A report claiming that money was deducted from a bank account after a person replied 'NO' to a message received from an unknown number on WhatsApp had raised concerns among users. However, cyber expert Amit Dubey has clarified that simply replying to such a message does not result in money being withdrawn from a bank account. The actual risk arises when fraudsters subsequently send fake links or trick users into sharing sensitive banking information.
A new type of cyber fraud involving WhatsApp messages sent in the name of banks has recently been the subject of discussion. A claim emerged that a person lost money from their bank account after simply replying 'NO' to a message received from an unknown number. Hyderabad Police had also issued a warning to the public regarding the incident.
Cyber expert Amit Dubey has now explained how fraudsters use such messages to initiate conversations and subsequently trap unsuspecting users.
According to Dubey, replying 'NO' to a WhatsApp message cannot, by itself, result in money being withdrawn from a bank account. Fraudsters use the response to continue the conversation. Once someone responds to their message, they can identify that the recipient is paying attention to their communication.
Dubey explained the method with an example. Suppose an unknown WhatsApp number displays the State Bank of India (SBI) logo as its profile picture. The number sends a message claiming that Rs 30,000 has been deducted from the recipient's bank account. The message asks the recipient to reply immediately with 'NO' if they did not carry out the transaction.
A sudden message about money being deducted from a bank account can cause panic. Under such circumstances, people may respond without verifying the information. Fraudsters exploit this reaction to proceed with their next step.
After receiving a 'NO' response, fraudsters may send another message while posing as bank employees. They may claim that a suspicious transaction has taken place in the recipient's account and that the user's banking details must be verified immediately to stop it.
The message may also contain a link that resembles the bank's official website. However, it could lead to a fraudulent webpage created by cybercriminals.
If users enter their banking details, passwords or OTPs on such pages, the information can be misused. Fraudsters may also send UPI payment requests and attempt to persuade recipients to approve them.
However, simply opening a link or viewing a UPI request does not necessarily result in an automatic deduction of money. Fraudsters generally need payment authorisation or access to other sensitive information to withdraw funds.
In October 2026, Hyderabad Police Commissioner V.C. Sajjanar had cautioned people about fraud involving WhatsApp messages. At the time, a case involving the withdrawal of money from an individual's bank account had come to light. The incident also generated considerable discussion on social media.
According to initial reports, the victim had replied to a WhatsApp message by typing only 'NO'. It was reported that the individual had neither shared an OTP with anyone nor opened any unknown link. Despite this, money was reportedly deducted from the bank account.
However, complete details of the technical method used to withdraw the money in that particular case were not made public.
Cyber expert Amit Dubey explained that fraudsters often use such messages to initiate conversations with potential victims. They subsequently send links under various pretexts or attempt to persuade recipients to approve payment requests. Therefore, the claim that simply replying 'NO' leads to money being deducted from a bank account is not established.
Messages sent in the name of banks are common on WhatsApp. Several banks also use the platform to share important information with their customers. However, cybercriminals exploit this familiarity by using bank logos and names in their profile pictures to make fraudulent messages appear genuine.
Users may assume that a message has come from an actual bank representative after seeing the bank's logo or name on the sender's profile. However, anyone can use a bank's photograph as their WhatsApp profile picture. The presence of a bank's name or a business account label does not establish that the sender is an authorised bank representative.
If users receive an unexpected message claiming that money has been deducted from their account or that their bank account is about to be closed, they should avoid responding immediately. Instead, they can open their bank's official application to check their account balance and recent transactions.
Users should also avoid entering banking information through links received in such messages. OTPs, UPI PINs and passwords should not be shared with anyone.
In particular, if someone asks for a UPI PIN in the name of transferring money back to the user, the request should be treated as suspicious. The Reserve Bank of India has also clarified that entering a UPI PIN is not required to receive money through UPI.
