Phone call asking for option selection - potential data harvesting — How to Identify & Stay Safe

Severity: MEDIUM | View Full Scam Details

Phone Call Asking for Option Selection Scam in India 2026: How to Stay Safe from Data Harvesting Phishing Attacks

Scammers in India are increasingly using automated phone calls that ask victims to select options, aiming to steal personal data through clever social engineering.

What Is the Phone Call Asking for Option Selection - Potential Data Harvesting?

This scam involves receiving an unexpected phone call that sounds like it's from a bank, government agency, or popular service like your UPI app or Aadhaar helpline. The caller uses an automated Interactive Voice Response (IVR) system asking you to pick options—such as pressing 1 for account info, 2 for Aadhaar update, or 3 to speak to an executive. Though it may sound harmless, the intent is to trick you into revealing personal information or verifying details the fraudsters can exploit later.

Typically, these calls target Indian mobile users across both urban and rural areas, exploiting the country’s widespread digital payments ecosystem, especially UPI transactions and Aadhaar-linked services. CERT-In (Indian Computer Emergency Response Team) and the Indian government’s I4C (Indian Cyber Crime Coordination Centre) have repeatedly warned about such phishing methods, highlighting the growing risk as criminals adapt to India’s massive digital transformation.

This scam’s medium severity rating (5/10) reflects its potential to harvest sensitive data like your phone number, Aadhaar-linked details, or bank-related info for further misuse. While it may not always lead to immediate financial loss, collected data can fuel future fraud, identity theft, or phishing attacks.

How This Scam Works — Step by Step

1. Randomized or Purchased Number Call: Scammers use software to generate or buy lists of Indian phone numbers. They start calling these numbers, sometimes late at night or early morning to catch victims unaware.

2. Automated IVR Setup: When you pick up, you hear a recorded message or an auto-generated voice claiming it's from your bank, UIDAI, RBI, or a popular telecom operator. The voice urges you to select options from a menu for “verification” or “account update.”

3. Social Engineering Questions: The IVR asks you to “confirm” your identity by pressing certain digits linked to your personal information, such as date of birth, last four digits of Aadhaar or PAN, or mobile number verification via SMS OTP.

4. Hidden Data Capture: By interacting and responding, you unknowingly allow the system to record your inputs, which are then harvested by scammers.

5. Follow-up Calls or Messages: After collecting your info, fraudsters may call back pretending to be bank officials or WhatsApp support, pushing you to share OTPs or login details.

6. Financial or Identity Theft: Using the data and OTPs obtained, scammers can initiate fraudulent UPI transactions, SIM swap frauds, or misuse Aadhaar details for services in your name.

Real Warning Signs to Watch For

• Unsolicited calls from unfamiliar numbers asking you to press options.
• Voices or messages claiming urgency like “your account will be blocked” or “your Aadhaar needs verification.”
• Requests to confirm sensitive details via keypad inputs or SMS OTPs.
• Official agencies or banks never request personal info through automated calls—this is often a red flag.
• Repeating the call or threatening consequences if you do not comply.
• Unusual accents or robotic voices, indicating an automated scam IVR system.
• Calls encouraging immediate action with little explanation or chance to verify authenticity.

What Happens to Victims

Victims may not lose money instantly but put themselves at grave risk of future fraud. Once scammers harvest your details, they can:

• Use your Aadhaar or PAN to open fake accounts or apply for loans.
• Manipulate your UPI-linked bank accounts through SIM swap or OTP theft.
• Sell your information on the dark web, leading to multiple identity theft attempts.
• Cause emotional distress through harassment calls or financial loss.

In India’s context, once your mobile SIM is compromised, reversing transactions via UPI becomes difficult because the attacker has your OTP and personal data. Victims often face long disputes, with little immediate recourse.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) reminds users that banks never call customers to ask for sensitive details like OTPs, PINs, or passwords. RBI’s official advisories urge users to verify calls independently by contacting customer service directly.

CERT-In and the Indian Cyber Crime Coordination Centre (I4C) advise citizens to be vigilant of phishing calls and report them immediately through official channels. The cybercrime.gov.in portal and the national helpline number 1930 are recommended for reporting such incidents.

CERT-In also publishes periodic alerts about rising trends in phishing scams, emphasizing that no government agency or legitimate business requests personal info via phone calls.

How to Protect Yourself

1. Never press keys or share personal info on unsolicited calls—even if the caller sounds official.
2. Hang up immediately if the call pressures you to act urgently or threatens penalties.
3. Verify suspicious calls by directly contacting your bank, UIDAI, or service provider using official phone numbers.
4. Do not share OTPs or PINs with anyone, even relatives or people claiming to be officials.
5. Register your number on the National Do Not Call Registry to reduce spam calls.
6. Install updates to your smartphone and use security apps flagged by CERT-In or RBI.
7. Report suspicious calls immediately on cybercrime.gov.in or by calling 1930.

What to Do If You’ve Been Targeted

• Immediately contact your bank and disable UPI or mobile banking apps until verified.
• Inform your telecom operator to check for potential SIM swap or suspicious activity.
• File a complaint at the nearest cybercrime police station or via the online portal at cybercrime.gov.in.
• Call the national cybercrime helpline at 1930 for guidance and support.
• Change all related passwords and enable two-factor authentication wherever possible.
• Monitor your bank statements and Aadhaar linked services vigilantly for unauthorized usage.

Frequently Asked Questions

Q: Can I trust calls that claim to be from UIDAI or the RBI?
A: No official Indian agency or bank asks you to divulge sensitive details like OTPs or Aadhaar numbers via phone calls. Always verify independently using official contact channels.

Q: What should I do if I accidentally pressed an option and entered details?
A: Immediately hang up, do not share any further information, and contact your bank and telecom provider to alert them. Report the incident to cybercrime.gov.in and change your passwords.

Q: Will I lose money immediately if I participate in this IVR scam?
A: Not always immediately. But your data may be harvested and used later for fraudulent transactions, identity theft, or SIM swap frauds which can cause financial loss.

Digital fraud keeps evolving, but knowledge is your best defense. Before responding to any suspicious call or message, verify its authenticity at BharatSecure.app — India’s trusted platform for fighting scams and protecting your digital life. Stay alert, stay secure!