Key takeaways
- Banks never ask for your OTP, PIN, CVV or full card number by call, SMS or WhatsApp.
- Urgency ("points expire today", "card will be blocked") is the biggest red flag.
- Report scam calls and SMS (no money lost) on Sanchar Saathi's Chakshu.
- If money was lost, call 1930 or report on cybercrime.gov.in immediately.
Most credit card fraud in India doesn't involve hacking. It involves someone convincing you to hand over an OTP or install an app. Knowing the common scripts is the best protection. Here are the scams we see most often, and what to do.
1. "Your reward points expire today"
An SMS says your points are about to expire and links to a site to "redeem" them. The site looks like your bank's and asks for your card number, expiry, CVV and then an OTP. Red flags: a short or misspelt link, urgency, and a request for card details to redeem points. Your bank already knows your card. Check points only in the official app.
2. "Credit limit increase" or "card upgrade" call
A caller claiming to be from your bank offers a higher limit, a free upgrade or a lifetime-free conversion. They "just need to verify" with an OTP. That OTP authorises a transaction, not an upgrade. Real limit increases happen in the bank app, and RBI rules require your explicit consent. Banks don't need your OTP over the phone.
3. "Update your KYC or your card will be blocked"
A message threatens to block your card unless you update KYC via a link or app. It leads to a phishing page or asks you to install an app that gives remote access to your phone. Never install apps at a caller's request.
4. Fake customer care numbers
Searching for "[bank] credit card customer care" can surface fake numbers in ads, forums or listings. The "agent" then asks for card details or screen sharing. Use only the number on the back of your card or the bank's official website.
5. "Annual fee reversal" or "insurance cancellation"
The caller offers to reverse a fee or cancel an unwanted add-on, and needs "a small verification transaction" or an OTP. Real reversals don't need your OTP.
6. Fake festive and sale offers
Around Diwali and big sales, messages offer impossible discounts ("iPhone at 80% off with your SBI card") via lookalike sites. Buy only from official sites and apps. See our Diwali guide for how real bank offers work.
The universal red flags
- Anyone asking for your OTP, PIN, CVV, full card number or net banking password. Banks never ask for these.
- Urgency and threats: "within 2 hours", "card will be blocked", "legal action".
- Requests to install an app or share your screen.
- Links in SMS or WhatsApp, especially shortened ones or lookalike domains.
- Calls from personal mobile numbers or WhatsApp claiming to be your bank.
- Offers that seem too good to be true.
How to report scam calls and messages (no money lost)
Use Chakshu on the government's Sanchar Saathi portal to report suspected fraud calls, SMS and WhatsApp messages, including fake customer care, impersonation, phishing links and fake offers. Reports help authorities block fraudulent numbers. Many banks also have a dedicated email or page for reporting suspicious messages that use their name.
If you've lost money
- Block your card in the bank app or through the official helpline.
- Report to the bank within 3 working days to protect your zero-liability rights.
- Call 1930 or file at cybercrime.gov.in immediately. Quick reporting can help freeze the money.
Full steps are in our first-hour fraud guide. Chakshu is for reporting suspicious communications; 1930 and cybercrime.gov.in are for money actually lost.
Protect your family
Older relatives are often targeted. Share a simple rule: "Never share an OTP with anyone, ever. If in doubt, hang up and call the number on the card." Set transaction alerts and sensible online limits on their cards, and consider switching off international use if they don't travel.
FAQs
Will my bank ever call and ask for my OTP?
No. Banks never ask for your OTP, PIN, CVV or passwords by phone, SMS, email or WhatsApp. Anyone who does is a fraudster.
Where do I report a scam call or SMS in India?
On Chakshu, part of the government's Sanchar Saathi portal. If you've lost money, call 1930 or report on cybercrime.gov.in.
I clicked a scam link but didn't enter anything. What should I do?
Close the page, don't enter details, and run a security check on your phone. If you entered any card details, block the card immediately.
Is a reward points expiry SMS always a scam?
Not always. Banks do send genuine reminders, but they won't ask for card details through a link. Check your points only in the official app or website.
Can scammers use my card with just the number and expiry date?
Most online payments in India need an OTP, so the number alone is often not enough. But combined with your OTP, or on some international sites, it can be misused. Block the card if your details are exposed.
What should I do if I shared my OTP?
Block the card immediately, report to your bank, and call 1930. Also change any passwords you shared and remove any app the caller asked you to install.
Sources
- Sanchar Saathi: Chakshu, report suspected fraud communication
- PIB: Chakshu facility of Sanchar Saathi
- National Cybercrime Reporting Portal (I4C)
- HDFC Bank: reporting suspicious fraudulent communication
