Loading page
About this tool
India-first teardown of KYC-expiry scam messages, with a scanner that weighs remote-access, UPI-PIN and identity-harvest markers in anything you paste.
This explainer dissects the KYC-expiry scam message — "your KYC has expired as per RBI guidelines, the account will be blocked today" — and names the pressure tactic in each line, including the two endings that actually take the money: a screen-sharing app installed for "assisted KYC", and a one-rupee verification approved with your UPI PIN. A scanner scores anything you paste against 13 weighted markers of the same family and inspects every link's registrable domain. Periodic KYC updation is a genuine RBI requirement, which is exactly why this pretext works.
Open KYC Update Phishing Anatomy on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
Sets the scam against how periodic KYC updation actually works under the RBI Master Direction, so the pretext falls apart on its own terms.
Screen-sharing requests and UPI-PIN prompts carry the highest weights, because those are the steps that move money rather than just collect data.
Every rule executes in your browser; a message you are unsure about is never uploaded.
No. The Reserve Bank of India holds no individual accounts and never contacts customers about their KYC. Periodic updation is your own bank's obligation, and any message invoking RBI to demand action within hours is a scam.
Under the RBI Master Direction on KYC, periodic updation runs at least every two years for high-risk customers, every eight years for medium risk and every ten years for low risk. Where none of your details have changed, banks may accept a self-declaration of no change through registered email, registered mobile, ATM, net banking or the branch.
Because the nine-digit code those apps display is a session key. Once it is shared, the caller sees your screen and incoming SMS in real time and can operate your banking app while talking you through a form, which is why it is the most common ending of this scam.
No. A UPI PIN is only ever required to send money — never to receive it or to verify an account — and the collect request you approve can carry any amount. Treat any request to enter a UPI PIN for a check, refund or verification as an attempt to take money, and confirm anything KYC-related with your bank directly.