Fake KYC Video Call Scam: Bank Officials Stealing OTPs

The fake KYC video call scam has quietly become one of the more dangerous frauds hitting Indian bank customers in 2026. Your phone rings. It's a video call. A person in a suit, sitting in what looks like an official bank office, introduces themselves as a KYC verification representative. They know your name. They mention your bank branch. And they warn you that your account will be frozen within 24 hours unless you complete video verification right now.

That's the setup. And it's working on a lot of people.

A fake call centre busted recently had operators running KYC update scams alongside reward point redemption scams at the same time, according to Times of India reporting. Two arrests were made. But for every fake call centre shut down, more appear. Cyber crime complaints in India crossed 17 lakh in 2023-24, per MHA data, and KYC-related fraud is a significant slice of that. Kashmir Observer specifically called out KYC and OTP scams as being on the rise in their region, and it's not just Kashmir. This pattern is national.

How the fake KYC video call scam actually works

This isn't the crude "please share your OTP" call of a few years ago. The scam has evolved. Fraudsters now use video calls with official-looking backgrounds, printed bank logos visible in the frame, and in some cases AI-generated face overlays. The whole setup is designed to feel like a real bank interaction, and for a lot of people, it does.

Here's how it unfolds, step by step:

1. The initial call. You receive a video call, sometimes on WhatsApp, sometimes from a regular mobile number. The caller claims to be from your bank's KYC compliance department. They may already know your name, your bank branch, and your registered mobile number, all of which can be got from data leaks or bought in bulk online for a few hundred rupees.
2. The urgency trap. Your account will be "suspended" or "blocked for regulatory non-compliance" unless you complete video KYC right now. Because RBI's KYC norms are real, this framing sounds completely believable to most people.
3. Document capture. They ask you to show your Aadhaar card or PAN card on camera and read out the number aloud. Some go further and ask for "liveness verification," blinking or turning your head, mimicking the real video KYC processes that banks actually use in their apps.
4. The OTP extraction. While the call is ongoing, the fraudster triggers a real OTP to your phone by initiating an actual transaction or account change on their end. They then tell you this OTP is "for verification purposes" and ask you to read it out. The moment you do, the transaction completes on their side.
5. The disappearing act. The call ends. You feel reassured. Then an SMS arrives from your bank about a transaction you never authorised.

Some versions involve call merging, where the fraudster patches you into a real bank IVR mid-conversation, making background sounds seem authentic. Hyderabad Police issued a specific advisory on this call-merging technique and Deccan Chronicle covered it in detail. The goal is simple: make you hear familiar hold music or automated messages so your guard drops before the OTP request comes.

Warning signs this KYC call is not from your bank

The hardest thing about this scam is that it's engineered to feel exactly like a legitimate interaction. But there are tells, if you know what to look for.

• Real banks don't initiate video KYC through random incoming calls. If your KYC is actually due, you'll get an SMS from your bank's official registered sender ID, with a link to their official app or website, not a surprise video call.
• Any extreme urgency, "your account will be blocked in 2 hours," is almost always a pressure tactic. Banks send written notices and give you days to respond, not hours.
• A legitimate bank employee will never ask for your OTP. Not once. Not ever. This is a zero-exception rule that every bank in India repeats in their own communications.
• If the caller asks you to hold your Aadhaar or PAN card up to the camera, hang up immediately. That's document capture, not verification.
• They may claim to be from "RBI's KYC verification cell" or "UIDAI compliance department." These bodies do not call individual citizens for video KYC. Full stop.
• The video might look slightly off: too clean a background, unnaturally smooth facial texture, or lip movements that don't quite sync with the audio. AI-generated face overlays are now being used in some of these calls, per alerts from government cybersecurity channels.

Seniors are particularly targeted, and Moneylife has flagged this repeatedly in their fraud alert coverage. The Times of India reported on cyber crooks impersonating pensioner verification officials in Ludhiana, using the exact same playbook: a legitimate-sounding reason, manufactured urgency, then an OTP request. Small business owners are in the crosshairs too. Fraudsters have started calling GST-registered businesses claiming their current accounts need video KYC for "FEMA compliance." For individuals the losses run to a few thousand rupees. For businesses, several lakhs. (Honestly, the business-targeting angle doesn't get nearly enough coverage.)

How to protect yourself from KYC video call fraud

Some of this is common sense. But common sense is hard to access when someone is telling you your salary account will be frozen by tonight.

• Never share an OTP on any call, regardless of who the caller claims to be. Not for "verification." Not for "completing your KYC." No stated reason makes this acceptable.
• If someone calls about KYC, hang up and call your bank directly. Use the number on the back of your debit card or on the official bank website, not any number the caller offers to provide.
• Check your bank's official app or net banking portal for any actual KYC pending notices. If it's not showing there, the call was fake.
• Don't show Aadhaar or PAN on video calls you didn't initiate. Genuine video KYC happens inside your bank's secured official app, not over an incoming WhatsApp video call.
• Enable transaction alerts on SMS and the bank app so you know about any account movement in real time. Most banks offer this free of charge.
• Lock your Aadhaar biometrics through the UIDAI portal when not in active use. Our guide to Aadhaar biometric locking explains exactly how to do this in under five minutes, and it prevents authentication fraud even if someone has your Aadhaar number.
• CERT-In (https://www.cert-in.org.in/) publishes regular advisories on emerging scam techniques. Worth bookmarking, especially if you manage finances for elderly family members or run a small business.

One thing I'd add: don't assume your bank's brand protection will save you. SBI, HDFC, ICICI, Axis, all of them are impersonated regularly. The Times of India covered SBI specifically warning customers about fake communications with fraudulent app links. No bank is immune to impersonation, and neither are you.

The 2026 twist: deepfake faces on KYC video calls

This is the part that worries me most about where this scam is headed. We've written about deepfake video call fraud separately, but the KYC angle adds specific danger. Fraudsters now use real-time face-swapping tools to appear as someone in a bank uniform, with a bank logo visible behind them. On a low-bandwidth mobile video call, this can be surprisingly convincing.

The tell is subtle. Slightly robotic blinking. Lip-sync that's half a beat off. Facial texture that looks too smooth, almost like a photograph rather than a live face. If a video call ever gives you that uncanny-valley feeling, trust it. Hang up. A real bank official won't mind if you ask to call them back through official channels to verify their identity.

The government has issued a strict warning about hackers using fake identities on calls, and CERT-In has flagged AI-assisted impersonation as a growing threat category for 2026. I'm not sure exactly how widespread the deepfake tool usage already is at the lower end of the fraud market, but it's clearly not theoretical anymore.

What to do if you've already shared your OTP or Aadhaar

Act immediately. Every minute matters after an OTP is shared.

1. Call your bank's fraud helpline right now and ask them to block your account and reverse any pending transactions. Most major Indian banks have 24/7 fraud response lines.
2. Call 1930, the national cyber crime helpline, or file a complaint at cybercrime.gov.in. It's free, available around the clock, and this is your first official step toward a potential recovery.
3. Keep all records: the caller's number, screenshots, any SMS received, full transaction details. You'll need these for both the bank's fraud investigation and any police complaint.
4. File an FIR at your local police station as well. An online complaint at cybercrime.gov.in is important, but a physical FIR strengthens your case significantly for bank fraud reversal under RBI's guidelines.
5. Check if any new mobile connections have been registered using your Aadhaar through the Sanchar Saathi portal at sancharsaathi.gov.in. Fraudsters sometimes take out SIM cards in victims' names as a follow-up step.

RBI's position on this is unambiguous and has been repeated in multiple public advisories: no bank representative or RBI official will ever ask for your password, PIN, or OTP over a call or message. If someone on a video call is asking for any of these, the call is fraudulent, regardless of how official it looks or sounds.

The I4C (Indian Cyber Crime Coordination Centre) under MHA is actively coordinating with state police cyber cells on financial fraud cases. But detection and recovery still trail far behind the actual scale of the problem. A 2026 cyber crime guide by DeXpose notes that financial fraud is the largest category of cyber complaints received in India, and the numbers keep climbing.

What protects you isn't the response time of any government body. It's knowing how this works before it happens to you. Share this with your parents. Your elderly relatives. Anyone in your circle who might answer a video call from a "bank official" and not question it. And if you want to go deeper on related scams, see our explainer on fake Aadhaar update SMS scams, which often work in combination with video call fraud as part of a two-stage attack on the same victim.