Fake SBI YONO Reward Points SMS Scam: Bank Alert

If your phone buzzed this morning with a text message claiming your State Bank of India reward points worth ₹9,850 are expiring today, don't tap that link. You're looking at the fake SBI YONO reward points scam, an aggressive wave of fraud targeting millions of account holders across India. The message looks convincing at first glance. It uses urgent wording alongside a realistic cash figure, plus a short web link asking you to redeem your points immediately. Don't fall for it. Behind that link lies a trap designed to drain your bank balance within minutes.

State Bank of India and government cyber security agencies have already raised an alert about it.

In my experience over the past three years, I've seen dozens of these scam variants (annoying, I know). This latest wave is much dirtier. Scammers have basically abandoned simple phishing forms in favor of pushing malicious Android application packages (APK files) straight onto your handset. It's a mess. Once you install their package, they steal your net banking login and quietly take over your SMS inbox. From there, they grab your two-factor authentication codes and drain your savings before you even realize what happened.

How the fake SBI YONO reward points scam works

Look, the fraud begins with bulk SMS blasting. Fraud networks send automated text messages to hundreds of thousands of Indian mobile numbers every single day. They don't know whether you actually hold an account with SBI. But with over 50 crore customers at State Bank of India, chances are high that at least every second person receiving the text has an SBI savings account or debit card (which makes sense, actually). The numbers here are a bit fuzzy, but if you ask me, the sheer volume is how they make their money.

The scam unfolds through a predictable sequence:

1. You receive an SMS warning that your accumulated SBI reward points will lapse at midnight unless redeemed for cash.
2. The message provides a shortened link or a disguised web address directing you to an external website mimicking SBI YONO branding.
3. Instead of loading a webpage in your browser, the site prompts an automatic download of an APK file with names like SBI_Rewards.apk or YONO_Redeem.apk.
4. If you open the file, Android asks you to enable installation from unknown sources, bypassing standard Google Play Store security checks.
5. Once installed, the fake app displays an SBI login screen asking for your net banking username, password, profile password, and date of birth.
6. Behind that fake screen, the app requests background permissions to read, receive, and send SMS messages on your handset.
7. When scammers initiate a real-time fund transfer or create a UPI mandate from your account, the app intercepts the incoming bank OTP and forwards it to the scammer server without showing an alert on your screen.

"State Bank of India never sends SMS or WhatsApp messages containing web links to redeem reward points or download APK files. Customers must never install applications from unverified sources."

The Indian Computer Emergency Response Team (CERT-In) at cert-in.org.in has repeatedly flagged similar SMS-based malware campaigns. Similar tactics appeared earlier this year in the fake HDFC reward points scam, where criminals tricked cardholders into surrendering credentials under the pretext of expiring cash points.

The anatomy of the fraudulent SMS message

Look closely at your messages app. A standard scam text usually reads something like: "Dear SBI user, your SBI Rewardz points worth Rs 9,850 will expire today. Kindly redeem immediately to avoid forfeiture. Click here: bit.ly/sbi-claim-pts to transfer cash directly into your bank account."

Notice the psychology at play. Scammers pick an amount that feels too substantial to ignore. Nobody cares about 20 rupees, but ₹9,850 feels like free cash waiting to be claimed (and that happens more often than people admit). And they always create artificial panic by setting the expiry time to "today" or "within 24 hours". I think that ticking clock is what pushes people over the edge.

Thing is, banks don't operate like that. Genuine SBI reward points accrue quietly in your SBI Rewardz loyalty account every time you swipe your debit card or pay through YONO. They expire on a fixed calendar cycle (usually after 36 months), and the bank never hounds you with frantic countdown texts. So if an SMS creates sudden urgency, treat it as hostile.

What happens when you install the malicious APK

This is where the real damage occurs. The rogue app requests permission to read and send SMS messages. Most people tap "Allow" out of habit because they think the official YONO app needs SMS verification. Don't. That single tap hands full control of your digital life straight to a criminal syndicate.

Once the app gets SMS permissions, it acts as a silent background spy. It hides its own app icon from your phone home screen so you can't easily spot or uninstall it. Meanwhile, the criminals take the net banking credentials you typed into the fake form and log into SBI online banking from their own browser. In my experience, they work fast.

SBI naturally triggers an OTP to authorize a new beneficiary or initiate an IMPS transfer. But because the malware controls your messaging service, it catches that OTP the millisecond it hits your phone. It hides the incoming notification from you and transmits the secret digits straight to the fraudster command server (a nasty shock, obviously). Within two minutes, ₹50,000 or ₹1,00,000 leaves your account. You only find out hours later when you check your mini-statement or get an email alert.

And the threat doesn't stop at banking. Because the malicious package stays active on your phone, it can intercept OTPs for WhatsApp and your Google account, plus your email and Aadhaar-linked services. Why do phone operating systems still let rogue apps hide their icons? Honestly, I'm not sure exactly why. That's just the reality right now. That's why our team at GetInfoToYou regularly updates our latest scam alerts, exposing these fraud patterns before they wipe out family savings.

Warning signs you should never ignore

Fraudulent SMS messages always leave digital footprints if you know what to check. You don't need technical expertise to spot them.

Keep an eye out for these red flags:

• The SMS arrives from a standard 10-digit mobile number or an international prefix instead of verified telecom sender headers like SBIBNK, SBIINB, or SBIRWD.
• The message contains shortened URLs from services like bit.ly, tinyurl, or odd domains ending in .top, .live, or .apk rather than official sbi.co.in or bank.sbi web domains.
• The website prompts your mobile browser to download a file with an .apk file extension instead of opening a secure web portal.
• The web page asks for sensitive information that no reward redemption requires, such as your debit card PIN, internet banking profile password, or card CVV number.
• The message text contains spelling mistakes, odd capital letters, or inconsistent rupee formatting.

Honestly, if you ask me, spotting these sketchy details isn't rocket science once you slow down for ten seconds. Similar warning signs show up frequently in fake income tax refund scam alerts, where fraudsters clone government portals and push dangerous download files on unsuspecting taxpayers.

What you must do if you already tapped the link

Don't panic. Fast action can save your money even if you clicked the link or downloaded the file.

Put your phone on airplane mode immediately. Do it right now. Cutting mobile data and Wi-Fi breaks the connection between the malware and the scammer server, stopping the app from relaying any incoming SMS or OTP right away (classic trick, really). I think this single action saves more accounts than anything else.

Here are the exact recovery steps you must follow in order:

1. Use a different device (like a family member phone or laptop) to log into your official SBI internet banking account and change your login password and profile password immediately.
2. Call SBI round-the-clock customer helpline numbers 1800 1234 or 1800 2100 to temporarily lock your net banking access and debit card.
3. On your compromised phone, go to Settings, then Apps, and find any recently installed application with an unfamiliar name, blank icon, or fake SBI logo. Tap Force Stop and select Uninstall.
4. Check your phone accessibility settings and notification access to ensure no lingering background service retained special privileges.
5. If the rogue application refuses to uninstall or you cannot find it, back up your photos and contacts, and perform a complete factory reset on your handset.

Never install apps from unverified links or unknown sources outside the official Google Play Store. Taking these recovery actions swiftly makes a massive difference. You can also explore our practical digital security guides for step-by-step instructions on securing your smartphone against background spyware.

How to check genuine SBI reward points safely

You might still be wondering whether you actually have points sitting in your account. That's completely normal. In my experience, people get curious when they see big numbers mentioned. SBI Rewardz is an authentic loyalty program run by State Bank of India, and regular spending does accumulate points over time.

Checking your legitimate balance takes less than a minute. Just open your official SBI YONO app. Log in with your registered six-digit MPIN or biometric fingerprint, then scroll straight down on the home dashboard to Quick Links and tap SBI Rewardz. You'll see your exact points total along with their real expiration schedule. Plus, you can browse valid vouchers for flight bookings or retail gift cards without touching sketchy third-party sites.

Alternatively, you can visit the verified website at sbirewardz.sbi directly from your computer browser. State Bank of India will never send you an SMS with a direct link or an APK download to claim reward points. If you see a text message claiming otherwise, delete it on the spot.

Where to report SBI reward scams in India

Reporting the incident is your civic duty. And it directly helps authorities pull down malicious web domains before other people fall into the trap.

Call the national cybercrime helpline at 1930 immediately. The 1930 number connects you straight to the citizen financial cyber fraud reporting system run by the Ministry of Home Affairs. Time is everything here. If you report your loss within the first two hours (the golden hour, basically), police can coordinate with banks to freeze the transaction before the money disappears into mule accounts or crypto exchanges.

Next, lodge an official complaint online at cybercrime.gov.in. Upload screenshots of the SMS and the scammer's phone number, along with the web link and your bank statement. You should also forward the scam text directly to the State Bank of India anti-phishing cell by emailing report.phishing@sbi.co.in.

Stay skeptical whenever an unexpected message promises free money. Nobody hands out cash for nothing. If you ask me, talk to your parents and older relatives about this scam today, because seniors are often the easiest targets for these fake reward expiry messages.