Electricity Bill Scam on WhatsApp & SMS — Recovery & Reporting Guide (2026)

“Dear customer, your electricity will be disconnected today at 9:30 PM as your bill is unpaid. Call 9XXXXXXXXX immediately.” — this SMS or WhatsApp message is now the single most common utility scam in India. The phone number leads to an “officer” who installs a remote-access app and drains your bank account in minutes. This page is the 30-second verification + recovery playbook, updated for 2026 with BNS, 2023 provisions, RBI zero-liability framework, and state-wise DISCOM verification portals.

Citizen Crisis Response Network — verification rule\\
Real DISCOMs in India never threaten 24/7-hour disconnections via personal-mobile SMS. They use registered DLT IDs (e.g., BSESDR, MSEDCL, TPDDLP) and only after multi-month written notice. Learn more about the Citizen Crisis Response Network.

Electricity disconnection threats over WhatsApp / SMS / personal mobile numbers in India are scams. Real DISCOMs (BSES, Tata Power, Adani Electricity, MSEDCL, TNEB, KESCO, KSEB) send bills through their registered DLT sender IDs, the official app, or printed bill at your meter. Verify by logging into the DISCOM's official portal or app directly (not from any link in the SMS). If you have already paid or shared remote-access (AnyDesk / TeamViewer / RustDesk), call 1930, file at cybercrime.gov.in, block the debit card, and email your bank within 24 hours under RBI's 2017 framework. Detailed steps: 1930 helpline script and UPI fraud recovery steps.

• How the scam works
• Five red flags
• Verify in 2 minutes
• 30-minute recovery drill
• Scam comparison table
• DISCOM disconnection rules
• Legal sections
• Compensation
• RTI escalation
• What not to do
• Sample complaint
• FAQ

The electricity bill scam is a three-stage social engineering attack that exploits fear of disconnection to trick victims into installing remote-access tools:

1. Bait — SMS / WhatsApp from a 10-digit number (not a DLT ID): “Your bill of ₹XXX is unpaid. Disconnection in 2 hours. Call 9XXXXXXXXX.”
2. Trap — You call. The “officer” says the bill is “stuck in the system” and asks you to install AnyDesk / Quick Support / RustDesk to “verify your meter ID.” Or sends an APK or a UPI “₹1 verification.” The scammer may also use AI voice cloning to sound like an official DISCOM representative.
3. Drain — While you watch the screen, the attacker triggers UPI / net-banking on the side, captures the OTP through screen-share, and empties accounts. Some scammers use UPI autopay mandate fraud to set up recurring auto-debits.

The defining signature: personal mobile number in the SMS + time pressure + request for screen-share or UPI verification.

Citizen tip — Scammers increasingly use WhatsApp Business accounts with profile photos cloned from DISCOM logos. A “verified” green badge on WhatsApp means the number is registered with Meta — it does NOT mean the person is a DISCOM employee. Real DISCOM messages come from official DLT sender IDs, not personal WhatsApp numbers.

Citizen tip — If even one red flag is present, treat the message as a scam. Do not call the number in the SMS. Verify only by logging into your DISCOM's official app or portal.

1. Open the DISCOM's app or portal directly — examples:
   • Delhi BSES: bsesdelhi.com / BSES Connect app
   • Tata Power-DDL: tatapower-ddl.com
   • Adani Electricity Mumbai: adanielectricity.com
   • MSEDCL: mahadiscom.in / Mahavitaran app
   • TNEB: tnebltd.gov.in
   • KESCO: kescoin.in
   • BESCOM: bescom.org
   • KSEB: kseb.in
2. Login with your consumer / connection number — usually printed on every prior bill.
3. Check current dues — disputed amount, due date, last paid date.
4. Look at notice history — real disconnection always preceded by 15-30-day written notice.
5. If the portal shows no dues, the SMS is a scam. Block + report.

If your DISCOM is not listed, search “<state> electricity board official site” — and only click the result that matches the official ``.gov.in`` / ``.com`` domain printed on your prior bill. For electricity bill disputes beyond verification, see RTI for electricity bill dispute.

The electricity bill scam is part of a broader family of utility-impersonation and remote-access frauds. Understanding the pattern helps you spot variants before they succeed. Compare the most common ones:

Pattern insight — Every one of these scams shares three elements: (1) urgency (“act now or lose X”), (2) authority impersonation (DISCOM officer, police, bank manager), and (3) payment/app installation request. If you spot any two, it's a scam. See also Telegram vs WhatsApp scam comparison.

Real electricity disconnection follows a legally mandated procedure that takes weeks, not hours. Understanding the actual process is the strongest defence against the scam:

1. Billing cycle — DISCOMs generate bills monthly or bi-monthly. The due date is typically 15–21 days after bill generation.
2. Due date + grace — After the due date, most State Electricity Regulatory Commissions (SERCs) allow a 7–15 day grace period before any disconnection action.
3. Written notice — Before disconnection, the DISCOM must serve a written notice (typically 15 days) specifying the outstanding amount, the disconnection date, and the grievance redressal mechanism. This notice is:
   • Delivered by field staff or posted to the registered address
   • Sometimes sent via the DISCOM's registered DLT sender ID (not a personal number)
   • Never sent via WhatsApp from a personal number
4. Field visit — On the disconnection date, a DISCOM employee with an ID card physically visits the premises to disconnect the meter. They do not call you to “verify.”
5. Reconnection — After payment of dues, reconnection is done within 24–48 hours.

The Electricity Act 2003 and state-specific Electricity Supply Codes govern this process. SERC tariff orders specify exact notice periods — for example, the Delhi Electricity Regulatory Commission (DERC) requires a minimum 15-day written notice. See also Central Electricity Regulatory Commission (CERC).

Key takeaway — If the “deadline” is measured in hours and comes from a personal number, it is always a scam. Real disconnections take weeks of documented procedure.

Electricity bill scammers can be prosecuted under multiple overlapping statutes. If you file an FIR, these are the sections the police should invoke:

Filing tip — Under BNS, 2023, FIR registration for cheating is mandatory. Police cannot refuse to register a complaint for electricity bill fraud. See Zero FIR procedure under BNSS §173 and your rights during FIR/arrest. You can also track your complaint via cybercrime complaint status check.

If you already (a) called the number, (b) installed an app, © paid a “verification” amount, or (d) shared an OTP:

1. 0–2 min: Disconnect data / power off the phone if AnyDesk-class app is installed
2. 2–5 min: Change net-banking password from a different device
3. 5–8 min: Block the debit card via the bank app or 24×7 number
4. 8–10 min: Disable / de-register UPI in every UPI app on the device — see UPI fraud recovery for per-app steps
5. 10–15 min: Call 1930 within 90 minutes; note the cyber-helpline complaint number — full script at 1930 helpline script
6. 15–25 min: File at cybercrime.gov.in with the SMS screenshot, APK file (if you can extract it), bank statement
7. 25–30 min: Email your bank's “report unauthorised transaction” form quoting the 1930 number — invoke RBI's 2017 zero-liability framework. See bank refused cyber fraud refund guide.
8. Factory-reset the phone if any sideloaded APK was installed
9. DISCOM — call the official number and inform them of the impersonation
10. Local police FIR — under BNS, 2023 §316 + §319 + IT Act §66D

Emergency step — Most “verification UPI ₹1” links are spoofed payment QRs that auto-fill ₹50,000+ on the second tap. Always check the payee name on the UPI confirmation screen before entering PIN. If your bank account is frozen after the scam, see bank account freeze recovery.

1. 0–2 min — Verify dues by logging into the DISCOM portal directly
2. 2–10 min — If money moved: change net-banking password; block debit card; de-register UPI
3. 10–20 min — Call 1930; file at cybercrime.gov.in
4. 20–30 min — Email bank's “report unauthorised transaction” with all references
5. +24 h — DISCOM written complaint; FIR at local station
6. +72 h — RBI bank-dispute window for any debit — see failed transfer refund guide

Yes — multiple compensation channels exist depending on where the failure occurred:

• Bank refund (RBI zero-liability) — Under RBI Master Direction on Limiting Liability of Customers (2017): zero liability if reported within 3 working days; limited liability up to 7 working days. Show the screen-share / APK pattern as “deceit” — see how to claim zero-liability refund.
• Banking Ombudsman (RB-IOS 2021) — If the bank stalls or rejects your claim, escalate to the Banking Ombudsman at cms.rbi.org.in. Walkthrough: Banking Ombudsman complaint guide.
• Consumer court — For negligence (e.g., bank ignored unusual large debit alert, DISCOM failed to issue advisory despite repeated complaints). See NCH + consumer court guide.
• DISCOM apology + advisory — For letting the impersonation persist; raise via RTI / consumer forum if not addressed — see RTI for electricity bill dispute.
• Telecom / DLT trace — TRAI / DoT can fine the originating telemarketer if reported via Sancharsaathi → Chakshu. See TRAI DND spam complaint guide.
• Credit card dispute — If the scammer charged a credit card, file a chargeback: credit card dispute guide.

If your DISCOM refuses to act on your impersonation complaint or fails to issue a public advisory despite multiple reports, an RTI application forces them to respond in writing within 30 days:

1. Ask the DISCOM's PIO: “How many electricity bill scam impersonation complaints were received in the last 12 months? How many public advisories were issued? What action was taken against fraudsters using the DISCOM's name?”
2. Ask the State SERC: “What are the disconnection notice procedures mandated for licensees? What penalties have been imposed for violations?”
3. If money was lost and police/cyber-cell is inactive: File RTI with the police PIO asking for investigation status. See cybercrime complaint status and CIC UPI transaction data case for precedent.

• Do not call the number printed in the SMS / WhatsApp.
• Do not install AnyDesk, TeamViewer, QuickSupport, RustDesk, or any APK on a “DISCOM officer's” instruction. See app permissions guide to understand why these tools are dangerous.
• Do not scan a QR code sent over SMS / WhatsApp claiming to be a “verification.”
• Do not enter UPI PIN on any “₹1 verification” screen — payment apps never require PIN to receive money.
• Do not delay the FIR / 1930 call out of embarrassment — recovery is time-sensitive. See why Indians fear filing complaints after a scam.
• Do not forward the SMS to others without redacting your consumer number and personal details.
• Do not factory-reset the phone before taking screenshots of the SMS, call log, and any suspicious apps — these are evidence for the police and bank.
• Do not believe “WhatsApp verified badge” — it only means the number is registered with WhatsApp Business, not that it belongs to the DISCOM.

To,
The Customer Service Officer,
[DISCOM Name], [Division / Sub-division]

Subject: Complaint of impersonation and electricity-bill scam SMS —
request for public advisory and verification — Consumer no. [______]

Sir / Madam,

I, [Full name], holder of consumer connection [number] for the premises
at [address], received a fraudulent SMS / WhatsApp message dated [date]
at [time] purporting to be from your DISCOM, threatening disconnection
within [X] hours and asking me to call [number].

The message did not originate from your registered DLT sender ID. The
phone number provided is not listed on your official portal /
customer-care contacts.

I have:
  1. Filed a complaint at cybercrime.gov.in (Reference: ___) and
     called 1930 (Reference: ___).
  2. Reported the SMS at sancharsaathi.gov.in → Chakshu (Reference: ___).
  3. [If money was lost] Filed a written request to my bank under RBI's
     Master Direction on Limiting Liability of Customers, 2017
     (Reference: ___).

I request the DISCOM to:
  a) Issue a public advisory on impersonation / scam SMSes.
  b) Confirm in writing that no disconnection notice has been issued
     against my consumer number.
  c) Coordinate with the cyber cell on impersonation under
     IT Act §66D and BNS, 2023 §316 / §319.

Yours faithfully,
[Signature, Name]
[Phone, Email, Date]

• WhatsApp OTP fraud explained
• WhatsApp electricity disconnection scam (dedicated page)
• WhatsApp account banned or hijacked — recovery
• Fake KYC update scam
• Fake police notice PDF scam
• Fake Aadhaar update website fraud
• Telegram vs WhatsApp scam comparison
• Telegram investment scam
• Telegram part-time job scam
• AI voice scam recovery
• ATM fraud recovery
• AEPS / Aadhaar payment fraud
• Scammed on UPI — recovery steps
• UPI fraud recovery India
• UPI autopay mandate fraud
• Bank account freeze recovery
• Bank refused cyber fraud refund — zero liability
• Banking Ombudsman complaint guide
• Money sent to wrong bank account
• Block lost / stolen SIM card
• Check SIM misuse via TAFACP
• Unknown mobile numbers in my name — Sanchar Saathi
• TRAI DND — stop spam calls/SMS
• TRAI AI spam detection
• Binary trading scam India
• WFH task scam recovery
• Stock market Telegram tips scam
• App permissions guide
• Zero FIR procedure
• Arrest / FIR notice rights
• RTI for electricity bill dispute
• Water/sewer bill complaint
• Streetlight not working complaint
• Consumer court / NCH guide
• Citizen Crisis Response Network

Because impersonators clone the DISCOM's bill format. Even logo + colour scheme can be perfect. Authenticity is judged by sender ID + portal verification, not by visual similarity. Scammers often have your name, consumer number, and address from data leaks — see data leaks in India for context.

No. The ₹10 is the trigger, not the loss. The next step (often within minutes) is screen-share + bigger drain. Treat ₹10 as the alarm and run the 30-minute recovery drill immediately.

Some do — but only after you opt in through their app or portal, and always with the registered WhatsApp Business number (verified badge). A random 10-digit WhatsApp claim is a scam. See when WhatsApp notices are valid in court for legal context.

No — it's a legitimate remote-support tool. The fraud is in being tricked into giving the access code to a stranger. Uninstall it after use; never run it on a banker / DISCOM officer's request. Understand why these tools are dangerous in our app permissions guide.

DISCOM app → Bill summary; the printed bill at your meter; or call the official customer-care number printed on the bill (not the SMS).

Under RBI's 2017 zero-liability framework: 100% if reported within 3 working days, limited liability (₹25,000–₹50,000) if reported within 7 days. After 7 days, recovery depends on bank policy and the amount traced. If the bank refuses, escalate to the Banking Ombudsman. See how to claim zero-liability refund.

Yes. Under BNS, 2023 §316 (cheating by personation) and IT Act §66D, this is a cognisable offence. Police must register the FIR. If the local station refuses, file a Zero FIR at any station — see Zero FIR procedure. Track status via cybercrime complaint status.

Three channels: (1) Call 1930 (National Cyber Crime Helpline), (2) File at cybercrime.gov.in, (3) Report the fraudulent number at Sancharsaathi → Chakshu. See TRAI DND complaint guide for telecom-level reporting.

Banks sometimes freeze accounts as a precaution after a cyber fraud report. This is temporary — see bank account freeze recovery for step-by-step unfreezing. Also see bank freeze cyber fraud and account freeze/unfreeze guide.

Yes — but redact your consumer number, name, and address first. Forward also to PIB Fact Check (WhatsApp +91-8799711259) and Sancharsaathi → Chakshu.

Never. DISCOMs verify meter IDs through field staff or your authenticated app session — never via SMS or WhatsApp.

Use the DoT's TAFACP portal to check SIM cards linked to your Aadhaar. See TAFACP SIM misuse check and unknown numbers in my name.

Yes. File an RTI with the DISCOM's PIO asking how many impersonation complaints were received and how many advisories were issued. If no reply in 30 days, file a first appeal — see deemed refusal appeal. See also RTI for electricity bill dispute.

• MHA — National Cyber Crime Reporting Portal: cybercrime.gov.in · Helpline 1930
• DoT — Sancharsaathi → Chakshu: sancharsaathi.gov.in for fraud SMS reporting
• PIB Fact Check: factcheck.pib.gov.in · WhatsApp +91-8799711259
• Press Information Bureau (PIB): pib.gov.in — government advisories and press releases
• Ministry of Home Affairs (MHA): mha.gov.in — cyber crime policy and I4C
• TRAI: trai.gov.in — DLT non-compliance complaints and telecom regulation
• Central Electricity Regulatory Commission (CERC): cercind.gov.in — inter-state transmission tariffs
• POWERGRID: powergrid.in — national grid operator
• RBI Master Direction on Limiting Liability of Customers, 2017: rbi.org.in
• RBI Banking Ombudsman: cms.rbi.org.in
• State Electricity Regulatory Commission (SERC) for tariff / disconnection rules
• Central Electricity Authority (CEA) for technical standards
• BNS, 2023 §316 (personation), §318 (cheating with property), §319 (cheating)
• IT Act 2000 §66C (identity theft), §66D (impersonation)

This page draws on the following primary sources:

• National Cyber Crime Reporting Portal (cybercrime.gov.in) — MHA's official portal for reporting cyber crimes
• PIB Fact Check (factcheck.pib.gov.in) — Government's fact-checking initiative for fake news and scam alerts
• Sancharsaathi (sancharsaathi.gov.in) — DoT's citizen portal for reporting fraudulent communications
• Telecom Regulatory Authority of India (trai.gov.in) — DLT sender ID regulations and spam complaint procedures
• Ministry of Home Affairs (mha.gov.in) — Indian Cyber Crime Coordination Centre (I4C) advisories
• Press Information Bureau (pib.gov.in) — Official government press releases on cyber fraud advisories
• POWERGRID (powergrid.in) — National electricity grid infrastructure
• Central Electricity Regulatory Commission (cercind.gov.in) — Electricity regulation and tariff orders
• Reserve Bank of India (rbi.org.in) — Master Direction on Limiting Liability of Customers in unauthorised electronic transactions
• RBI Complaint Management System (cms.rbi.org.in) — Integrated Banking Ombudsman Scheme 2021
• BNS, 2023 — Bharatiya Nyaya Sanhita, 2024 (sections 316, 318, 319)
• Information Technology Act, 2000 — Sections 66C and 66D
• Electricity Act, 2003 — Disconnection procedures and consumer protection provisions