Indian Bank Warns Customers of Fake LPG Payment and KYC Scams

Key Takeaways

• Indian Bank has issued a cybersecurity warning regarding widespread fraudulent messages targeting customers.
• Scammers are impersonating LPG providers (Indane, Bharat Gas, HP Gas) and banks to trick individuals into revealing banking credentials and OTPs.
• The scams leverage fake KYC update and pending payment notifications, often exploiting concerns over LPG cylinder availability.
• Attack vectors include malicious links in SMS/WhatsApp, fake websites, malicious APK files, and imposter WhatsApp calls.
• Customers are advised to verify all communications through official channels and never click suspicious links or share sensitive information.

Indian Bank Alerts Customers to Surge in Sophisticated LPG and KYC Scams

Indian Bank has disseminated an urgent cybersecurity alert, cautioning its clientele about a significant increase in fraudulent communications. These deceptive messages, masquerading as legitimate notifications concerning LPG payments and Know Your Customer (KYC) updates, are designed to illicitly acquire banking credentials and subsequently drain victims’ accounts.

Cybercriminals are strategically leveraging public anxiety surrounding the availability of LPG cylinders. They are distributing these fraudulent messages across various communication platforms, including SMS, WhatsApp, and other popular messaging services, to maximize their reach and effectiveness.

The Deceptive Playbook: Impersonation and Social Engineering

The scam messages meticulously mimic official communications from prominent LPG suppliers such as Indane, Bharat Gas, and HP Gas. They falsely inform recipients that their gas connections face imminent suspension unless they promptly update their KYC details or settle an alleged outstanding payment.

This elaborate fraud employs a well-established social engineering methodology. Victims receive alarming alerts, such as “Your LPG KYC is pending. Limited stock. Click here to update and order,” or urgent demands like “Immediate payment required to continue connection. Avoid LPG disconnection. Click on link.” Such urgent phrasing is specifically crafted to induce panic and bypass rational decision-making.

Upon clicking the embedded malicious link, users are redirected to meticulously crafted, but entirely fake, websites. These sites are designed to harvest sensitive financial information, including banking credentials, Unified Payments Interface (UPI) PINs, and One-Time Passwords (OTPs).

In more advanced iterations of these attacks, threat actors distribute malicious Android Package Kit (APK) files via WhatsApp. Once installed, these files grant attackers surreptitious access to the victim’s device, potentially compromising banking applications, saved passwords, and other highly sensitive personal data.

Reports also indicate that some fraudsters are impersonating bank officials through WhatsApp calls. During these calls, they instruct users to click on specific links under the guise of urgent account verification, further expanding their attack vectors.

Law Enforcement Responds to Widespread Fraud

Indian law enforcement agencies, including various cybercrime units within the Delhi Police, have already registered numerous complaints related to these fraudulent LPG messages. These reports have been channeled through the national cybercrime helpline, 1930.

Scammers are also utilizing fake advertisements on social media platforms, employing the logos of reputable gas companies. These ads serve to funnel unsuspecting consumers to bogus payment portals, where their financial data is stealthily exfiltrated. Security researchers have identified this as a classic event-driven phishing campaign, strategically exploiting fears of LPG scarcity to maximize victim conversion rates.

What You Should Do

• Exercise Extreme Caution: Never click on unsolicited links received via SMS, WhatsApp, or social media platforms, especially if they claim to be from LPG providers or banks.
• Protect Personal Information: Absolutely refrain from sharing OTPs, UPI PINs, Aadhaar numbers, or any banking credentials with anyone who requests them through unofficial channels.
• Verify Through Official Channels: Always confirm delivery statuses or KYC requirements exclusively through the official mobile applications of your LPG provider or their authorized helplines.
• Avoid Unknown Software: Do not install APK files or any other software received through messaging apps from unknown or suspicious numbers.
• Report Suspicious Activity: Immediately report any suspicious messages or calls to the national cybercrime helpline at 1930 or visit the official portal at www.cybercrime.gov.in.
• Direct Verification: If in doubt, contact your gas agency directly using the official phone number found on your last delivery receipt or their verified website, not numbers provided in suspicious messages.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.