2. Phishing, Smishing & Fake Bank Alerts
● The Real Scenario: A citizen receives an SMS text or a WhatsApp alert stating that their HDFC or SBI account will be blocked because their PAN card or KYC info has expired.
● How It Works: The message includes a link leading to a flawless replica of the bank's login portal. The moment the user types in their net banking password and the subsequent OTP, the scammers drain the account.
● How to Avoid: Never click on links in SMS alerts regarding account blocks. Official banks never ask for KYC updates via SMS links; always use the official mobile app or visit the physical branch.
Speaking on trust and safety, PhonePe describes social engineering as a tactic in which fraudsters create urgency and manipulate people into voluntarily revealing sensitive financial information. As per the PhonePe, one should be aware that fraudsters create an urgency so that the victim does not have the liberty of time to evaluate the situation.
The Scale of Bank Spoofing Fraud (2026 Data)
● The Primary Vector: Phishing and smishing account for over 35% of all digital banking fraud incidents reported in India. It is the single most common way retail banking consumers lose their savings.
● WhatsApp is the New Frontline: While traditional SMS remains high, over 60% of spoofed banking alerts are now delivered via WhatsApp. Scammers use compromised or verified-looking business accounts displaying stolen bank logos to lower the victim's guard.
● High Penetration Rates: Out of all consumers targeted by fake KYC/PAN block alerts, roughly 12% to 15% click the link, and a critical 5% enter their credentials. The panic of losing access to a primary bank account causes immediate compliance.
● The 90-Second Drain: Once a victim inputs their net banking credentials and OTP into the spoofed portal, automated scripts (bots) log into the real bank account and execute a transfer to a mule account in under 90 seconds.
Phishing and smishing remain major entry points for digital fraud. McAfee's 2026 research found that Indians receive an average of 13 scam messages every day across text, email and social media. Separately, RBI data recorded 13,516 card/internet frauds involving about Rs 520 crore during FY2024-25.
