In plain terms
The government does not block your Aadhaar by SMS, and your bank does not hold your account hostage with a link. Anyone claiming either is selling fear to harvest data.
SMS and WhatsApp messages saying “Your Aadhaar will be deactivated” or “Bank KYC incomplete — account will be blocked, update now” followed by a link are the most-imitated phishing script in digital India.
What the link actually does
The link clones the look of a bank or UIDAI page. You enter your phone number, OTP and sometimes your PIN — and that is all the attacker needs to drain your account or swap your SIM.
Why it matters
- Fear of losing an account is the hook; speed of clicking is the trap.
- The moment you enter an OTP on a stranger’s page, it stops being your OTP.
- SIM swaps often start exactly this way — the number you receive texts on is being taken over.
Key takeaways
- Threat + link + urgency = phishing.
- Legitimate KYC lives inside official apps, not texted links.
- An OTP typed on a stranger page is a key handed over.
The official truth
- Government agencies and banks never warm you of deactivation via a texted link.
- Aadhaar updates happen on the official UIDAI portal/app; banks update KYC inside their own app with your login.
- A genuine OTP message never arrives together with a request to enter it on a site you reached from a text.
What you should do
- Never tap links in messages that threaten account blocking.
- For real KYC, open your bank’s app or the official portal yourself and check the notices section.
- If you did enter details, block the card, inform the bank, and file on cybercrime.gov.in immediately.