Know-your-customer requirements are real, and banks genuinely do ask customers to refresh their details. That legitimacy is what the scam borrows. The fraudulent version differs in three consistent ways: the deadline is immediate, the channel is a link, and the form asks for secrets no bank needs.
What a real KYC request looks like
A genuine request gives you weeks, not hours. It asks for identity and address documents, not authentication credentials. It directs you to a branch, the bank's own app, or a login page you reach yourself. It never asks for your PIN, your card's CVV, your internet-banking password or a one-time code.
The remote-access variant
A dangerous version asks you to install an app to "complete verification". The app is a remote-access tool. Once installed, the caller can see your screen, read incoming codes, and operate your banking app while talking to you calmly about something else. Losses here are usually total, because every security control is being satisfied by you in real time.
No bank in any country asks a customer to install a screen-sharing or remote-control application to complete KYC. If that request appears, the call is fraudulent regardless of how convincing everything before it was.
The safe response
- Do not click the link. Open your bank's app directly, or type the address yourself.
- If in doubt, call the number printed on your debit card or a statement — never a number from the message.
- If you have already installed an app at a caller's request, disconnect the device from the internet, uninstall it, and call your bank from a different phone.
- Change your internet-banking password from a device you know is clean.