Fraudsters get crafty: Call Merging Scam, a new scheme to bait phone users

Another kind of OTP fraud stealing money from victims' bank accounts

Hyderabad: Cyber fraudsters are back in the market to cheat people with a new modus operandi, a ‘Call Merging Scam’, which is a simple yet crafty phishing approach that baits unsuspecting phone users and reels in sensitive information.

In Call Merging Scam, the fraudster pretending or posing to be a friend or acquaintance obtains the victim’s contact details through a mutual contact. The scammer then proceeds to call the victim and asks to merge the call with someone else, creating the illusion of a legitimate conversation.

---

“Unaware of the trap, the victim agrees, unknowingly linking the call to an OTP verification process from their bank. The scammer has timed everything perfectly, waiting until the victim receives the OTP. Assuming it to be a part of the ongoing call, the victim shares the OTP, only for the fraudster to use it to withdraw money from the bank accounts,” said a cybercrime official.

It is learnt that in some cases, fraudsters could pose as media professionals, inviting the victim to an event. During the conversation, the victim receives another call from an unknown number.

Once the victim shares the OTP, the transaction is completed, and the money is gone, leaving them stunned and helpless.

How the Call Merging Scam Works?

The victim receives a call from a stranger who claims to have received their number from a mutual friend. The scammer may offer an exclusive event invitation or a lucrative opportunity to build trust. Later, the fraudster requests to merge the call by claiming that a friend is calling from another number and asks the victim to merge the calls.

In reality, however, the second call is not from a friend but an automated OTP verification call from the victim’s bank. With the call merged, the victim unintentionally shares the OTP, allowing the scammer to quickly complete fraudulent transactions. The moment the OTP is revealed, scammers finalise the transaction, leaving the victim’s bank account drained.

Advisory:

• Avoid merging calls with unknown numbers. If someone insists on merging a call, refuse and verify their identity separately.
• Verify caller identity. If someone claims a friend is trying to reach you, contact the friend independently to confirm.
• Banks never ask for OTPs over calls. If you receive an unexpected OTP request, do not share it.
• If you receive an OTP for a transaction you did not initiate, immediately call the cybercrime helpline 1930 and inform your bank.