OTP Phishing in Marketplace Deals — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 29, 2026

Severity: HIGH | View Full Scam Details

OTP Phishing in Online Marketplace Deals India 2026: How Sellers Lose Money on OLX and WhatsApp

Fraudsters are duping Indian sellers by stealing OTPs in fake buyer scams on popular marketplaces like OLX, causing major financial loss through UPI and KYC manipulation.

What Is the OTP Phishing in Marketplace Deals?

OTP phishing in marketplace deals is a rising cybercrime pattern targeting sellers on India’s most popular classified platforms like OLX. Scammers impersonate genuine buyers to gain a seller’s trust and then trick them into sharing their One-Time Password (OTP), a critical security code sent by banks or payment apps to validate financial transactions or identity verification. This OTP gives fraudsters temporary control that can lead to unauthorized money transfers or identity misuse.

This scam specifically targets Indian sellers who actively list items such as mobile phones, vehicles, or electronics, often engaging via WhatsApp or phone calls after receiving inquiries on the marketplace. In recent years, especially post-pandemic with a rise in online buying and selling, complaints about OTP phishing in such deals have grown. According to data from India’s Integrated Financial Crime Unit (I4C) and cybersecurity bodies like CERT-In, these scams are gaining ground by exploiting sellers’ eagerness to close sales quickly.

RBI has also issued warnings about phishing attempts involving UPI-based payments and warned users never to share OTPs or UPI PINs with others, even if asked by someone claiming to be a buyer or platform official.

How This Scam Works — Step by Step

Here is how scammers reportedly operate to phishing OTPs during marketplace deals:

1. Fake Buyer Initiates Contact: The scammer creates a bogus buyer profile or hijacks a real OLX account and messages the seller on the marketplace or outside on WhatsApp, showing interest in the item.

2. Building Trust: Claiming urgency or offering above-market prices, the caller convinces the seller to move the conversation off the platform and share phone or WhatsApp details.

3. Introducing an “OTP Request”: The scammer sends a message saying they will transfer a token amount or check KYC verification and asks the seller to share an OTP sent to their phone, claiming it’s necessary to confirm the transaction or “verify payment”.

4. Sharing the OTP: The seller, believing the OTP is safe to share because it is “just for verification,” provides the code.

5. Fraudulent Transaction: Using the OTP, the scammer either completes a fake UPI transaction that drains the seller’s bank account or hijacks their mobile SIM, linked Aadhaar, or payment app to commit further identity fraud.

6. Disappearing Act: Once done, the scammer blocks the seller and deletes messages, leaving the victim unable to reverse the transactions in most cases.

Because UPI payments are typically irreversible once processed, and because many victims do not know to report quickly, losses can range from a few thousand to several lakhs of Indian Rupees.

Real Warning Signs to Watch For

• Genuine buyers typically do not ask for OTPs or UPI PINs at any point.
• The buyer insists on moving the conversation to WhatsApp or direct phone calls immediately.
• Messages or calls create a false urgency like “You must share OTP now to avoid cancellation.”
• The buyer offers above-market prices or rushes the deal without proper negotiation.
• The supposed buyer requests multiple OTPs repeatedly for different “verification steps.”
• The buyer asks you to click suspicious links or share payment app details.
• You receive OTP SMS alerts during or soon after the conversation without initiating any payments yourself.

What Happens to Victims

The financial impact can be devastating: victims lose money directly from their linked bank accounts through unauthorized UPI transfers that are difficult to reverse. The scam can also lead to theft of sensitive personal data, such as Aadhaar or bank KYC details, putting victims at further risk of identity theft or SIM swap fraud. Such misuse can cascade into loan frauds, credit damage, or further financial crimes.

Emotionally, victims often feel violated and helpless. Many sellers do not immediately realize the scam and only discover the loss after checking their bank balance or getting charged by UPI apps. Recovery is complicated by lack of awareness, regulatory processes, and the fast-moving nature of digital payments.

What RBI and CERT-In Say

RBI has issued several advisories clarifying that OTPs and UPI PINs are strictly confidential and should never be shared, no matter who requests them, including fraudsters posing as buyers or officials. The regulator highlights that UPI transactions done with confidential information shared by customers are generally not reversible.

CERT-In emphasizes digital vigilance and urges the use of authentic apps from official sources as well as immediate reporting of suspicious transactions. It reminds citizens that the India 1930 Cybercrime Helpline is available for such complaints. The Ministry of Home Affairs’ Integrated Financial Crime Unit (I4C) also collaborates with law enforcement to track such frauds.

How to Protect Yourself

1. Never share OTPs or UPI PINs: No valid buyer or official will ask for these.
2. Keep marketplace conversations on official platforms like OLX messaging only.
3. Verify buyer profiles carefully, look for inconsistencies or newly created accounts.
4. Do not click on any payment links or download unofficial apps sent by buyers.
5. Set up two-factor authentication and transaction alerts for your bank and UPI apps.
6. Immediately report suspicious chats or calls to the marketplace customer support and cybercrime authorities.
7. Regularly check your bank and UPI transaction history for unrecognized activity.

What to Do If You’ve Been Targeted

• Call your bank and freeze your accounts or cards immediately to prevent further loss.
• Report the incident to the 1930 Cybercrime Helpline and file a complaint on cybercrime.gov.in.
• Inform the marketplace platform so they can block or investigate the fraudulent buyer’s profile.
• Notify your mobile service provider if you suspect SIM swap fraud and ask for account security measures.
• Keep all communication evidence such as chat screenshots, call logs, or SMS for investigations.
• Contact RBI’s helpline for specific guidance if your UPI transactions are affected.
• Consult with a legal advisor if you face identity theft or additional financial crimes.

Frequently Asked Questions

Q: Can sharing my OTP ever be safe during a marketplace transaction?
A: No, your OTP is a private code meant only for authenticating transactions initiated by you. Sharing it—even in marketplace deals—can allow fraudsters to access your bank account or digital wallet.

Q: What if the buyer says the OTP is needed for KYC or payment confirmation?
A: KYC and payment verification do not require you to share OTPs. Legitimate platforms perform these verifications internally. If asked, treat it as a red flag and stop communication.

Q: How quickly should I act if I suspect OTP phishing?
A: Act immediately. Contact your bank to block transactions, report on the 1930 helpline, and notify marketplace support. Fast action may help prevent further financial loss.

Stay alert: Verify any suspicious messages or calls at BharatSecure.app, and report fraud immediately at the 1930 cybercrime helpline to protect yourself and others.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.