Electricity Bill and KYC Update Scams: Same Trick, New Label

Two messages, one gang. "Dear consumer, your electricity will be disconnected tonight at 9.30 pm because your previous month's bill was not updated. Contact our officer 9xxxxxxxxx." And: "Dear customer, your SBI YONO account will be blocked today. Update your KYC immediately: [link]." The KYC scam and the electricity bill scam share a script, a sender, and an ending. The label changes with the season; the trick does not.

This explainer takes both apart, shows what happens after you call or click, and lists the official ways to check a bill or a KYC status so that no message ever needs answering.

The KYC scam and the electricity bill scam, side by side

What happens when you call the electricity number

A man answers as an officer from the distribution company. He has your name and address, which came from a leaked list. He explains that your online payment did not update and that the disconnection order is already issued, but he can stop it if you clear the difference now. The amount is small: ₹10 to a few hundred. He sends a link, or asks you to install TeamViewer QuickSupport or AnyDesk "to update the server", or sends a UPI collect request labelled as the bill. The screen sharing is the real aim: once connected, he watches you log in to your bank app and reads the OTP as it arrives. Our explainer on screen-sharing app fraud covers what happens from there.

What happens when you click the KYC link

The link opens a page that copies the bank's login, often with the right logo and colours. You enter your user ID, password and sometimes card details and date of birth. A "verification" OTP arrives and you enter it; it was generated by the scammer logging in as you at the same moment. Some versions skip the page and send an APK called something like "SBI KYC Update" or "HDFC Secure"; installed, it forwards your SMS and lets the gang register UPI on their device. In the phone version, the "bank executive" asks you to read the OTP to complete the re-KYC. Every route ends at the same place.

How real utilities and banks actually do it

Electricity distribution companies disconnect for non-payment after a notice printed on the bill and a grace period set by the state regulator, and the status is visible in the company's app, on its website against your consumer number, and on BBPS bill-payment screens in PhonePe, Google Pay and Paytm. No utility sends a disconnection warning from a mobile number with a personal number to call. Several, including BSES and MSEDCL, have published warnings about exactly this message.

Banks run re-KYC on a schedule set by the Reserve Bank. When it is due, it appears inside the official app or net banking, and can be completed there, at the branch, or through a video-KYC session that you book through the official channel. The RBI has issued public cautions about fraudsters using "KYC update" calls and messages, and has said plainly that banks do not ask customers to share credentials or install apps through links. A pending KYC never blocks an account the same day with no prior notice. If you want the regulator's position, the RBI page on this site explains its role, and the phishing, vishing and smishing guide covers the message patterns in general.

The thirty-second check that replaces every reply

If you already called, clicked or installed

If you installed anything: flight mode, uninstall it, and change your bank and email passwords from a different device. If you typed card details: call the bank's fraud line and block the card. If money has moved: dial 1930 with the transaction details so the receiving account can be frozen, file on cybercrime.gov.in, and write to your bank the same day. Under the RBI's 6 July 2017 circular, a third-party fraud reported within three working days carries zero liability for the customer; banks will argue a transaction you authenticated was yours, and the argument back is that deception by a stranger is third-party fraud. The order of steps is on our reporting page.

Report the number or sender on Chakshu at Sanchar Saathi, which leads to disconnection; our Chakshu guide shows the form. If the OTP was read out, our OTP fraud explainer covers how to contest the bank's "customer-induced" label, and if your phone lost network at any point, the SIM swap explainer explains why that matters.

Then the usual warning. If you lost money, a "recovery agent", a "bank reversal desk" or a "cyber lawyer" will call, knowing the exact figure, and ask for a fee to get it back. Your details are on a list the gang sells. Nobody can guarantee recovery, and no agency contacts victims unasked. If you want the bank correspondence and follow-ups handled, our financial fraud response service works on a fixed fee agreed beforehand. The category is described on the phishing, vishing and smishing page.