"Your 7,450 reward points worth โน3,725 expire today. Redeem now."
There is a short link.
It is your bank's name, and you do have a credit card with them.
It feels like money you are about to lose.
Where does the link go?
To a page that looks exactly like your bank.
It asks for your card number, expiry date and CVV, to "verify" you.
Then it asks for the OTP that arrives on your phone.
That OTP is not for redeeming points.
It is approving a payment from your card.
How do I know it is fake?
Your bank does not send redemption links from random numbers.
Real reward points rarely vanish with a same-day warning.
No genuine redemption asks for your CVV and an OTP together.
Short links and slightly odd web addresses are the giveaway.
How do I check my points safely?
Open your bank's official app.
Or type the bank's website address yourself, rather than tapping a link.
Your points, and their real expiry dates, are shown there.
Redeem them inside the app if you want to.
What if I entered my details?
Call your bank immediately on the number printed on your card.
Block the card, and ask them to check for any payment you did not make.
Call 1930 and report at cybercrime.gov.in.
The sooner you act, the better the chance of stopping the payment.
How do I spot the next one?
Read the OTP message itself, not just the code.
It usually says what it is for, like a payment to a merchant and an amount.
If the OTP says "payment" and you were not paying anyone, stop.
Things to Remember
- Never redeem points through a link in an SMS.
- Check points in your bank's official app.
- No redemption ever needs your CVV and an OTP.
- Read what an OTP is for before using it.
- Entered details? Block the card and call 1930.