Identity Theft via KYC Fraud: How to Stay Protected

When you create an account with banks or financial institutions, they require you to verify your identity. This is done through a KYC Process that involves submitting documents like Aadhaar, PAN or other RBI-approved documents.

Today, financial institutions carry out this verification process through “Digital KYC”. Digital KYC involves capturing live photos of the customer and their documents or proof of possession of Aadhaar, where offline verification cannot be carried out.

What is Identity Theft via KYC Fraud and Account Suspension Scams?

In KYC identity theft, fraudsters steal your personal information or create fake identities and use them to complete the KYC process fraudulently. Once verified, they gain unauthorized access to your accounts or use your KYC to open a new account, take loans and credit cards in your name, leading to financial loss and reputational damage.

In today’s digital world, identity theft has become a major threat, especially when fraudsters use stolen or fake documents to complete KYC procedures and take control of your accounts.

Additionally, this threat extends to KYC related Account Suspension Scams. This is a fear-based social engineering tactic where fraudsters artificially create a high-stress situation. Scammers reach out claiming that your payment account, bank account, or digital wallet will be permanently blocked or suspended within a short timeframe (e.g., 24 hours) because your KYC documentation is incomplete or expired. The primary goal is to induce panic so you act impulsively, bypassing normal logical checks to hand over sensitive financial information or grant account access.

How Identity Theft and KYC Fraud Can Occur

• Scenario 1: Fraudsters can steal your personal identity information through various phishing methods..

 Arjun was approached by a fraudster who promised attractive investment returns. To proceed, Arjun was asked to verify personal details. Trusting the fraudster, he shared his account credentials and OTPs believing his investments would be managed securely. Using this stolen information, the fraudster accessed Arjun’s account and made unauthorized transactions.

• Scenario 2: Fraudsters may trick you into completing the KYC process for an account that isn’t yours. After that, they misuse the account for fraudulent activities without your knowledge. 

David was contacted by a fraudster who promised to help him secure a loan. The fraudster asked David to complete the KYC process on an account that had already been created in the fraudster’s name, not David’s. Believing it was a legitimate part of the loan application process, David complied. He submitted his personal details for KYC, unknowingly giving the fraudster full control of the account. The fraudster then misused the account for fraudulent loan transactions, leaving David unaware and at significant risk.

• Scenario 3: Fraudsters send text messages that mimic official bank or app communications containing urgent warnings to harvest login credentials. 

A frantic SMS from a sender masked as “PP-ALERT” pings Nisha’s phone late at night. Creating a false sense of emergency, the message includes a shortened link and reads: “URGENT: Your KYC is incomplete. Click here to verify your Aadhaar in the next 15 minutes, or your account will be permanently blocked and your funds seized.” Panicking, Nisha clicks the link, lands on a fake web page, and enters her number and the OTP she receives. But as the scammers attempt to use those stolen credentials to log into her account from a different city, PhonePe’s backend security takes over. PhonePe Protect instantly flags the unrecognized device and suspicious location jump. It blocks the login attempt entirely and pushes a real-time, in-app notification to Nisha’s actual phone: “Suspicious Login Attempt Blocked. Protect your account.”

• Scenario 4: A scammer poses as a compliance team executive, warning of an impending block and offering a “quick fix” that involves downloading a screen-sharing app.

A caller identifying herself as “Anjali from the KYC Compliance Desk” reaches out to Vikram, warning him that his wallet has been suspended due to a mandatory audit. She promises a two-minute resolution if he cooperates, instructing him to download a remote-access app and saying: “Install the QuickVerify tool and open your PhonePe app while I stay on the line. Our system will securely sync your details and unfreeze your wallet.” As Vikram complies and launches PhonePe with the screen-share app actively running in the background, the app’s internal security mechanisms trigger immediately. Device Guard detects the active screen-mirroring session, while the system recognizes the classic behavioral signs of social engineering. PhonePe immediately blackouts the screen to prevent the scammer from seeing any sensitive details and freezes the interface with a clear warning: “Potential Scam detected.”

Common Red Flags of KYC Fraud and Account Takeover

• Unexpected calls or emails about account opening you didn’t request.
• Alerts or SMS notifications for transactions you didn’t authorize.
• Receiving bills or credit cards you never applied for.
• Difficulty accessing your bank or financial accounts.
• Offers that sound too good to be true and trick people by stealing their identity.
• Urgent URLs sent via SMS, WhatsApp, or email claiming your account will be blocked or suspended if you do not update your KYC.

How to Protect Yourself from Identity Theft and KYC Fraud

• Secure Your Personal Information: Never share sensitive documents or OTPs over phone, email or messaging apps. Don’t share OTPs, UPI PINs, or ATM PINs with anyone, even if they claim it is necessary to stop an account suspension.
• Be Vigilant of Phishing Attempts: Avoid clicking on suspicious links or sharing info on untrusted websites. Don’t click on URLs sent via SMS, WhatsApp, or email that claim your account will be blocked or suspended.
• Regularly Monitor Your Accounts: Check bank statements, credit reports, and account activity for any unauthorized access.
• Use Strong Authentication: Enable two-factor authentication (2FA) wherever possible.
• Verify Communication: If contacted unexpectedly by financial institutions, verify their identity via official contact channels. Initiate contact with customer support only through the official numbers listed inside the verified app, never through numbers in random SMS warnings. Close any urgent message about account suspension and open the official app directly from your phone’s menu to check for legitimate notifications.
• Beware of Screen-sharing Apps: Credible customer care teams will never ask you to install third-party applications (especially remote desktop or screen-sharing apps).
• Report misused Documents Immediately: If your ID proofs are misused, report to relevant authorities and institutions.
• Use Official KYC Channels Only: Complete KYC through official websites or verified agents.

How PhonePe Actively Protects You

• Intelligent Risk Scoring Engines: PhonePe’s backend systems use machine learning algorithms to evaluate every transaction and login attempt in real-time. If a login occurs from an unrecognized device immediately after a suspicious link click, the system can flag or block the activity.
• In-App Centric Processes: PhonePe ensures that genuine KYC requests and account updates are only processed directly within the secure environment of the official application. They never force users to complete KYC via external web links sent in text messages.
• App Warnings: The PhonePe app is designed to display prominent, unmissable warnings when a user is about to perform a high-risk action, such as approving a login from a new device or transferring funds, breaking the “spell” of the scammer’s urgency.

What to do if your identity information has been misused on any PhonePe account 

If you suspect fraud or have been scammed through PhonePe, act quickly by raising the issue through any of the following channels:

• PhonePe Customer Care Number: Call PhonePe customer care at 80–68727374 or 022–68727374. The customer care agent will raise a ticket and assist you further.
• Social Media: Report fraudulent incidents on PhonePe’s official social media accounts:
  • Twitter: https://twitter.com/PhonePeSupport
  • Facebook: https://www.facebook.com/OfficialPhonePe
• Grievance Redressal: If you already have a complaint ticket, you can report a grievance at: https://grievance.phonepe.com/ using your ticket ID.

Reporting to Authorities

• Cyber Crime Cell: File a complaint online at Cyber Crime Portal or call 1930.
• Department of Telecommunications (DOT): Report suspicious messages, calls, or any fraud  request via the Chakshu facility on Sanchar Saathi Portal.