WhatsApp Bank Scam: Is Replying "NO" Dangerous? Safety Tips for India
Hyderabad Police warn of a WhatsApp 'reply NO' bank scam that cost a CA ₹1.70 lakh. What the message says, what's confirmed, and how to stay safe.
A message lands on WhatsApp from a number you don't recognise: "₹90,000 has been debited from your [Bank] account. If you did not authorise this transaction, please reply NO immediately." It looks urgent. It looks like it's trying to protect you. Multiple reports from across India in September–October 2026 say the opposite happens the moment you reply — and in at least one case, the victim lost real money within minutes.
Here's what's actually confirmed about this scam, what's still disputed, and what to do if the message lands in your inbox.
What the Message Actually Says
The scam runs in two steps, matching a pattern reported by Hyderabad Police and flagged separately by Jammu & Kashmir Bank:
- A message from an unknown or international number claims a specific amount has just been debited from your bank account.
- A follow-up line asks you to reply "NO" if you did not authorise the transaction — framed as the fastest way to flag and reverse the fraud.
No bank sends this kind of message. "Banks do not ask customers to confirm transactions by replying 'YES' or 'NO' on WhatsApp," Jammu & Kashmir Bank said in an advisory, urging customers to verify any such claim only through the bank's own app, net banking, or official helpline — never by replying to the message itself.
Is Replying "NO" Actually Dangerous? What's Confirmed vs. Disputed
| Claim | Source | Status |
|---|---|---|
| Replying can let attackers install malware and take control of your phone ("auto-execution file attack") | Hyderabad Police Commissioner V.C. Sajjanar, in a public warning | Police claim — exact technical mechanism not independently verified |
| A WhatsApp reply alone cannot install malware or prove a transaction happened | Separate technical reporting on the same wave of complaints | Also unverified either way — investigation is case-by-case |
| A chartered accountant lost ₹1.70 lakh from ICICI and IndusInd accounts after replying "NO," without clicking a link or sharing an OTP | Victim's account, reported by multiple outlets, October 2026 | Reported case; exact mechanism of the loss not disclosed |
The honest answer is: nobody has publicly confirmed the precise technical mechanism yet. What's not in dispute is that real people have reported real financial losses right after replying, and no legitimate bank uses this format. Treat the uncertainty as a reason for more caution, not less — you don't need to know exactly how a trap works to know not to step in it.
A Real Case: ₹1.70 Lakh Lost Without Clicking Anything
In mid-October 2026, Vishnu Kumar, a chartered accountant, received a WhatsApp message reading almost exactly the template above: "Rs. 90,000 has been debited from your ICICI Bank account. If you did not make this transaction, please reply NO." He replied "NO." The sender wrote back, "Thank you. Our team will get back to you." Soon after, money moved out of both his ICICI Bank and IndusInd Bank accounts — a combined ₹1.70 lakh. He maintains he never opened a link or shared an OTP.
This is a single reported case and the full technical chain hasn't been published — but it's exactly the pattern multiple police advisories are now warning about.
Why This Message Works
- Manufactured urgency. A large debit you didn't make is designed to spike panic, and panic shortens the pause before you act.
- It looks like help, not a threat. You're not being asked to click a suspicious link or share an OTP — just type one word. That feels low-risk, which is exactly why it isn't.
- It mimics a real bank reflex. Indian banks genuinely do send fraud-alert SMS asking you to call or report — so a WhatsApp message copying that tone doesn't feel out of place at first glance.
What To Do If You Get This Message
- Don't reply — not "NO," not "STOP," not anything. A reply confirms your number is active and being read, at minimum.
- Don't open any attachment or link that follows, even if it looks like a bank portal.
- Check the transaction yourself — open your bank's own app or net banking directly (not through the message), or call the number printed on your physical debit card or the bank's official website.
- Block and report the number inside WhatsApp, and keep a screenshot as evidence.
If You Already Replied or Lost Money
- Call 1930 immediately — India's National Cyber Crime Helpline. The first golden hours after an unauthorised debit are when banks can still freeze a transfer before it's withdrawn.
- Call your bank's official helpline (never a number from the suspicious message) and ask them to block UPI/net-banking access on the account as a precaution.
- File a complaint at cybercrime.gov.in with screenshots of the WhatsApp conversation and your bank statement showing the debit.
- Watch for follow-up contact — scammers who get a reply sometimes escalate with a phone call pretending to be "bank support," which is where OTP-sharing or remote-access app tricks usually come in. Don't engage.
Reference & Source
- Hyderabad Police Commissioner V.C. Sajjanar's warning on the "auto-execution file attack" pattern, via Business Today, October 14, 2026.
- Chartered accountant's reported ₹1.70 lakh loss, via StudyCafe, October 15, 2026.
- Jammu & Kashmir Bank's official advisory against WhatsApp "YES/NO" transaction confirmations, via Kashmir Life.
- For OTP-sharing risk on the same platform, see Shared Your WhatsApp OTP? Am I Hacked?
Related Guides
Read next
Social Engineering
Why Growing Trust in Digital Payments Leaves Indians More Exposed to Cybercrime: The Convenience Paradox Explained
Social Engineering
Kerala Enlists Students & Retired Hands to Fight Cybercrime: How Community Cyber Defense Works & Why Your Ward Needs It
Social Engineering