An SMS says your account will be blocked tonight. A WhatsApp number you don't know sends a link. Someone calls and says they're from your bank. No single test proves a message is genuine. What you can do is run four checks, look the number or link up in two free government databases, and contact the organisation on a number you found yourself.

Is this a scam? Four checks for any message

Most of these come straight from the RBI's consumer awareness page on cyber fraud.

1. Who sent it?

A bank, telecom company or government office writing from an ordinary 10-digit mobile number, a WhatsApp account you've never saved, or an email address that isn't the organisation's own. The RBI describes phishing as SMS and emails spoofed to make you think they came from your bank, so a familiar name at the top of the message proves nothing by itself.

The RBI's advice is to check website addresses in SMS and emails for spelling errors. A bank's name with an extra word stuck on (like "-kyc" or "-verify"), or with one letter swapped, should make you stop. More on links below.

3. What does it ask for?

This is the strongest tell. The RBI says never to share your account number, login ID, password, PIN, UPI PIN, OTP or card details with anyone, "not even with bank officials, however genuine they might sound." It also says receiving money never needs a QR scan or a PIN, and not to download unknown apps, because an app "may access your confidential data secretly." If a message wants any of these, you have your answer, whatever else it says.

4. How much of a hurry is it in?

"Blocked today." "Pay within 2 hours." "Stay on the call." In the scams this blog has covered, the deadline does the work: the jumped deposit caller wants a "wrong" credit back immediately, and digital arrest callers keep victims on video calls for months so they can't check with anyone. A genuine bank, courier or government office can wait while you call it back.

How to identify a fraud SMS, and check a fake bank SMS

Take a message like this one, made up but typical:

Dear Customer, your account will be suspended today due to pending KYC. Update now: kesaribank-kyc.example

The RBI names this exact pattern: a message threatening to block your account over KYC, with a link to fix it, "is a common modus operandi of fraudsters." Its advice is not to respond to offers to update KYC at all, and to go to the bank's official website or branch instead.

The sender line helps too. Under TRAI's February 2025 amendment, an SMS header should show what kind of message it is with a suffix: -P for promotional, -S for service, -T for transactional and -G for government. Bank alerts and OTPs are service or transactional messages. The same document says spammers use "normal 10-digit mobile/landline numbers" to pass as ordinary subscribers, so a "bank" SMS from a 10-digit mobile number is a red flag.

A correct-looking header still isn't proof, because the RBI warns that phishing SMS are spoofed. The real check is your bank's own app or statement. Log in there yourself: if it shows no block, payment or pending request, don't act on the SMS.

  1. Don't tap it from the message. Open the bank's or company's own app, or type the website address you already know.
  2. Read the whole website name. That's everything between https:// and the next /. The last part decides who runs the site, so kesaribank.verify-kyc.example belongs to verify-kyc.example, not to a bank. Check the spelling too, as the RBI advises.
  3. Look it up. Suspect Search on cybercrime.gov.in has a Website URL option. For a bank, the Trusted Contact Details page on Sanchar Saathi lets you search by website and shows the address the bank has listed.
  4. Never install an app from a link someone sends you. The RBI lists luring people into downloading an app as one of fraudsters' methods. Our digital arrest guide describes gangs sending APK files over WhatsApp and SMS disguised as traffic challans, bank updates or KYC documents.
  5. Keep apps updated. Sometimes the link is not a fake website at all: one Telegram Desktop bug, fixed in version 7.2.9, let a single link in a group steal a logged-in session.

How to check if a number is fraud

Search it in Suspect Search. The cybercrime.gov.in Suspect Search checks a mobile number (enter it without +91), email, bank account number, social media handle, UPI ID, mobile app or website URL. You fill in a captcha and it tells you whether that identifier has come up in citizens' cybercrime complaints.

Read the result carefully. The portal says the database "is not complete as cybercriminals are known to rapidly create, change and dispose such identifiers," and that I4C does not certify the complaints behind it. A match is a strong warning. No match means nobody has reported that number yet, not that it's safe.

Check it against the bank's real numbers. Sanchar Saathi's Trusted Contact Details lets you search by bank name, website, email or contact number, and lists each bank's or financial institution's website, email ID, official number, toll-free number, WhatsApp number and other customer care numbers. If the number that called or messaged you isn't there, call back on one that is.

Don't trust a number from a Google search. The RBI says "contact numbers on internet search engines may be fraudulent." Get customer care numbers from the official website, the back of your card or the app.

Is this call a scam?

Hang up if the caller:

  • asks for an OTP, PIN, UPI PIN, password or card number. The RBI rule above covers bank staff too.
  • offers to update or speed up your KYC. The RBI says not to respond to these offers.
  • says you are under "digital arrest" or must pay to clear your name. The CBI says no police, CBI or other government agency places anyone under digital arrest or demands money over a phone or video call.
  • says they sent you money by mistake and asks you to approve a request to return it. Our jumped deposit guide explains how that request takes far more than it "returns".

The number on screen helps a little. TRAI's 2025 amendment says the 1600 series has been "allotted exclusively for service and transactional calls," and the TRAI spam rules explainer covers which callers get those numbers. A 1600 number tells you who is likely calling. It doesn't make every request safe, and nothing changes the OTP rule.

WhatsApp scam message check

WhatsApp messages carry no SMS header, so the sender check comes down to the number. A bank logo in the profile photo is not a check.

  • Compare the number. Trusted Contact Details lists banks' official WhatsApp numbers where they have one.
  • Search it. A WhatsApp number is a mobile number, so it works in Suspect Search.
  • Don't open APK files, whatever they're called.
  • Walk away from "commission" offers to use your bank account or UPI. Accounts that pass on scam money can be frozen, and their owners have been arrested. See RBI's draft money mule rules.

Chakshu takes reports of WhatsApp messages as well as calls and SMS.

UPI requests and QR codes: check if a UPI ID is a scam

The RBI lists fake payment requests "with messages like 'Enter your UPI PIN' to receive money" as a fraud method, and says receiving money never needs a QR scan or your MPIN. So the rule is short: a PIN screen means money is leaving your account. Read the amount and the payee name every time.

To check a UPI ID someone has given you, use Suspect Search: UPI ID is one of its search options. The same limit applies. A clean result only means nobody has reported it yet.

What to do if you think it's a scam

Already tapped a link, shared an OTP or paid? Call 1930 and your bank's official number now, then file at cybercrime.gov.in.

If you haven't lost anything:

  1. Don't reply, tap the link or call the number in the message.
  2. Take screenshots of the message, the number or link, and any UPI ID, before you block anyone.
  3. Report it on Chakshu in the Sanchar Saathi portal. It takes suspected fraud calls, SMS and WhatsApp messages, such as fake bank, wallet, SIM, gas, electricity or KYC messages and impersonation of government officials. Report within 30 days for action.
  4. Or use Report Suspect on cybercrime.gov.in for a website URL, phone number, SMS header, WhatsApp number or Telegram handle, email ID, social media URL, deepfake or mobile app. It asks for a screenshot or other evidence (up to 5 MB) and a description of at least 100 characters.
  5. Block the number.
  6. If you sent a copy of your Aadhaar or PAN, follow the ID misuse steps to check the SIMs on your Aadhaar and your credit reports.

Where NO SUS fits

NO SUS does not run a scam checker and can't tell you whether a real message is genuine. For a message in front of you, use the lookups above.

What it has is practice. Scam ya Nahi? is a free daily game: five practice messages a day, mixing SMS, WhatsApp, email, UPI screens and call transcripts in English, Hinglish and Hindi. You tap SUS or NO SUS and Nox shows you the tell. The cards are written ahead from public warnings by the RBI, I4C, the Department of Telecommunications and PIB Fact Check, with made-up names and links that don't open, and no AI runs when you play. It's practice for the four checks above, not a checker.