Bank, OTP and KYC scams

Bank, OTP and KYC scams impersonate your bank to steal one-time codes, logins, or 'KYC' details and drain your account.

How bank, otp and kyc scams work

You're contacted by a fake 'bank security' text or call about a login, a blocked card, a suspicious transaction, or a pending KYC update.

You're pressured to share a one-time code, log in via a link, or update KYC - handing over the keys to your account.

Genuine banks resolve these inside the official app and never need your OTP, password, or PIN.

Common opening lines

• “A login was detected - share the code we just sent to confirm it's you.”
• “Your account will be blocked today; update KYC here to keep it active.”
• “This is the fraud team - move your money to a safe account now.”

Example patterns

Sanitised examples - placeholders only, never real links or data.

Red flags

• otp
• fake authority
• urgency
• credentials

What to do now

1. Secure the account: change the password and enable app-based 2FA.
2. Sign out other sessions and remove unknown linked devices/apps.
3. Warn your contacts and report the takeover.

What not to do

• Don't share verification or one-time codes with anyone, ever.
• Don't 'appeal' or 'verify' an account via a link in a message.
• Don't reuse passwords; turn on app-based two-step verification.

If you already responded

If you went further: if you clicked, don't enter anything and change any details you typed; if you entered card details, freeze the card with your bank; if you shared an OTP, change the password and enable app-based 2FA; if you paid, contact your bank or provider immediately; if you installed an app or gave remote access, disconnect, uninstall, and change passwords from a clean device.

How to verify safely

Call your bank only using the number on your card or in the official app, and log in only through the official app - never via a message link.

How to report

Report through official channels you find yourself - never a number or link from the message. Tell your bank or payment provider if money moved, and file with your national fraud or cybercrime body. Find the right links in the reporting directory. Open the reporting directory.

Watch for 'recovery' offers afterwards: anyone promising to get your money back for an upfront fee is running a second scam.

Sources checked

• CFPB - Classic warning signs of fraud and scams
• FBI IC3 - Senior US officials impersonated in malicious messaging campaign (2025)

Last reviewed: 2026-06-05

This is general safety information, not legal, financial, or cybersecurity incident-response advice. We can't detect every scam or guarantee recovery - always verify through official channels.