The WhatsApp 'Reply NO' Scam: No OTP, No Link — Here's What Actually Takes the Money

Short answer: The new WhatsApp scam sends a fake “₹48,000 debited” message, then asks you to “reply NO if this wasn’t you.” There’s no OTP and no link. Hyderabad Police say the reply can trigger malware; that part isn’t independently proven. What is certain: the reply marks you as a live, frightened target, and the money goes at the next step. The fix is one rule — don’t reply, check in your bank’s own app — plus a few WhatsApp settings. If money does go, call 1930 and tell your bank within 3 working days.

The misconception

We’ve all learned the old rule: never share an OTP, never click a strange link. This scam is built for people who learned that rule. It asks for neither. It asks for one harmless-looking word — and a word feels safe.

What the police actually said

In mid-October 2026, Hyderabad Police Commissioner V.C. Sajjanar posted a video warning. The pattern: a WhatsApp message from an unknown number says money has been debited from your account. A second message says to reply NO if you didn’t make the transaction. He cited a chartered accountant who lost money this way, and called the method an “auto-execution file attack.”

Here is the honest part. Every report traces back to that one police video. No security researcher has shown that typing NO, by itself, runs malware. Most outlets say “allegedly.”

What actually takes the money

Your reply tells the scammer two things: this number works, and this person is scared. Everything after that needs exactly those two facts. The “bank officer” calls. A “refund” request arrives. You’re asked to install an app to “secure” the account, or to share your screen.

The same goes for the links now circulating in God’s name — “VIP darshan booking”, “prasad at home”, “special puja” — which the Home Ministry’s cybercrime centre has warned about before. A link rarely drains an account on its own. It walks you into one of three doors:

1. An app (APK) that asks to read your SMS — and so reads your bank OTPs.
2. A fake payment page where you type your card number or UPI PIN yourself.
3. A UPI request or autopay you approve, thinking it’s a refund or an offering. To receive money, you never enter a PIN.

The message doesn’t steal your money. Your panic does.

Real alert or fake?

Real debit alerts come by SMS from your bank’s sender ID and show up in your bank’s app. No bank asks you to reply NO on WhatsApp. A WhatsApp message is not proof that anything was deducted.

What to do

• Don’t reply. Not YES, not NO, not “who is this?” Block and report the number inside WhatsApp.
• Check it yourself in your bank’s official app, or call the number on the back of your card — never the number in the message.
• Turn on WhatsApp’s own protections: Settings → Privacy → Advanced → Block unknown account messages (it stops unknown numbers sending in bulk, not every stranger); Privacy → Calls → Silence unknown callers; Privacy → Groups → My contacts; check Linked devices; switch off media auto-download.
• For older parents: set these on their phone today, plus Silence Unknown Callers in the phone’s own settings. No button blocks every unknown message, so give them one rule: don’t reply — show us first.
• Book darshan, prasad or puja only on the temple trust’s or government’s official website.

If money has already gone

Call 1930, the national cybercrime helpline, and file at cybercrime.gov.in. Tell your bank in writing the same day. Under the RBI’s July 2017 rules, if the fraud was a third-party breach and not your fault, reporting within 3 working days of the bank’s alert means zero liability. The bank must credit the amount back within 10 working days of your complaint while it investigates, and the burden of proof is on the bank. Wait longer and that protection shrinks.

Not replying won’t make your phone hack-proof. It just shuts the one door this scam needs.