the police refuse to register an FIR. The magistrate can direct the police to investigate the complaint.

What decides the outcome

The outcome of a KYC update scam case depends on several factors. First, the speed of reporting is critical. If you report the fraud within three working days, the RBI's zero-liability framework may protect you from financial loss. Second, the evidence you preserve matters. Screenshots of the fraudulent message, call logs, and bank statements establish the scam and the flow of money. Third, the bank's investigation determines whether the bank failed in its duty to protect your account. Fourth, the police investigation's ability to trace the fraudster affects the criminal case. Fifth, the court considers whether you shared the OTP or PIN. If you did, the bank may argue that the loss was due to your negligence.

The law on KYC scam liability is still developing. Courts rely on the RBI circulars and the facts of each case. There is no definitive Supreme Court ruling that applies to all situations. Victims should gather as much evidence as possible and present a clear timeline of events. The stronger the evidence, the better the chances of recovery. Victims should also consider the cost of litigation and the likelihood of recovering the money from the fraudster. In some cases, a settlement with the bank may be the most practical option.

Common mistakes to avoid

• Sharing the OTP with the fraudster. No legitimate bank or telecom company asks for an OTP.
• Clicking links in unsolicited messages. Always verify the sender and the domain name.
• Installing screen-sharing apps at the request of a caller. This gives the fraudster full access to your device.
• Not reporting the fraud immediately. Delays reduce the chance of freezing the funds.
• Deleting the fraudulent messages or call logs. Preserve all evidence for the investigation.
• Ignoring the bank's requests for information. Cooperate with the investigation to resolve the case.
• Not monitoring your credit report. Unauthorized loans or accounts may appear after the scam.

If you need legal assistance, consult a cyber crime lawyer in Kolkata. For victims in West Bengal, our cyber law services in West Bengal provide guidance on filing complaints and pursuing recovery. You can also contact us for a consultation.

When to involve a lawyer

You should involve a lawyer if the bank rejects your claim, if the police fail to register an FIR, or if the amount lost is substantial. A lawyer can help you file a writ petition in the High Court under Section 528 of the BNSS 2023, pursue civil recovery, and represent you in criminal proceedings. Legal representation is also advisable if you are accused of committing a KYC update scam, as the offence carries serious penalties under the IT Act 2000 and BNS 2023. A lawyer can guide you through the complexities of electronic evidence under BSA 2023 Section 63 and ensure your rights are protected throughout the process.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Trading app scam: what it is and how the fraud runs
• Stock market scam: how the fraud actually runs in India
• Mutual fund scam: what it is and how the fraud runs
• Fake website scam: what it is and how it works
• AI voice cloning scam what it is and how it works
• Work From Home Scam: What It Is and How It Runs

Cyber crime lawyer in your city · Bank account freeze help · Contact