Beware Of Call Merging Scams: How Cybercriminals Steal OTPs And Bank Funds

With the increasing use of digital transactions, cybercriminals are developing new ways to defraud people. One such emerging scam that has recently caught the attention of authorities is the call merging scam. Consumers are tricked into merging conversations in this tech-enabled scam, which unintentionally exposes One-Time Passwords (OTPs) and gives scammers access to bank accounts so they may steal money. The National Payments Corporation of India, which created the Unified Payments Interface (UPI), has already released safety recommendations and warned about this scam to keep customers secure.

How the Call Merging Scam Works

Scammers have found a smart way to take advantage of unsuspecting people by utilizing the call-merging feature on cell phones. Here’s how the scam usually works:

1. Initial Contact: The trick starts when a scammer calls an unsuspecting victim, posing as having obtained their telephone number from a friend or a respectable institution.
2. Request to Merge Calls: The scammer tells the victim that there’s a ‘trustworthy individual’ or their ‘friend’ on another line and requests that they join the call for a three-way conversation.
3. Interception of OTP Calls: Once the call is merged, the victim unknowingly connects with a genuine OTP verification call from their bank or financial institution.
4. Perfect Timing by Scammers: The scammers time this event so precisely that when the OTP is read out by an automated system or manually shared by the victim, they immediately capture it and use it to complete unauthorized transactions.
5. Financial Loss: When the OTP is entered, the fraudsters access the victim’s bank account, leading to monetary loss.

This scam preys on trust and quick decision-making, making it highly effective and dangerous.

Warnings Issued by UPI and NPCI

National Payments Corporation of India (NPCI) recently posted this warning on its official X (formerly Twitter) handle. While issuing the alert, caution was emphasized, and calls from unknown numbers should never be consolidated. NPCI had issued this notification:

“Scammers are using call mergers to make you disclose OTPs. Don’t be fooled! Be cautious and safeguard your money.”

With more digital transactions, fraudsters attempt to exploit security vulnerabilities, so users must exercise caution.

Recent Trends and Statistics on Digital Payment Frauds in India

Over a third of Indians have been victims of payment scams in real-time, as per a new survey. FICO, a global analytics company, in its report, pointed out the growing risk of payment fraud in the country:

• 60% of respondents reported receiving scam messages.
• 54% of people knew someone—either friends or family—who had been scammed.
• The number of consumers reporting financial losses in 2024 decreased slightly from 2023, but fraud losses exceeding Rs 8 lakh doubled from 2% to 4%.

Additionally, the Reserve Bank of India reported that online payment scams have grown alarmingly as cybercriminals target businesses and individual consumers. The growth in cases has caused authorities to bolster cybersecurity and inform people more about financial security.

How to Stay Safe from Call Merging Scams

UPI and cyber security experts have provided the following safety advice to help you avoid falling for this scam:

1. Never Merge Calls with Unknown Numbers: Do not merge calls from unknown numbers. Unless you know who is calling, never merge calls. If someone asks you to merge a call, politely decline and check their authenticity by other means.
2. Verify the Authenticity of the Caller: If an individual identifies him or herself as belonging to your bank, financial institution, or even a known contact, then call them back on an officially confirmed number rather than continuing the conversation.
3. Never Share OTPs Over Calls: Banks and other financial organizations will never request OTPs over the phone. If someone calls and asks for an OTP, end the call immediately and report the issue.
4. Enable Two-Factor Authentication (2FA): Adding two-factor authentication (2FA) to banking apps and UPI transactions adds another degree of protection, making it hard for scammers to conduct illegal transactions.
5. Report Suspicious OTP Requests Immediately: If you receive an OTP for a transaction you didn’t initiate, report it immediately by calling 1930 (Cyber Crime Helpline) or contacting your bank.
6. Stay Updated on New Scam Trends: Check regularly for updates from NPCI, RBI (Reserve Bank of India), and your bank regarding new fraud tactics and security measures.
7. Educate Family Members and Elderly Relatives: Older individuals are most at risk for financial fraud. Inform them of the most commonly used scam types and instruct them never to divulge confidential banking information via telephone.

Real-Life Examples of Call Merging Scams

1. The Businessman’s Loss:
   • A businessman from Mumbai received a call from someone claiming to be a bank official.
   • The fraudster convinced him to merge a call with a ‘senior representative’ to verify his account.
   • The victim unknowingly merged the call with an OTP verification call.
   • Within minutes, Rs 2.5 lakh was stolen from his bank account.
2. The Student’s Mistake:
   • A Bengaluru college student got a call informing them that they had won a scholarship and required their account details to be verified.
   • When they merged the call, they provided an OTP sent by their bank, assuming it was for verification.
   • In a matter of seconds, the scammers took out Rs 50,000 from their account.

What Authorities Are Doing to Combat This Scam

The Indian government, banks, and the police are attempting to curb this fraud. Some of the efforts made are:

• Increased Monitoring: Banks and payment providers bolstered anti-fraud mechanisms to flag real-time suspect transactions.
• Public Awareness Campaigns: The RBI and NPCI are conducting awareness campaigns to educate people about scams.
• Legal Actions: Police arrest and prosecute these cyber thieves under cybercrime laws.
• Technological Upgrades: Improved security features like biometric authentication of high-value transactions are incorporated to strengthen consumer protection.

Conclusion

With the advancements in technology, so do the ways used by cybercriminals. The call merge scam is an excellent example of how scammers use human psychology and confidence to obtain sensitive banking information. While regulators such as NPCI and RBI are trying to stem such frauds, it largely depends on people themselves to be vigilant and on their guard.

By following the above safety tips, verifying every request for an OTP, and staying informed about new scam tactics, we can all reduce the risk of financial fraud and protect our hard-earned money. For further assistance, users can visit the Cyber Crime portal or call the 1930 helpline to report fraud cases.