Banking phishing

SBI KYC SMS Scam

Fake SBI KYC messages often claim your account, YONO access, or card will be blocked unless you verify through a link. The link is usually the trap.

Common script

What the message or call may sound like

SBI user, your YONO account has been suspended. Update PAN/KYC now at the link to reactivate service.

Mechanism

Why this scam works

The scam imitates a familiar bank, uses compliance language, and makes delay feel expensive.

Red flags

Stop when you see these signals

Account suspension or KYC expiry threats
YONO or SBI wording paired with a non-official domain
Requests for OTP, debit card details, CVV, PIN, PAN, or net banking password
Short links, misspellings, and urgency
Requests to install an app outside official app stores
Sender ID that imitates SBI but is not the official one used in your previous genuine messages
A shortened URL or a domain with extra words like sbi-kyc-update or sbi-verify
Grammar that a bank would not ship: missing spaces, odd capitals, urgent tone

Do now

If this is happening to you

Open YONO or the official SBI website yourself.
Call official support if you already submitted credentials.
Block cards and reset net banking credentials when payment details were shared.
Save evidence before deleting the message.

Do not

Do not use links from the message.
Do not enter OTP or card PIN into a web page.
Do not trust a caller who follows up after the SMS.

Save evidence

SMS screenshot
Sender ID and phone number
Suspicious link
Bank alert messages and transaction IDs

Prevent repeat risk

Bookmark the official bank site.
Use app notifications and official statements rather than message links.
Set a family rule: bank warnings are checked only through the app.
Check KYC status only inside the official YONO app or by visiting a branch.
Report fake SBI messages by forwarding them to the bank’s official phishing report address and to 1930 if money moved.

Run a check

Use Kaval on this pattern

Answers

Common questions

Can my bank account be blocked if I ignore a random SMS?

If there is a real issue, it will be visible through official bank channels. Do not use the random message link to check.

What if the sender ID looks official?

Sender IDs can be confusing or spoofed. The link, request, and destination matter more than the display name.

Does SBI block accounts for pending KYC the same day?

No. Banks give written notice with time to comply through official channels. Same-day blocking threats delivered by SMS link are a phishing pattern.

I entered my details on the link but no money has moved yet. What now?

Treat credentials as stolen. Change your net banking password and MPIN from a clean device, turn off UPI and net banking temporarily through official support, and watch transactions closely.

How can I check whether an SBI message is genuine?

Do not use anything inside the message. Open the official app or type onlinesbi.sbi yourself, or forward the message to Kaval on WhatsApp for a verdict before acting.

Guides