Look, I've seen a lot of financial frauds in my time covering tech in India. But the fake HDFC Bank credit card reward points SMS scam going around in 2026 is genuinely ruthless. People lose lakhs of rupees in minutes. Honestly, it's one of the most effective cons I've seen recently. It preys on something we all hate. We hate losing money we feel we've already earned.
You spend all year racking up points. You buy groceries and pay electricity bills on apps. Maybe you book a flight. Then you get an SMS out of nowhere. It says your hard-earned points will vanish by midnight. So of course you click the link. You want to save your points. That's exactly what these scammers count on.
Here's the deal. India's credit card landscape is a mess right now. Big players like HDFC Bank and SBI Card have been tweaking their reward structures. They're capping benefits and changing redemption rules for platforms like SmartBuy. It's confusing. People are frustrated. And fraudsters know this. They read the financial news too.
So they send out millions of text messages. The texts claim your reward points are expiring. They use the current banking confusion as cover. And it works.
The Bombay High Court judge case
Think you're too smart to fall for this? In my experience, nobody is immune. Just recently, a sitting judge of the Bombay High Court lost Rs 6.02 lakh to this exact scam. A judge! Someone whose literal job is to analyze facts and spot lies. If a high court judge gets taken for a ride, you and I are absolutely vulnerable.
The judge got a message about his reward points. He called what he thought was the HDFC helpline and ended up talking to a scammer on WhatsApp. Then he was tricked into installing a malicious app on his domestic help's phone. That one app gave the scammers complete control. They siphoned off over six lakh rupees in a blink. (I know, it sounds crazy that an 18 MB file does that. But it's the reality of modern cybercrime, something we often discuss in our security guides.)
What exactly is the fake HDFC Bank credit card reward points SMS scam?
Basically, this is a highly targeted phishing and malware attack. Criminals blast out SMS messages to random Indian phone numbers. I'm not sure exactly why they target some numbers over others. The messages claim to be from HDFC Bank. They warn you that thousands of reward points on your credit card are about to expire. They include a link to redeem the points or a customer care number to call.
But the link doesn't go to HDFC NetBanking. The phone number doesn't reach HDFC customer support. Instead, they direct you to a trap. It's designed to steal your banking credentials and your credit card details. Mostly they want the OTPs sent to your phone.
How the scam works: a step-by-step breakdown
To protect your bank account, you need to understand how these criminals operate. They follow a very specific playbook.
Step 1: The panic-inducing SMS
It starts with a text message. It might look like this: "Dear Customer, your 8,500 HDFC Credit Card reward points worth Rs 4,250 will expire today. Click here to redeem instantly." The message uses an urgent tone. They want you to act fast. You act before your brain has time to critically evaluate the situation.
Step 2: The fake portal or WhatsApp trap
If you click the link, one of two things happens. Sometimes it takes you to a fake website. It looks exactly like the HDFC NetBanking login page. You enter your Customer ID and password there. The scammers capture it instantly.
More recently, the scammers use a different tactic. The link or phone number directs you to a WhatsApp chat. A "customer service agent" politely explains you need to download a "support app" to process the reward point redemption. This agent is actually a scammer sitting in a call center in Jamtara or Mewat. The numbers here are a bit fuzzy on how many of these centers exist.
Step 3: The malicious APK download
This is the trap. The scammer sends you an APK file over WhatsApp. An APK is just an installation file for Android apps. They might call it "HDFC_Rewards.apk" or "QuickSupport.apk". They insist you install it to get your points. Never, under any circumstances, install an APK file sent over WhatsApp.
Step 4: Screen sharing and complete control
Once you install that app, you're in deep trouble. The app has malware. It gives the scammers remote access to your phone. Sometimes it's a hidden screen-mirroring tool. The app asks for permissions to view your screen and read your SMS messages.
Because you think it's a legitimate banking app, you grant those permissions.
Step 5: The silent drain
Now the scammers have everything. They have your credit card number (which you probably typed into their fake form). They have remote access to your phone. So they initiate a massive transaction. They might buy expensive electronics online or transfer funds to a dummy account.
The bank sends an OTP to your phone to verify the transaction. Normally this protects you. But the scammers have malware on your phone. They can intercept the OTP and even delete the SMS before you see it. They approve the transaction themselves. You only find out when the money is gone.
Warning signs you are being targeted
You can spot this scam a mile away if you know what to look for. Here are the red flags:
- Urgency: Real banks rarely give you a 24-hour ultimatum for reward points. They expire at the end of the month, not randomly on a Tuesday afternoon.
- Suspicious Links: Look at the URL in the SMS. It won't be "hdfcbank.com". It'll be something weird like "hdfc-rewards-redeem.in" or a bit.ly short link.
- WhatsApp Communication: Your bank will never initiate a customer support chat on WhatsApp to process reward points. They definitely won't send you files.
- Requests to Install APKs: This is the biggest warning sign. Official banking apps are downloaded from the Google Play Store or the Apple App Store. Period.
- Asking for PINs or Passwords: A legitimate bank employee will never ask for your NetBanking password, ATM PIN, or CVV.
How to protect your bank account right now
We rely on our phones for everything now. We use them for UPI payments and DigiLocker access. A compromised phone is a financial disaster. If you ask me, you have to lock your phone down tight. Here's exactly what you need to do to stay safe.
First, ignore the SMS. If you get a message about reward points, just delete it. Don't engage with it. If you're genuinely worried about your points, open your official HDFC mobile banking app. You can also type the official URL into your browser. Check your points there. Never trust the link in the text message.
Second, disable "Install from Unknown Sources" on your Android phone. This setting prevents you from accidentally installing malicious APK files downloaded from outside the Play Store. Go to your phone's settings. Search for "unknown apps". Make sure it's turned off for WhatsApp and your web browser.
Thing is, you should also read the security guidelines from CERT-In. The Indian Computer Emergency Response Team regularly publishes warnings about these specific malware campaigns. They do good work. It's worth paying attention to their alerts.
Finally, just slow down. Scammers win when you rush. Take a breath. Ask yourself if it makes sense that a bank is WhatsApping you a file to give you free money. It doesn't.
What to do if you've already fallen for it
Let's say you clicked the link. Let's say you downloaded the app. Panic is setting in. Stop. Take a breath (which makes sense, actually). You need to act immediately. But you need to act smart.
- Disconnect your phone: Turn on Airplane mode immediately. This cuts off the internet connection and severs the scammers' remote access to your device.
- Block your cards: Use another phone (a family member's or friend's) to call HDFC Bank customer care and block your credit card and NetBanking access immediately.
- Report the fraud: This is non-negotiable. Call the National Cyber Crime Reporting Portal helpline at 1930. You must do this as fast as possible. The sooner you report, the higher the chance authorities can freeze the stolen funds before the scammers withdraw them.
- File an official complaint: Go to cybercrime.gov.in and file a detailed report with all the evidence — the SMS, the phone numbers they used, and the transaction details.
- Factory reset your phone: The only way to be 100% sure the malware is gone is to completely wipe your phone. Do a full factory reset before you turn the internet back on.
The bottom line
Look, I know dealing with banks is annoying. I know keeping track of reward points is a hassle, especially with all the recent devaluations. But you cannot let that frustration make you careless. The fake HDFC Bank credit card reward points SMS scam of 2026 is claiming new victims every single day in India. We track these financial frauds closely.
Scammers are getting better at making their messages look real. They get better at manipulating people over the phone. But they still rely on you opening the door for them. Don't click the sketchy links. Don't download files from strangers on WhatsApp. Protect your bank account. Getting your money back after a cyber fraud is a nightmare you do not want to deal with.
Stay sharp out there. Share this with your parents and older relatives. They are often the prime targets for these kinds of attacks.
