A fake HDFC KYC message usually threatens account blocking and pushes you to a link, phone number, APK, or remote-access app. The safe route is to ignore the message link and check only inside the official bank app, website, branch, or card-backed support number.
Common script
What the message or call may sound like
Dear customer, your HDFC account KYC will expire today. Update immediately to avoid account block. Click link and verify OTP.
Mechanism
Why this scam works
The message borrows a real banking word, adds time pressure, and makes the victim feel that doing nothing is more dangerous than clicking.
Red flags
Stop when you see these signals
Threats that the account will be blocked today or within a few hours
A link that is not the exact official bank domain
Requests for OTP, card number, PIN, net banking password, Aadhaar, PAN, or remote access
A WhatsApp-only support number or callback request
APK download instructions or screen-sharing app instructions
A link whose domain is not hdfcbank.com when read carefully from the start
Messages that arrive at odd hours from ordinary 10-digit mobile numbers
Do now
If this is happening to you
Do not tap the message link.
Open the official HDFC app or type the official domain yourself.
If details were entered, call the bank from the number on your card or official app.
Change passwords and review recent transactions from a trusted device.
Report financial cyber fraud quickly if money moved.
Do not
Do not share OTP or UPI PIN with anyone.
Do not install an APK or remote-access app.
Do not call a number from the suspicious message.
Save evidence
Screenshot of the SMS or WhatsApp message
Full URL without opening it again
Sender phone number or SMS sender ID
Transaction IDs if money moved
Prevent repeat risk
Use the bank app directly for KYC status.
Turn on transaction alerts.
Teach family members that banks do not need OTPs through links.
Save the official HDFC support number from the back of your card, not from search results.
If in doubt, forward the SMS to Kaval on WhatsApp before touching anything in it.
Treat WhatsApp KYC links as unsafe. Check KYC status inside the official app, typed website, branch, or official support channel.
What if I entered an OTP?
Call the bank immediately, change affected passwords, review transactions, and report cyber fraud if money moved.
Does HDFC block accounts the same day for KYC?
No. Real KYC follow-ups come with notice through the app, email, and branch. Same-day threats with a link are the scam version.
I clicked the link but did not enter anything. Am I safe?
Mostly yes. Close the page, clear the browser tab, and do not install anything it downloaded. Danger comes from entering credentials, OTPs, or installing an APK.
Who do I report a fake HDFC SMS to?
Use the bank’s official phishing reporting channel, report at cybercrime.gov.in, and call 1930 immediately if money moved.