SBI Data Leak 2026: How Scammers Pose as SBI Officials

SBI Data Leak 2026: How Scammers Pose as SBI Officials Key takeaways Updated 25 October 2026: on 23 October SBI said it had individually informed affected customers by email and WhatsApp.

• SBI says it found 3,897 customer records in a dark-web dataset (a seller claims about 375,000). The source, authenticity and size are still unconfirmed.
• Reported fields include names, mobile numbers, dates of birth, addresses and loan-related metadata. SBI says customer funds and core banking were not impacted.
• SBI says it has contacted affected customers by email and WhatsApp, which gives scammers an obvious template for fake "SBI notices". Treat any message with a link, an app file or a request for an OTP, PIN or password as suspect, even if it mentions the leak.
• The main risk is a convincing fake "SBI official" call, SMS or WhatsApp message. Knowing your details does not prove someone is from SBI.
• Never share an OTP, PIN or password, hang up and call back on the number on your card, and report fraud to 1930 or cybercrime.gov.in.** What SBI has confirmed about the data leak** On 21 October 2026, State Bank of India told the stock exchanges that it "has experienced an incident involving the loss of certain data." After a preliminary review of a dataset circulating on the dark web, the bank identified 3,897 customer records containing personal information. The alert reached SBI on 16 October through CERT-In and its threat intelligence provider. According to reports of the filing, the exposed fields include customer names, gender, registered mobile numbers, email addresses, residential addresses, dates of birth, branch and CIF identifiers, and metadata linked to loan and lead records. SBI says customer funds and core banking transactions have not been impacted, has activated its incident response process, and has engaged an independent cybersecurity firm from CERT-In's empanelled list. The reports do not list account numbers, balances, passwords, OTPs or card details among the exposed fields.** Update, 23 October 2026.** In a post on social media, SBI said it had individually informed the customers whose data was identified as affected, by email and WhatsApp, and repeated that account balances and funds are safe, according to Business Today. The report does not reproduce the messages and does not mention SMS as a channel.** What is still unknown** This is a developing story, and a lot has not been confirmed:**
• How big it is.** A seller using the name "Siriusim" claimed about 375,000 records and 2,722 PDF documents. SBI's 3,897 is its own preliminary count, not a confirmed total. It has not said whether those are 3,897 different people.**
• Where the data came from.** SBI's filing does not say whether its own systems were breached, or whether the data came from a subsidiary or a third-party provider.**
• Whether it's authentic overall.** Reporters who reviewed a handful of sample records found working phone numbers, but that does not settle the question for the full set.**
• How many people, and the technical cause.** Business Today notes that SBI has not specified the technical nature of the incident, how many customers were affected or which categories of information were exposed. If you bank with SBI, don't assume you are affected, and don't assume you are not. Only SBI can confirm that.** How to tell a real SBI notice from a fake** Because affected customers are being contacted by email and WhatsApp, a fake "SBI data incident notice" is an obvious next lure. SBI's own advice, as reported, is to never share OTPs, PINs or passwords, even with someone claiming to be from the bank, to avoid clicking unknown links received by SMS, email or WhatsApp, and to verify any suspicious communication through the bank's official channels before responding. In practice, that means:**
• Don't reply, click or call back from the message.** Open the official SBI or YONO app yourself, or call the number printed on your card, passbook or SBI's official website.**
• Treat these as red flags**, whatever the sender name says: a link, an app file, a request to "verify" or "update KYC" to protect your account, a deadline, or a request for an OTP, PIN, CVV or password. This is our practical reading of SBI's advice, not SBI's wording.**
• Don't assume the lack of a message means you are safe**, or that a message proves you are affected. Only SBI, through its official channels, can tell you.** Why the real risk is the phone call, not your balance** The leaked fields are not the kind that lets someone log in and move money. What they do is make an impersonator sound real. A caller who can read out your name, your registered mobile number, your date of birth, your address, your branch and details of a loan enquiry doesn't need to guess. They can simply let you believe they already know you. That is the point worth remembering: a caller knowing your details does not prove they are from SBI. Those details are exactly what a leaked dataset hands over.** How a fake "SBI official" may approach you** These are patterns that impersonation scams in India commonly follow, and what leaked details make easier. They are not reports of specific cases from this leak.**
• The "we noticed a problem" call.** The caller says they are from SBI's fraud, security or loan department, quotes your name and branch, and says there is suspicious activity or a pending loan issue. The urgency is the tool.**
• The "verify your KYC" message.** An SMS or WhatsApp message in SBI's name asks you to update KYC or Aadhaar details, and links to a lookalike page. SBI has previously warned about fake messages claiming its YONO app will be deactivated unless you update details through a link.**
• The "download this app" message.** PIB Fact Check has flagged a fake "SBI Rewards" message that asks you to install an APK to redeem points, and said it is fake. An app file sent to you in a message is not a way to get or verify anything from SBI.**
• The "share the OTP to cancel it" step.** Whatever the story, it ends with a request for an OTP, a PIN, a CVV, a password or a remote-access app. No real bank employee needs any of these from you.** What to do now**

1. Never share an OTP, PIN, CVV or password with anyone, whoever they say they are and however much they already know about you.
2. Hang up and call back on a number you trust, taken from the back of your card, your passbook or SBI's official website. Don't call a number the caller or a message gives you.
3. Don't tap links or install APKs from SMS or WhatsApp that claim to be from SBI. Open the official SBI or YONO app you already have, or type the website address yourself.
4. Turn on transaction alerts and check your statements for anything you don't recognise.
5. To find out whether your records were affected, contact SBI through its official channels. SBI says it has contacted affected customers by email and WhatsApp, but check any such message the way described above, and don't use a number or link given in a message.
6. Report suspicious calls and messages. Call the national cybercrime helpline 1930 or report at cybercrime.gov.in. SBI's own security page lists report.phishing@sbi.co.in for phishing reports. If money has already left your account, call 1930 straight away and tell your bank.** Where Arjuna fits, and where it doesn't** Part of this scam travels as a message with a link or a file, and that part is where Arjuna helps. SMS Scam Detection and WhatsApp Scam Detection scan message text for malicious links and known-bad URLs, and WhatsApp Scam Detection also scans fake or APK file attachments, before you open them. Fake APK Detection and Sideloaded App Detection (Premium plan, under Device Protection) flag apps installed from outside the official stores, which is how a fake "SBI Rewards" app would reach a phone. The limits matter, so here they are plainly. A phone call from a fake "SBI officer" has no link and no file for an app to scan. Arjuna does not screen voice or video calls and cannot verify who is on the other end of one, and neither can any message-scanning app. Nothing here is a guarantee. For the call itself, the defence is the habit above: hang up and call back on a number you trust.** SBI data leak: frequently asked questions What did SBI confirm about the data leak?** On 21 October 2026 SBI told the stock exchanges it found 3,897 customer records containing personal information in a dataset circulating on the dark web. It says customer funds and core banking transactions were not impacted.** What data was exposed in the SBI leak?** Reports of the filing list names, gender, registered mobile numbers, email addresses, residential addresses, dates of birth, branch and CIF identifiers, and loan or lead metadata. Account numbers, balances, passwords, OTPs and card details were not listed.** Is my SBI account safe?** SBI says funds and core banking were not impacted. The practical risk is impersonation, so treat unexpected calls and messages in SBI's name with care and turn on transaction alerts.** How do I know if a call is really from SBI?** You can't tell from the caller's knowledge of your details. Hang up and call back on the number printed on your card or passbook, or on SBI's official website.** How is SBI contacting customers affected by the leak?** SBI said on 23 October 2026 that it had individually informed affected customers by email and WhatsApp, according to Business Today. The report does not mention SMS. Because scammers can copy a notice like that, verify any message through the SBI or YONO app or the number on your card, and never share an OTP, PIN or password.** How can I tell a real SBI notice from a fake?** SBI's advice is to avoid clicking unknown links received by SMS, email or WhatsApp, never share OTPs, PINs or passwords with anyone, and verify suspicious messages through official channels. Treat any message with a link, an app file, a "verify your KYC" request or an OTP request as suspect.** Where do I report an SBI-related scam?** Call the national cybercrime helpline 1930 or report at cybercrime.gov.in. SBI's security page lists report.phishing@sbi.co.in for phishing reports.** Sources**[

• The Hacker News: State Bank of India confirms data leak](https://thehackernews.com/2026/10/state-bank-of-india-confirms-data-leak.html)[
• CyberPeace: SBI data leak, what we know and what customers should do](https://cyberpeace.org/resources/blogs/sbi-data-leak-what-we-know-what-we-do-not-and-what-customers-should-do)[
• Business Today: SBI contacts customers over cyber incident through email, WhatsApp](https://businesstoday.in/india/story/sbi-contacts-customers-over-cyber-incident-through-email-whatsapp-heres-what-it-said-563260-2026-10-23)[
• Business Standard: PIB warns against fake "SBI Rewards" app](https://www.business-standard.com/finance/personal-finance/cybercrime-alert-pib-warns-customers-against-fake-sbi-rewards-app-124110400237_1.html)** Protect your phone** Stop. Check. Stay Safe. Download Arjuna for Android and iOS. Share this guide with a parent or relative who banks with SBI. Related on Arjuna: Scam protection · Android protection · Phishing links · Digital arrest scams · More cyber alerts