ArthPulse › Real or fake bank SMS

Real or fake bank SMS? How to spot SMS fraud in India

A genuine bank SMS comes from a registered business sender name, never from an ordinary mobile number, and it never asks you for an OTP, PIN or password. Since 2025, those sender names also end in a letter that says what kind of message it is. Check both, and treat any link or request in an SMS with suspicion.

Check 1: who sent it

Banks send from a business sender name, a short code of letters such as one ending in the bank's name. A "bank" message from a regular 10-digit mobile number is not from your bank.
Since 6 May 2025, the sender name ends in a suffix, added by the telecom operator under TRAI's rules: -T for transactional messages (alerts, OTPs), -S for service messages, -P for promotional ones and -G for government. A transaction alert marked -P is a warning sign.
A correct-looking sender is not proof on its own. Fraudsters imitate names closely. Use the sender as a first filter, then apply the checks below.

Check 2: what it asks you to do

A real transaction alert tells you something happened. Fraud asks you to do something. Red flags:

Any request for an OTP, PIN, CVV or password. Banks never ask for these, by SMS, call or link.
Urgency: "your account will be blocked today", "KYC expiring", "pay now to avoid a penalty".
Links, especially shortened ones, asking you to log in, update details or claim something.
"You have received money, enter your PIN to accept." You never need your UPI PIN to receive money. Entering it sends money out.
Requests to install an app or share your screen "for verification".

Check 3: verify it yourself

Do not use anything in the message. Open your bank's own app, type its official website address yourself, or call the number printed on your card. If the transaction is real, it will be there.

If you have been targeted

Lost money? Call the national cyber-crime helpline 1930 straight away and report at cybercrime.gov.in. Speed matters: the sooner it is reported, the better the chance of stopping the money.
Call your bank to block the card or account involved.
Got a suspicious message but did not act? Report it through the Department of Telecommunications' Sanchar Saathi portal (Chakshu), then delete it.

How ArthPulse handles fake messages

ArthPulse builds your spending record from bank alerts, so it has to tell real alerts from everything else:

Messages from ordinary mobile numbers are not treated as bank alerts. On the Google Play version, messages from an individual's number are dropped on your phone before anything is uploaded, so a fake "bank" SMS from a mobile number never reaches your record.
OTPs are never used as transactions, and on the Play version they never leave your phone.
Every debit lands in one list, across all your accounts and cards, so a payment you did not make stands out instead of hiding in one bank's app.

More on what ArthPulse reads and what it never touches.

See every debit, across every account, in one place. Free on Google Play.

Get ArthPulse

Questions

How can I tell if a bank SMS is genuine?

Genuine bank alerts in India come from a registered business sender name, not an ordinary 10-digit mobile number, and since 2025 that sender name ends in a suffix: -T for transactional or -S for service messages. Even then, never act on a link or a request in the message; check in your bank's own app or official website.

Do I need to enter my UPI PIN to receive money?

No. You never need your UPI PIN to receive money. A message or request asking you to enter your PIN to accept a payment is a scam: entering it sends money out of your account.

What should I do if I have been defrauded?

Call the national cyber-crime helpline 1930 immediately and report at cybercrime.gov.in, and ask your bank to block your card or account. Acting quickly gives the best chance of stopping the money.