Hyderabad cybercrime alert: Beware of call-merging OTP fraud

Cybercrime officials have warned of a fraud targeting bank customers through smartphone call-merging features. Fraudsters pose as bank or service officials, persuade victims to merge calls and then obtain OTPs triggered by transactions initiated using information gathered from the victims

Hyderabad: Cybercriminals are exploiting a little-used smartphone feature that allows two calls to be merged, using it to keep unsuspecting bank customers on conference calls while attempting to obtain one-time passwords (OTPs) and facilitate fraudulent transactions, cybercrime officials have warned.

In this modus operandi, fraudsters typically pose as bank officials, courier company representatives or employees of utility service providers. They contact potential victims with a fabricated emergency, claiming that an unauthorised transaction has been detected, a bank account is about to be suspended or a parcel requires verification.

---

After establishing contact, the caller tells the victim that the call needs to be transferred to a “senior official”, “verification cell” or automated system. The victim is then instructed to use the ‘Add Call’ option on the phone and merge the calls.

Meanwhile, the fraudster initiates a financial transaction using information obtained from the victim during the conversation. This may trigger an OTP or an automated verification call, after which the victim is persuaded to disclose the OTP.

“Once the victim shares the OTP, the fraudster may use it to complete the transaction that was initiated using the victim’s banking or card details. The amount is then debited from the victim’s account or transferred to an account controlled by the fraudsters,” a cybercrime official said.

Cybercrime officials have advised people not to add or merge calls at the request of unknown callers. They have also cautioned people against sharing OTPs, PINs, passwords, card details or internet banking credentials over the phone.

Anyone receiving a call about a suspicious transaction or an account-related issue should disconnect and contact their bank through its official customer-care number or verified digital channels.

Officials have urged people to be particularly cautious when callers claim that immediate action is needed to prevent an account from being blocked or a transaction from being processed.

Cybercrime officials reiterated that banks and other legitimate financial institutions do not ask customers to disclose OTPs or other confidential banking credentials over telephone calls.