WhatsApp Electricity Disconnection Scam: Verify and Block (2026)

It is 9 PM in Bengaluru, Mumbai, Delhi, Chennai, or Hyderabad and your phone buzzes with a WhatsApp message: “Dear Customer, your electricity will be DISCONNECTED at 9:30 PM today, last bill not paid, pay ₹500 immediately via this APK or UPI to avoid disconnection.” The message often comes from a +91 number with a name like “Electricity Officer” or a random foreign code (+92, +234, +44). The first 80 words: do NOT install any APK file, do NOT click any UPI link, do NOT call the number on the message. Indian DISCOMs (BESCOM, MSEDCL, BSES Rajdhani, BSES Yamuna, TPDDL, TANGEDCO, TSSPDCL, UPPCL, KSEB, PSPCL) NEVER disconnect supply through WhatsApp at night. Verify on the official portal in 60 seconds, screenshot the scam, dial 1930, and file on https://cybercrime.gov.in.

1. Take screenshot of the WhatsApp message, the sender number, and any APK or UPI link inside it.
2. Note the exact time the message arrived and the consumer account number it claims belongs to you.
3. Do not click the APK link, do not install any app, do not respond to the sender, do not call back.
4. Open your DISCOM official portal (BESCOM, MSEDCL, BSES, TPDDL, TANGEDCO) and check actual bill status using your real consumer number.
5. Report the WhatsApp number inside WhatsApp (Block and Report), then dial 1930 and file on https://cybercrime.gov.in.

🟡 Citizen tip , No DISCOM in India sends disconnection notices through WhatsApp. Real disconnection notices come on physical paper, on the printed bill, by SMS from a 6-character DLT-registered sender ID, or by a recorded IVR call from the official DISCOM number, never from a personal WhatsApp account at night.

1. Stop. Do NOT install the APK. Android APK files from WhatsApp are the No. 1 vector for screen-mirror trojans like SOVA, BRATA, and DroidBot in 2026. Once installed, the app reads OTPs and drains UPI accounts within minutes.
2. Open a fresh browser tab and verify your bill yourself. BESCOM at https://bescom.karnataka.gov.in, MSEDCL at https://www.mahadiscom.in, BSES Rajdhani at https://www.bsesdelhi.com, BSES Yamuna at https://www.bsesdelhi.com, TPDDL at https://www.tatapower-ddl.com, TANGEDCO at https://www.tnebltd.gov.in, TSSPDCL at https://www.tssouthernpower.com, UPPCL at https://uppclonline.com, KSEB at https://wss.kseb.in, PSPCL at https://www.pspcl.in. Use your real Consumer ID or RR number printed on your last paper bill.
3. Take screenshots of the WhatsApp thread end to end, including the sender number with country code, the APK file name, the UPI handle, the threatening text, and any timestamp.
4. Inside WhatsApp tap the sender number, scroll down, tap “Report” and then “Block”. This forwards the last 5 messages to WhatsApp Trust and Safety which is required to act under IT Rules 2021 Rule 4(2).
5. Dial 1930 (National Cyber Crime Helpline) within 30 minutes if you already paid or installed the APK. The operator can flag the destination UPI VPA and freeze the amount before withdrawal.
6. File the complaint at https://cybercrime.gov.in under “Report and Track” then “Report Cybercrime” then “Financial Fraud” with subcategory “UPI Fraud” or “Phishing/APK Trojan”. Note the NCRP acknowledgement number.
7. Email or call your DISCOM consumer-care line with a screenshot of the scam message asking them to publish a public advisory and to confirm your account is in good standing. BESCOM 1912, MSEDCL 1912, BSES 19123, TPDDL 19124, TANGEDCO 94987 94987.
8. Lock your UPI: open BHIM/GPay/PhonePe, reduce daily limit to ₹1, disable AutoPay mandates, then ring your bank to put a 24-hour hold on outward UPI if APK was installed.

• Full WhatsApp chat with the scammer, scrolled top to bottom, with visible sender number and timestamps
• Screenshot of the APK file name, file size, and any UPI link or QR code in the message
• Screenshot of the official DISCOM portal showing your real bill status (paid or due) for evidence of no actual default
• Your last paper or PDF electricity bill with Consumer ID, RR number, sanctioned load, and connection address
• UPI transaction details if any payment was already made (UTR, VPA, amount, time)
• Bank statement extract for the last 24 hours
• Your government ID (Aadhaar / PAN) for FIR
• Phone bill or call log if voice calls were exchanged with the scammer
• Mobile device logs showing APK installation time if you installed it (Settings, Apps, Recently Installed)
• 1930 ticket reference and NCRP acknowledgement number

🟡 Trust signal , Bharatiya Sakshya Adhiniyam 2023 Section 63 admits screenshots and WhatsApp exports as primary electronic evidence when forwarded to your own email or saved with timestamp preserved. Section 65B certificate is replaced by §63(4) self-certification.

The first stop is the National Cyber Crime Reporting Portal at https://cybercrime.gov.in operated by the Indian Cybercrime Coordination Centre (I4C) under the Ministry of Home Affairs. File within 30 minutes of the message arriving (or paying), and parallelly call 1930 because the helpline operator can freeze the destination UPI account on your behalf. Within 24 hours, walk into the nearest Cyber Police Station with a printout of your NCRP acknowledgement and demand FIR registration under BNS 2024 §318 (cheating), §319 (cheating by personation), §336 (forgery), and IT Act 2000 §66C (identity theft) and §66D (cheating by personation using computer resource). The Supreme Court in Avnish Bajaj v. State (2008) 150 DLT 769 (Delhi HC) and the underlying principles affirmed by the Supreme Court have made clear that intermediary platforms must preserve and produce sender data for active police investigations. The Bombay High Court in Sunil Mahadev Patil v. State of Maharashtra (2019) reaffirmed the duty of telcos and OTT platforms to assist cyber probes.

🟡 Most citizens miss this , Consumer court fee starts at ₹100. e-Daakhil online filing needs no lawyer. Median resolution 6 to 12 months for DISCOM-related grievances if your DISCOM ignored a scam advisory request.

Tier 1 platform: Grievance Officer of WhatsApp at [email protected] (under IT Rules 2021). Email with the sender number, screenshots, NCRP acknowledgement, and citation of IT Rules 2021 Rule 4(2) and Rule 4(8) demanding 24-hour action and KYC disclosure to law enforcement. DPDP Act 2023 §27 right to erasure adds extra weight in 2026 if the scammer also misused your name or photo.

Tier 2 regulator: Indian Cybercrime Coordination Centre (I4C), TRAI for SMS spoofing if the scammer also sent fake DLT SMS, MeitY for IT Rules 2021 violations, and CERT-In at https://cert-in.org.in for the takedown of any phishing URL or APK distribution domain. State Electricity Regulatory Commissions (KERC for Karnataka, MERC for Maharashtra, DERC for Delhi, TNERC for Tamil Nadu) can be approached if the DISCOM did not publish a public scam advisory.

Tier 3 court and FIR: Cyber Police Station FIR under BNS 2024 §318 (cheating), §319 (cheating by personation), §336 (forgery), §351 (criminal intimidation if the message threatened disconnection as coercion), IT Act 2000 §66C (identity theft), §66D (cheating by personation using computer resource), and §43 (damage to computer if the APK exfiltrated data). For systemic platform failure to act, file a writ petition in the High Court invoking Article 21 right to privacy as in K.S. Puttaswamy v. Union of India (2017) 10 SCC 1. The Supreme Court has been clear that intermediaries cannot hide behind §79 safe harbour when they ignore valid takedown notices.

To,
The Grievance Officer
WhatsApp LLC (India)
Email: [email protected]

Subject: URGENT account suspension and KYC disclosure under IT Rules 2021 and BNS 2024

Sir/Madam,

I, [Full Name], an Indian citizen with mobile [number] and electricity Consumer ID [number] under [DISCOM name], received a fraudulent WhatsApp message on [date] at [time] from sender [+91 number with country code] threatening immediate disconnection of my electricity supply unless I paid Rs[amount] via APK file [filename] or UPI handle [VPA].

I have verified through the official [DISCOM] portal that my account is in good standing with no overdue amount. I have filed complaint number [NCRP ACK] with the Indian Cybercrime Coordination Centre on [date] and reported the matter to 1930 vide ticket [number].

Under Rule 4(2) and Rule 4(8) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, you are required to suspend the offending account and preserve all KYC and message logs for law enforcement within 24 hours of being notified. Under Section 27 of the Digital Personal Data Protection Act 2023, I exercise my right to erasure of any of my personal data shared on or through your platform by the scammer.

Please:
1. Suspend the sender account [+91 number] immediately
2. Preserve all logs, IP addresses, device IDs, and KYC of that account for law enforcement
3. Provide me a confirmation of suspension within 24 hours
4. Share the preserved data with the Cyber Police Station investigating my FIR
5. Add the APK file hash and UPI VPA to your spam database

Attached: Screenshots of the WhatsApp thread, sender number with timestamp, APK filename, UPI link, official DISCOM bill status, NCRP acknowledgement, my Aadhaar masked.

Yours faithfully,
[Name]
[Mobile] [Email] [Date]

To,
The Public Information Officer
[BESCOM / MSEDCL / BSES Rajdhani / TPDDL / TANGEDCO]
[Registered Office Address]

Subject: Application under Section 6(1) of the Right to Information Act 2005

Sir/Madam,

I, [Name], a registered consumer with Consumer ID [number] under your jurisdiction, request the following:

1. Standard Operating Procedure issued by the DISCOM for serving disconnection notices to consumers, including the prescribed mode of communication (paper, SMS, IVR, e-mail).
2. Whether the DISCOM ever sends disconnection notices through WhatsApp messages from non-DLT private numbers, and if not, the policy circular confirming the same.
3. Number of consumer complaints received in the last 90 days regarding fraudulent WhatsApp messages impersonating the DISCOM.
4. Public advisories issued by the DISCOM through print, broadcast, social media, and SMS warning consumers about the WhatsApp electricity disconnection scam.
5. Coordination protocol between the DISCOM, the State Cyber Police, and I4C for takedown of fake numbers and APK files used to impersonate the DISCOM.
6. Action taken report on consumer complaints regarding this specific scam pattern referred above.

I enclose ₹10 fee in the form of IPO. I am an Indian citizen.

Yours faithfully,
[Name]
[Mobile] [Address] [Date]

For the WhatsApp scam itself, FIR is the primary remedy under BNS 2024 §318, §319, §336 and IT Act 2000 §66C and §66D. Consumer court is NOT the right forum for the scam itself. However, if the DISCOM actually disconnected your supply on a fraudulent or paid-up bill, or if the DISCOM failed to publish a scam advisory despite repeated complaints, that constitutes deficiency in service under Consumer Protection Act 2019 §2(11). The DCDRC handles claims up to ₹50 lakh, State Commission up to ₹2 crore, NCDRC above ₹2 crore. Filing fee from ₹100 at https://edaakhil.nic.in. Claim refund of any wrongly recovered amount, compensation for distress and harassment caused by wrongful disconnection, plus costs. The Supreme Court in Karnataka Power Transmission Corporation v. Ashok Iron Works (2009) 3 SCC 240 confirmed that electricity supply is a “service” under the Consumer Protection Act and DISCOMs are answerable in consumer fora. Stack the consumer complaint on top of the FIR, never instead of it.

🟡 Do this immediately , Disable UPI auto-debit and reduce per-transaction limit to ₹1 the moment you receive any suspicious message. Restoring later takes 24 hours; preventing further loss takes 30 seconds. Also enable Google Play Protect's “scan APK files” toggle on Android.

• 🛡️ Weekend Problem Solver , 15 emergency topics hub
• 🛡️ Citizen Crisis Response Network , 100 guides
• ☎️ Fake customer-care number scam
• 🛂 Digital arrest / fake notice scam
• 🏦 Fake KYC update scam
• 💸 Money transferred to wrong UPI account , recovery
• 🏦 Banking Ombudsman + RBI complaint route
• 📚 RTI application format and full guide
• 🪄 AI RTI Drafter , free tool
• 📬 PIO Reply Checker

Login to RTI Wiki to download the printable PDF checklist for this article.

Take a deep breath. Indian DISCOMs do not disconnect supply on WhatsApp deadlines, and never at night. Open the official DISCOM portal in a fresh browser tab using your Consumer ID printed on your last paper bill. If the portal shows no overdue amount, the WhatsApp message is a scam. Screenshot the message, block and report the sender inside WhatsApp, and file at https://cybercrime.gov.in. The Electricity Act 2003 §56(1) requires a 15-day prior written notice before disconnection, served physically or through registered communication, never through a WhatsApp message from an unknown number.

Treat your phone as compromised. Switch to airplane mode, then power off. On a different device, log into your bank and UPI apps, change PINs, freeze cards, and contact your bank's 24×7 fraud helpline. Boot the suspect phone in safe mode, uninstall the APK from Settings - Apps - Recently Installed, then perform a factory reset. Call 1930 within 30 minutes to flag any UPI VPA the scam pushed and to freeze outgoing transfers. File on https://cybercrime.gov.in under “Phishing/APK Trojan”. RBI's customer protection circular dated 6 July 2017 gives zero liability for unauthorised electronic transactions caused by third-party fraud if reported within 3 working days.

Maybe. Call 1930 within 30 minutes of the transfer and the helpline operator can request the destination bank to freeze the amount before withdrawal. Recovery rate falls from around 70 percent at 30 minutes to under 10 percent after 24 hours. File a written complaint with your bank under RBI's customer protection circular dated 6 July 2017 demanding zero liability. Also file the NCRP complaint and follow up with the bank's nodal officer in 7 days, then escalate to the RBI Banking Ombudsman if the bank refuses to act.

Yes. Scammers set their WhatsApp display name and profile picture to mimic the DISCOM logo, but the sender number is always a personal SIM. Real DISCOM numbers are short helplines (1912, 19123, 19124) or 6-character DLT-registered SMS sender IDs, not 10-digit personal SIMs. The Telecom Commercial Communications Customer Preference Regulations 2018 require all bulk transactional SMS from DISCOMs to come from DLT-registered headers.

Indian police can still act on the Indian leg of the offence (the UPI VPA, the bank account, or the APK distribution server). The I4C coordinates with WhatsApp's India grievance officer under IT Rules 2021, and most scam UPI VPAs are linked to Indian KYC accounts which give actionable leads. File the NCRP complaint and mention the country code clearly so I4C tags the case for international coordination.

Smart-meter rollouts in BESCOM, MSEDCL, BSES, TPDDL, and TANGEDCO since 2024 have made consumers aware that disconnection can be remote, which the scammers exploit. WhatsApp Business API misuse lets them send templated messages cheaply, and APK-based banking trojans (SOVA, BRATA, DroidBot) have lowered the technical bar. CERT-In issued advisory CIAD-2026-0118 dated 18 January 2026 specifically warning against this APK scam.

First, file an RTI under §6(1) of the RTI Act 2005 to the DISCOM PIO seeking the SOP and the public advisory record. If the DISCOM does not respond in 30 days, escalate to the First Appellate Authority and then the State Information Commission. Parallelly approach the State Electricity Regulatory Commission (KERC, MERC, DERC, TNERC, TSERC, UPERC) under §142 and §146 of the Electricity Act 2003 for breach of consumer-protection obligations. The State Commission can fine the DISCOM up to ₹1 lakh per day of continuing default.

Yes. Forward the message and sender number to 1909 (TRAI DND) and file at https://www.tafcop.dgtelecom.gov.in for fraudulent SIM use. TAFCOP can disconnect a SIM proven to be misused under the Telecommunications Act 2023 §20. Add the number to https://sancharsaathi.gov.in under “Report Suspected Fraud Communication”.

The WhatsApp electricity disconnection scam thrives on panic, on the fear that your fridge, your AC, your child's homework will go dark in 30 minutes. The reality in 2026 is that no DISCOM in India disconnects supply through a WhatsApp message at night, that the Electricity Act 2003 §56 mandates a 15-day prior physical notice, and that one minute on the official portal will tell you the truth. Do not install the APK, do not pay the UPI, dial 1930, file on the National Cyber Crime Reporting Portal, demand WhatsApp account suspension under IT Rules 2021 Rule 4(2), and let your local DISCOM know so they can publish a citywide advisory. The Citizen Crisis Response Network keeps a state-wise list of cyber-savvy lawyers and DISCOM consumer-grievance officers who can stand with you in those critical first 24 hours.