---
title: "I got a KYC update message or call: is it really my bank?"
description: "A message or call says your KYC is pending and your account will be blocked. Your rights, how to fight it step by step, and what to do if it is fake."
url: "https://dpdpr.in/rights/scenarios/fake-kyc-sms/"
canonical: "https://dpdpr.in/rights/scenarios/fake-kyc-sms/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# I got a KYC update message or call: is it really my bank?

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

An SMS, WhatsApp or call says your KYC is pending. Sometimes a real bank employee or agent asks you to send KYC documents to their personal WhatsApp. That is not a safe way for a bank to collect your documents, and the bank answers for its staff and agents. Often it is simply fraud with a link.

**Safety first.** Threatened or in danger: call **181** (women) or go to the nearest police station. Lost money: call **1930** at once.

## Your rights

- **Right to privacy of your banking data.** RBI's Charter of Customer Rights says your personal information must be kept confidential unless you consent, the law requires it, or it is for a mandated purpose such as credit bureaus, and that you are protected from communications that infringe your privacy.
- **Right to have the bank answer for its agents.** RBI's 2025 Outsourcing Directions make the bank responsible for DSAs, DMAs and recovery agents and for the confidentiality of your information with them.
- **Right to a reply within 30 days, then the RBI Ombudsman.** Free, under the Reserve Bank Integrated Ombudsman Scheme, 2026.
- **Right to compensation.** The Ombudsman can award up to Rs 30 lakh for consequential loss plus up to Rs 3 lakh for your time, expenses and harassment. A Consumer Commission can also award compensation (file within 2 years).
- **Right to compensation if a company is careless with sensitive data** (passwords, bank or card details, health records, biometrics and similar). IT Act section 43A, with the 2011 SPDI Rules, until 13 May 2027.
- **Right to police help.** The police must take your complaint about threats, stalking or harassment. You can also report online at cybercrime.gov.in.
- **DPDP rights from 13 May 2027.** You can ask what data the company holds and who it shared it with (section 11), ask for correction or erasure (section 12), and complain to the company, then to the Data Protection Board (sections 13 and 27). The company answers for its processors (section 8(1)).

## How to fight it, step by step

One action per step. Each step says what to write, what to attach, what you get back, and how long to wait before the next step. If the person turns out to be fake, skip to [If it is fake](#fake).

1. **Save the evidence before you block or delete anything.**
What to write: A short note with the date, time, number used, and exactly what was said or what details they knew.
What to attach: Screenshots of the call log, SMS, WhatsApp chats (with the number visible), and any payment screen.
What you get back: A record that cannot later be denied.
How long to wait: Do this the same day.
2. **Complain to the bank through its official app, website or branch (not the caller's number).**
What to write: Letter 1 below: ask whether the caller works for the bank.
What to attach: Screenshot of the call log or messages.
What you get back: A complaint number or written acknowledgement.
How long to wait: Note the date. The bank has 30 days.
3. **Send Letter 2 below to the bank's grievance officer. The bank's website lists its escalation contacts, often including a Principal Nodal Officer.**
What to write: Letter 2: how your data reached a personal phone.
What to attach: Letter 1, its acknowledgement, your evidence.
What you get back: A second acknowledgement.
How long to wait: Up to 30 days from your first complaint.
4. **Send one written follow up to the grievance officer.**
What to write: Your complaint number, the date you complained, and: "I have had no reply (or an incomplete reply). Please reply in writing within 7 days, or I will escalate to the RBI Ombudsman."
What to attach: Your first complaint and its acknowledgement.
What you get back: Proof that you gave the company a fair chance. Regulators and Commissions ask for this.
How long to wait: 7 days, then go to the next step.
5. **Complain to the RBI Ombudsman on cms.rbi.org.in.**
What to write: What happened, your complaint number with the bank, and what you want (written confirmation, action, compensation).
What to attach: Your complaints, the bank's replies, your evidence.
What you get back: An RBI complaint number. Track it on the same site.
How long to wait: File within 90 days after the bank's 30 days ran out or its last reply. If you disagree with an Award you can appeal within 30 days.
6. **File a police complaint, or ask for an FIR.**
What to write: A signed complaint to the officer in charge of your local police station, or online at cybercrime.gov.in. Say what happened, when, the numbers used, and that the person misused your banking data (you may mention IT Act section 72A, and threats or harassment if any).
What to attach: Printouts of your screenshots and a copy on a pen drive. Your ID proof.
What you get back: An FIR copy, or at least a written acknowledgement of your complaint. Online, you get an acknowledgement number.
How long to wait: Do this at once if you feel unsafe. Do not wait for the company.
7. **Call the National Consumer Helpline on 1915, or file on consumerhelpline.gov.in.**
What to write: The company's name, your complaint number with it, what went wrong, and what you want (for example: action against the person, written confirmation, compensation).
What to attach: Your complaint, the company's replies, and screenshots.
What you get back: A docket number. The helpline takes your complaint up with the company. It is free and comes before a court case.
How long to wait: Give it a few weeks. If nothing changes, go to the Consumer Commission.
8. **File a consumer case for deficiency in service on e-Jagriti.**
What to write: Who you are, the company, what service you used, what went wrong, the loss and distress caused, and the compensation you claim.
What to attach: Everything above: evidence, letters, replies, helpline docket.
What you get back: A case number and hearing dates. You can argue the case yourself. The District Commission hears cases where the value of what you paid is up to Rs 50 lakh, the State Commission up to Rs 2 crore, and the National Commission above that (2021 Rules).
How long to wait: File within 2 years of the problem.
9. **Get a lawyer if the stakes are high.**
What to write: Nothing yet. Take your full file to the lawyer.
What to attach: All of the above.
What you get back: Advice on a legal notice, a claim before your State's IT Adjudicating Officer, or a civil suit for damages.
How long to wait: Before you send any legal notice or file a suit. This page is not legal advice.

## What people tried and what worked

- The reports we read did not say what worked. The steps below are the official route.

Based on reports on public forums. Paraphrased, with no usernames or personal details. What worked for one person may not work for you; the numbered steps above are the official route.

**Not legal advice.** This page explains the rules in plain words so you can act. Consult a lawyer before you sue anyone or send a legal notice. Laws and portals change; check the linked official source.

## Step 1: stay safe and find out who it is

1. Do not click any link or call any number in the message.
2. Check the sender. Bank SMS come from a header ending in -S or -T, not a 10 digit mobile number.
3. Open your bank's official app or website yourself and look for a KYC alert.
4. Call the number on your card or passbook and ask if KYC is due.
5. If a real employee asked for documents on personal WhatsApp, note their name and number for Letter 2.

## If it is genuine: hold the company accountable

### Which rules this may break

- **RBI Outsourcing Directions, 2025 (para 17):** the bank stays responsible for the actions of its service providers, including DSAs, DMAs and recovery agents, and for the confidentiality of customer information they hold.
- **Same Directions (para 24):** agents may see customer information only on a need to know basis.
- **Same Directions (para 28):** the bank must tell RBI at once about a breach or leak of confidential customer information, and is liable to its customers for any damage.
- **RBI Charter of Customer Rights (2014), Right to Privacy:** personal information must be kept confidential unless you consent, the law requires it, or for a mandated purpose.
- **SPDI Rules, 2011:** bank account, card and other financial details are sensitive personal data (rule 3). They may not be disclosed to a third party without your prior permission (rule 6).
- **IT Act section 43A (until 13 May 2027):** negligence with sensitive data that causes wrongful loss or gain means compensation.
- **IT Act section 72A:** a person who discloses your information in breach of a lawful contract, to cause wrongful loss or gain, commits a crime (up to 3 years or fine up to Rs 5 lakh).

### What the company must do, and by when

- Give you a complaint number and a written acknowledgement.
- Check whether the caller is its employee, DSA, DMA or recovery agent, and what customer data that person could access.
- Reply to you within 30 days. If it does not, or you are not satisfied, you can go to the RBI Ombudsman.
- Tell RBI at once if confidential customer information leaked (Outsourcing Directions, para 28).
- Act against the person or agency. Ask in writing what it did; the Directions keep the bank responsible for its agents.
- From 13 May 2027: tell you what data it holds and who it shared it with if you ask (DPDP section 11), and report breaches to you and the Board (section 8(6)).

### Letter 1: ask them to confirm who the caller is

Send it through the official channel. Keep a copy and the acknowledgement.

To: The Grievance Officer, \[Bank name\] Subject: Please confirm whether this person works for you Dear Sir or Madam, I am your customer. My account or customer ID: \[number\]. On \[date\] at \[time\] I received a call or message from \[phone number\]. This is not an official number. The person said they were \[name\], \[role or employee ID\], from the bank. They knew my \[list the details they knew\]. Please confirm in writing within 7 days: 1. Whether this person is your employee, agent, DSA, DMA, recovery agent or partner. 2. If yes, their name, role and the agency they work for. 3. Whether you allow staff or agents to contact customers from personal numbers. 4. If they are not connected with you, please say so, so I can report the number. Name: Registered mobile number: Date:

### Letter 2: ask how your data got there

To: The Grievance Officer, \[Bank name\] Subject: How did my personal data reach a personal phone? Complaint number \[if any\] Dear Sir or Madam, On \[date\] a person connected with you, \[name if known\], contacted me from a personal number \[number\] and knew my \[details\]. \[Describe what they did.\] Please tell me in writing: 1. What personal data about me this person could see, and through which system or app. 2. Whether you shared my data with any agency, DSA, DMA, recovery agent, partner or processor, and their names. 3. How my data reached a personal phone or account outside your official systems. 4. What action you have taken against the person or agency, including suspension while you investigate. 5. What you have done to stop this happening again. 6. Whether you have reported this to RBI, as the 2025 Outsourcing Directions require for a leak of confidential customer information. Under the RBI (Commercial Banks: Managing Risks in Outsourcing) Directions, 2025 the bank is responsible for its service providers, including DSAs and recovery agents, and for the confidentiality of customer information they hold, and must notify RBI of a leak of confidential customer information. From 13 May 2027, sections 8 and 11 of the Digital Personal Data Protection Act, 2023 also apply. Please reply within 30 days. If I do not hear from you, I will escalate to the RBI Ombudsman. Name: Registered mobile number: Date:

### Evidence to keep

- Screenshot of the message with the sender and link.
- Time received.
- If an employee asked for documents: the chat with their number.

More in the [evidence checklist](https://dpdpr.in/rights/evidence-checklist/).

### Can you sue? What realistically happens

- **Consumer Commission:** the most practical route for compensation. Cheap, no lawyer needed, file within 2 years.
- **IT Act section 43A (until 13 May 2027):** if the company was negligent with *sensitive* personal data (passwords, bank or card details, health records, biometrics) and that caused wrongful loss or gain, it must pay compensation. Claims up to Rs 5 crore go to your State's IT Secretary acting as Adjudicating Officer (section 46); larger claims go to a court. Appeal within 45 days (section 57). Your phone number and address alone are not sensitive data under the 2011 Rules.
- **Civil suit for damages:** possible, but slow and costly. Section 61 of the IT Act bars civil courts from matters the Adjudicating Officer can decide.
- **Police:** only where there is a crime, for example a person who disclosed your information in breach of a contract to cause wrongful loss or gain (IT Act section 72A, up to 3 years), identity theft (66C), cheating by impersonation (66D), stalking or threats.
- **Realistic outcome:** most people get results from a firm written complaint and the regulator or ombudsman. Courts take years. Consult a lawyer before suing.

### From 13 May 2027: the Data Protection Board

From **13 May 2027** the DPDP Act's duties apply. The company is responsible for processing done by it or by anyone processing on its behalf (section 8(1)), may use a processor only under a valid contract (section 8(2)), must protect your data with reasonable security safeguards (section 8(5)), and must tell you and the Board about a breach (section 8(6)). It may use your data only for the lawful purpose you agreed to (sections 4 to 6). Section 44(2) removes IT Act section 43A from that date. Complain to the company first; if it does not resolve it, complain to the Data Protection Board. The Board can impose penalties up to Rs 250 crore, but **penalties go to the Government (the Consolidated Fund of India, section 34), not to you**. For money, use the ombudsman or the Consumer Commission. Appeals from the Board go to TDSAT within 60 days (section 29).

## If it is fake: urgent steps

1. If you clicked and typed details, call the bank's official number and block everything.
2. Call 1930 if money left your account.
3. Report the message on Chakshu, in the KYC category.
4. Keep the evidence.

Step by step guides:

Report a fraud call, SMS or WhatsApp on Chakshu (Sanchar Saathi)

### Report a fraud call, SMS or WhatsApp on Chakshu (Sanchar Saathi)

Chakshu is run by the Department of Telecommunications. Use it for calls or messages that try to cheat you, such as fake KYC, fake police, fake customer care, job or loan offers and sextortion. It is for numbers that tried to cheat you. If you already lost money, call 1930 first.

**Keep this ready before you start:**

- A screenshot of the call log or message. The form asks for one.
- The number or SMS header that contacted you.
- Date and time (within the last 30 days).
- Any phone numbers or links mentioned in the message.
- Your own mobile number, to get an OTP.

1. Open [sancharsaathi.gov.in/sfc](https://sancharsaathi.gov.in/sfc/), or open the **Sanchar Saathi** app (Google Play or App Store).
2. On the website, under **Citizen Centric Services**, choose **Chakshu - Report Suspected Fraud Communication**.
3. Under **Report Suspected Fraud**, click **Proceed**.
4. Choose how it came: call, SMS or WhatsApp.
5. Choose the category. The list includes: KYC and Payment related to Bank / Electricity / Gas / Insurance; Impersonation as Police, CBI, Customs, Aadhaar, RBI; Fake Customer Care Helpline; Online job / lottery / gifts / loan offers; Sextortion; IVR / Robo Calls; Malicious link / website; Investment, Stock Market and Trading; Impersonation as DoT / TRAI; Impersonation as a relative / friend; Any Other Suspected Fraud.
6. Attach the screenshot. The portal may fill some details from the image. Check them.
7. Type the number it came from. For an SMS with a name instead of a number, choose **With header** and type the header.
8. Enter the date and the time in HH:MM AM/PM format.
9. In **complaint details**, write at least 30 characters. Say what they asked for and what they claimed.
10. Add any phone numbers and links that were in the message.
11. Enter the mobile number on which you got the call or message.
12. Type the captcha. Click **Verify Mobile via OTP**. Enter the OTP. Click **Verify OTP**.
13. Tick the declaration. Click **Preview**. Check it. Click **Submit**.
14. Take a screenshot of the thank you message. The Department says it will not send you individual results, for privacy reasons.
15. If it came on WhatsApp, also report the chat inside WhatsApp. The portal asks you to do this.

Checked on 1 November 2026 against: [Chakshu: report suspected fraud or spam (Sanchar Saathi)](https://sancharsaathi.gov.in/sfc/), [Sanchar Saathi portal and FAQ (Department of Telecommunications)](https://sancharsaathi.gov.in/).

Report money lost to fraud: call 1930

### Report money lost to fraud: call 1930

1930 is the national cyber crime helpline run with the Ministry of Home Affairs. It links your report to banks and wallets so they can try to stop the money. Call as fast as you can. The sooner the report reaches the bank, the better the chance.

**Keep this ready before you start:**

- Your mobile number.
- Name of the bank, wallet or app the money left from.
- Account number, wallet ID or UPI ID that was debited.
- Transaction ID or 12 digit UTR number for each payment.
- Date and amount of each payment.
- Card number, if a debit or credit card was used.
- Screenshots of the payment and of the chat or SMS.

1. Dial **1930** from any phone.
2. Tell them you want to report a financial cyber fraud.
3. Give each transaction one by one: bank, transaction ID or UTR, date and amount.
4. Write down the acknowledgement number they give you. It also comes by SMS.
5. Save that SMS. Take a screenshot of it.
6. Now file the full complaint on [cybercrime.gov.in](https://cybercrime.gov.in) (steps below). The official cybercrime.gov.in instructions ask you to complete it within 24 hours of the call.
7. Call your bank's official customer care number too, and ask them to block the card, UPI or account. Use the number on your card or passbook.

Checked on 1 November 2026 against: [I4C (Ministry of Home Affairs): National Cybercrime Reporting Portal and 1930](https://i4c.mha.gov.in/ncrp.aspx), [National Cyber Crime Reporting Portal: FAQ](https://cybercrime.gov.in/Webform/FAQ.aspx).

## Related guides

- [\*\*Banks\*\*Fraud, unauthorised transactions, data misuse and how to reach the RBI Ombudsman.](https://dpdpr.in/rights/banks/)
- [\*\*Spam calls, SMS and telemarketing\*\*Block marketing, complain within 7 days, and report fraud calls on Chakshu.](https://dpdpr.in/rights/spam-calls-sms/)

See also [when a platform shares your data with a third party](https://dpdpr.in/rights/platforms-and-third-parties/) and the [escalation ladder](https://dpdpr.in/rights/escalation-ladder/).

## Official sources

Checked on 1 November 2026. Company pages are labelled as the company's own words.

- [RBI (Commercial Banks: Managing Risks in Outsourcing) Directions, 2025 (28 November 2025)](https://www.rbi.org.in/scripts/BS_ViewMasDirections.aspx?id=13139)
- [RBI releases Charter of Customer Rights (3 December 2014)](https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=32667)
- [RBI: Reserve Bank Integrated Ombudsman Scheme, 2026 (FAQs)](https://www.rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id=3407)
- [RBI Complaint Management System (CMS)](https://cms.rbi.org.in/)
- [IT (Reasonable Security Practices and Sensitive Personal Data) Rules, 2011 (India Code)](https://upload.indiacode.nic.in/showfile?actid=AC_CEN_45_76_00001_200021_1517807324077&filename=GSR313E_10511%281%29_0.pdf&type=rule)
- [IT Act section 43A: compensation for failure to protect data (India Code)](https://www.indiacode.nic.in/show-data?actid=AC_CEN_45_76_00001_200021_1517807324077&orderno=49§ionId=13058§ionno=43A)
- [Information Technology Act, 2000, updated text (India Code)](https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf)
- [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf)