The SMS arrives in the early evening. It is short. It is from a normal 10 digit mobile number, not the branded sender you usually see for your electricity bill.
‘Dear Customer, your electricity will be disconnected today at 9:30 PM as your previous month bill is not updated. Please immediately contact our electricity officer.’ Then a phone number, or a link, or an APK file to install.
You look at the clock. It is already past 7 PM. The thought of your home losing power tonight, your fridge stopping, your child unable to study, your elderly parent in the heat or the cold, is enough to make you tap the link without thinking.
That tap is the scam.
This is happening to thousands of households across India every week in 2026. We get screenshots of these SMS on our verification WhatsApp regularly. Some senders have already lost lakhs. Some have lost their phone to malware. Here is how to spot it, how to verify a real disconnection notice, and what to do if you already clicked.
How big is this scam in India
The electricity disconnection SMS scam, often called the ‘power cut at 9:30 PM’ scam in the press, has been flagged by police across multiple states. PIB Fact Check has issued repeated advisories warning citizens that the Power Ministry and state discoms do not send same-day disconnection threats from personal numbers.
The Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs has logged tens of thousands of utility impersonation complaints across 2024 and 2025. The Citizen Financial Cyber Fraud Reporting and Management System has helped save over ₹3,400 crore across nearly 10 lakh cybercrime complaints as of late 2025 (PIB release).
The electricity scam stands out for two reasons. The addressable victim base is every household with an electricity connection, essentially the entire country. The pressure script (lose power tonight) is sharper and more universal than a parcel claim or a traffic challan.
A real Indian case
In April 2024, a 65 year old retired bank officer in Pune received an SMS late in the evening. The message said his electricity would be disconnected by 9:30 PM the same day because his previous month’s bill had not been updated, and asked him to call a number to settle the issue.
He called. The person on the other end, polite and professional, said the bill could be cleared in a few minutes through an app he would WhatsApp. The ‘app’ was an APK file. Once installed, it asked for SMS access, accessibility permissions, and overlay permissions. Within an hour, the attacker had read his OTPs, taken control of his banking apps, and transferred over ₹4 lakh out in multiple transactions.
He had been an MSEDCL customer for thirty years. He paid his bills on time. His actual account had no dues. None of that mattered because the SMS arrived at the moment of maximum panic.
Variants of the same script have been reported from Bengaluru, Hyderabad, Delhi NCR, Chennai, Mumbai, Ahmedabad, and small towns across India. The Hindu, Times of India, Hindustan Times, and Indian Express have all carried public warning pieces in 2024 and 2025. The discom impersonated changes (BESCOM, BSES, MSEDCL, TANGEDCO, TSSPDCL, KSEB) but the playbook does not.
How the electricity scam works, step by step
Step 1. A panic SMS arrives, almost always between 5 PM and 9 PM. Broken English with a specific time threat. ‘Dear Customer, your electricity power will be disconnect today night 9:30 PM, your previous month bill not update. Please immediately contact our electricity officer Mr Sharma 9XXXXXXXXX.’
Step 2. The sender is a 10 digit mobile number, not your discom’s registered branded sender ID. Real discoms send from branded short IDs like VM-BESCOM, AD-BSESDL, JD-MSEDCL registered with TRAI’s DLT registry.
Step 3. You call the number. A calm voice answers. They confirm your name, address, sometimes even your CA (consumer account) number phished from a leaked database. The conversational confidence locks you in.
Step 4. They say to fix it you need to install a small app or click a link to make a token payment of ₹1 or ₹10 to validate the account. Sometimes they send a UPI ‘collect’ request instead.
Step 5. If you install the APK, it asks for SMS access, accessibility services, and overlay permissions. This combination lets the attacker read every OTP, draw fake login screens on top of your banking apps to harvest your PIN, and silently approve transactions. If you click a link, the page is a near-perfect replica of your discom’s payment portal capturing your card or UPI details.
Step 6. Within minutes, money leaves your account through a chain of mule UPI accounts and shell current accounts. By the time you realise, the trail is laundered.
Real discom communication vs the scam
This compare block is the single most useful thing in this article. Memorise it.
| What it is | Real discom communication | Electricity scam SMS |
|---|---|---|
| Sender | Registered branded sender ID (VM-BESCOM, AD-BSESDL, JD-MSEDCL, etc) registered on TRAI DLT | Personal 10 digit mobile number, sometimes international |
| Timing of disconnection notice | Multiple stages over 15+ days per Electricity Act 2003: bill, reminder, formal disconnection notice | Same day, almost always 9:30 PM or 10:00 PM |
| Channel | Your discom app, registered email, registered SMS, physical bill | Random SMS, sometimes WhatsApp |
| Payment ask | Pay through discom app, BBPS, official website, or authorised collection centre | Click link, install APK, scan attacker’s UPI QR, send to personal UPI ID |
| Tone | Formal, with bill number, CA number, billing period, due date | Urgent, broken English, no bill number, vague ‘previous bill not updated’ |
| Verification path | You can verify on discom website, discom app, or 1912 helpline | The scammer wants you to verify only by calling them back |
| App distribution | Only through Google Play Store and Apple App Store, linked from discom’s official .gov.in website | APK file sent directly through WhatsApp or downloaded from link |
If even one of these signals is off, treat the message as fraud until proven otherwise.
7 red flags to spot the electricity scam SMS
1. The sender is a personal 10 digit number
Your discom never sends bill or disconnection messages from a personal mobile. If the From field looks like a normal phone number, it is fraud.
2. The disconnection time is the same day, usually 9:30 PM or 10:00 PM
The Electricity Act 2003 mandates at least 15 days of formal notice for disconnection over non payment. A ‘today at 9:30 PM’ message is by definition not legitimate.
3. The English is broken and there is no bill information
No bill number. No CA (consumer account) number. No billing period. No specific outstanding amount. Just a vague claim that the previous bill is ‘not updated’.
4. There is a link or an APK file
Discom apps live on Google Play and the Apple App Store. No discom in India sends an APK file by SMS or WhatsApp.
5. The message asks you to call a person, not the helpline
Real notices point you to the discom app, 1912, the discom website, or your registered email. They do not say ‘call Mr Sharma on 9XXXXXXXXX’.
6. You have not received a bill in your registered channel recently
If the only place you are hearing about a ‘pending bill’ is this one panic SMS, it is fraud.
7. There is a small ‘validation payment’ of ₹1 or ₹10 ask
No legitimate Indian discom asks for a token amount to validate an account. The ask is bait to capture your card or UPI flow.
What to do if you got a panic electricity SMS but did not click
Do nothing about the SMS. Do not call the number. Do not click the link. Do not install the app.
Verify your actual electricity account through an official channel.
- Open your state discom’s official app, downloaded only from the Play Store or App Store. Check current and previous bills.
- Visit the discom’s official website (most are at a .gov.in or state government domain): bescom.karnataka.gov.in, bsesdelhi.com, mahadiscom.in, tneb.tnebnet.org, tssouthernpower.com, kseb.in, etc.
- Call 1912, the national power consumer helpline. It routes to your state discom.
- Use the National Power Portal at npp.gov.in or the Ministry of Power’s Garv app.
Once confirmed, report the fraud SMS to Chakshu at sancharsaathi.gov.in/sfc. Upload screenshot, sender number, link or APK file name. TRAI’s 2025 amendment lowers the action threshold to 5 complaints in 10 days for sender takedown.
What to do if you already clicked the link or installed the app
This is the part that matters most. Do not freeze. Do not feel ashamed. Move fast.
Step 1, within 5 minutes
Switch the phone to airplane mode if you installed an APK. This cuts the malware off from sending OTPs out. Do not turn the phone off completely; some malware persists across reboot and you want to preserve evidence for police.
Step 2, within 10 minutes
Call your bank’s 24x7 fraud helpline (printed on the back of your debit card or in your bank app’s emergency section). Block your debit and credit cards. Freeze UPI. Ask the bank to flag any pending or recent transactions for reversal.
Step 3, within 30 minutes
Call 1930, the national cybercrime helpline. State that you fell for an electricity disconnection scam, that money was transferred or that an APK was installed. Note the complaint number they give you.
Step 4, within 60 minutes
File the complaint online at cybercrime.gov.in. Upload screenshots of the SMS, the link or APK file name, transaction reference numbers if money moved, and the bank’s confirmation of card or UPI block. The Citizen Financial Cyber Fraud Reporting and Management System works best when reported within the first hour.
Step 5, same day
Report the sender to Chakshu at sancharsaathi.gov.in/sfc. This helps block the number for everyone.
Step 6, within 24 hours
For the phone itself if you installed an APK: with the SIM removed and the phone offline, back up only photos and essential files through a trusted laptop, then factory reset the device. Reinstall only apps from the official store. Change every banking password and UPI PIN from a different, clean device first.
Step 7
Call 1912 to inform your state discom of the impersonation. They cannot recover your money, but they can flag the impersonation pattern internally and to the police.
Step 8
WhatsApp +91 99644 43350 if you want a second pair of eyes walking through the steps. We help you understand the next hour and do not charge for it.
What we do at Cybersecify on this scam
Cybersecify is a Bengaluru based cybersecurity company. We get scam SMS screenshots forwarded to our WhatsApp every week, including this electricity variant. When you send us one, we decode the URL or APK, cross check the sender against TRAI’s DLT registry, walk you through the Chakshu and cybercrime.gov.in reporting steps, and tell you whether to block, ignore, or escalate. Free.
We do not ask for bank details, card numbers, OTPs, or UPI PIN. We do not interrogate. We verify.
Frequently asked questions
Is the SMS saying my electricity will be cut tonight at 9:30 PM real?
No. No legitimate state electricity board in India sends a one line SMS from a personal 10 digit number warning of a same day disconnection at 9:30 PM or any specific evening time, with a link to pay or an app to install. Real disconnection notices follow a documented process under the Electricity Act 2003.
What is 1912 and when should I use it?
1912 is the national power consumer helpline run by the Ministry of Power. It connects you to your state discom for billing complaints, supply issues, disconnection clarifications, and the electricity ombudsman process. Use 1912 to verify whether a disconnection notice is genuine or to escalate a billing dispute. For the cybercrime aspect of a fake electricity SMS, call 1930 in parallel.
I clicked the link. What do I do in the next hour?
Switch the phone to airplane mode if you installed an APK. Call your bank’s fraud helpline and block cards plus UPI. Call 1930. File at cybercrime.gov.in. Report the sender to Chakshu. WhatsApp +91 99644 43350 if you want help walking through the steps.
How is this different from the e-challan or India Post SMS scam?
Same mechanism (urgent SMS plus malicious link or APK), different trigger. E-challan claims a violation. India Post claims a held parcel. Electricity claims same day disconnection at 9:30 PM or 10:00 PM from a personal 10 digit number. The defence is identical: never click links in unsolicited SMS, verify through the official app or helpline, never install an APK from SMS.
Will my real electricity board ask me to install an app via SMS link?
No. Discom apps live only on the Play Store and the App Store, linked from the discom’s official .gov.in or government domain website. No legitimate Indian discom sends an APK file by SMS or WhatsApp. If your SMS link downloads a .apk file, it is malware.
Save these numbers now
Save them before you need them. During a panic SMS at 8 PM, you will not have time to search.
- Cybersecify free verification WhatsApp: +91 99644 43350
- 1930 national cybercrime helpline (24x7)
- 1912 national power consumer helpline
- cybercrime.gov.in to file the cybercrime complaint
- sancharsaathi.gov.in/sfc to report the fraud SMS sender
A note from us
We have spoken to people on WhatsApp who lost their savings to this exact scam. Retired teachers. Small shop owners. Software engineers who would have caught any other phishing attempt. The common thread is that the SMS arrived at the moment of maximum vulnerability: late evening, after a long day, with a threat aimed at the most basic household need.
You are not careless if this catches you. The scam is engineered to bypass careful. The durable defence is to have these numbers saved, to know the verify-by-1912-first rule, and to forward suspicious SMS to people who can decode them.
If a relative or a neighbour got one of these messages, send them this article.
Foundational reads. The anchors behind every guide on this site.
- The First Hour After Cyber Fraud in India. What to do in the first 60 minutes after you realise you have been scammed.
- Pause, Verify, Then Act. The universal three-rule defence against every scam type.
- Your Digital Footprint Is the Scam’s Raw Material. Why scammers already know your name, employer, and bank.
Disclaimer: This guide is for public awareness only. Cyber Secify is an independent cybersecurity consultancy and is not affiliated with or endorsed by any electricity board, state discom, the Ministry of Power, or any government agency. Verification is best effort guidance, not legal or law enforcement advice. For emergencies or legal reporting, always contact official authorities at 1930 and cybercrime.gov.in.