Account Takeover via Call-Merging OTP Scam

How Account Takeover via Call-Merging OTP Scam Works

Overview: The call-merging OTP scam is a rising threat to Indian digital banking users. Scammers trick people into merging phone calls under various pretexts—such as "urgent bank verification" or pretending to be a trusted contact—leading to unauthorized account access. Once the fraudster gains access, funds can be siphoned instantly via UPI or IMPS. This scam targets everyday Indians, especially those using mobile banking or not fully aware of the pitfalls of call merging, and it is particularly dangerous as transactions are almost always viewed as authorized by the banks due to correct OTP entry. How It Works: 1. Scammer calls the victim, presenting themselves as a bank official, friend, or technical support. 2. They request the victim to merge the call with a bank's legitimate IVR number—often under the guise of "verifying account activity" or "resolving a complaint." 3. The scammer, already in possession of basic account details, times the merge to overhear the OTP spoken by the IVR or the victim. 4. With the OTP, the fraudster immediately logs into the victim's bank account and transfers funds to mule accounts. 5. By the time the victim realizes the loss, the funds are usually unrecoverable. India Angle: Indian digital payment growth, and widespread call-based support channels, have enabled scammers to customize this attack for UPI and mobile banking customers. It is seen in metros like Mumbai, Delhi, and Bengaluru, but also spreads to Tier 2 cities as digital adoption grows. Both young adults and retired users are being targeted, especially those new to advanced smartphone features like call merging. WhatsApp and regular mobile networks are the main channels. Real Examples: - "Hello Ma'am, I am from your bank's fraud prevention team. We're detecting unusual activity. Please merge me into your call with the bank helpline to resolve this issue instantly. It's for your security." - "Your account is at risk. Merge our call with your bank's IVR right now so I can guide you to block suspicious transactions." Red Flags: - Requests to merge calls with an unknown number or "bank official" - Sudden urgency to "resolve account issues" by phone - Calls from unofficial numbers, especially mobile numbers with local or out-of-state codes - Bank officials requesting security codes, OTPs, or merging with their lines Protective Measures: - Never merge phone calls unless you are 100% certain of the other party's identity - Banks never ask to merge calls with their IVR or for live OTPs - Keep your OTPs confidential, never say them aloud on calls - Verify suspicious requests via the official bank customer care app or number If Victimised: - Immediately call the 1930 helpline to report the scam - File a complaint on cybercrime.gov.in - Alert your bank and request temporary freezing of your account - Change all online banking passwords and review recent transactions Related Scams: 1. Fraudster posing as customer care, guiding victims to install screen sharing apps to steal OTPs 2. Fake IVR lines capturing T-PINs or account info when victims believe they're speaking to real bank representatives 3. SIM-swap frauds where scammers hijack mobile numbers for OTP interception.

Visual Intelligence:

BharatSecure's AI has identified this as a used in scams targeting Indian users.

Who Does Account Takeover via Call-Merging OTP Scam Target?

General public across India

Red Flags — How to Identify Account Takeover via Call-Merging OTP Scam

• Unsolicited calls urging you to merge with another line
• Pressure to act immediately on "security" grounds
• Requests to share or say OTP on a call
• Bank "officials" contacting from mobile numbers

What To Do If You Encounter Account Takeover via Call-Merging OTP Scam

1. Do not click any links or share personal information
2. Block and report the sender immediately
3. Report at cybercrime.gov.in or call 1930
4. Inform your bank if financial details were shared

How to Report Account Takeover via Call-Merging OTP Scam in India

• Call 1930 — National Cyber Crime Helpline (24x7)
• File a complaint at cybercrime.gov.in
• Contact your bank immediately if money was lost
• Call RBI helpline: 14440 for banking fraud

Frequently Asked Questions

What is Account Takeover via Call-Merging OTP Scam?

Overview: The call-merging OTP scam is a rising threat to Indian digital banking users. Scammers trick people into merging phone calls under various pretexts—such as "urgent bank verification" or pretending to be a trusted contact—leading to unauthorized account access. Once the fraudster gains access, funds can be siphoned instantly via UPI or IMPS. This scam targets everyday Indians, especially those using mobile banking or not fully aware of the pitfalls of call merging, and it is particularl

How does Account Takeover via Call-Merging OTP Scam work?

Overview: The call-merging OTP scam is a rising threat to Indian digital banking users. Scammers trick people into merging phone calls under various pretexts—such as "urgent bank verification" or pretending to be a trusted contact—leading to unauthorized account access. Once the fraudster gains access, funds can be siphoned instantly via UPI or IMPS. This scam targets everyday Indians, especially

How to protect yourself from Account Takeover via Call-Merging OTP Scam?

Do not click any links or share personal information Block and report the sender immediately Report at cybercrime.gov.in or call 1930 Inform your bank if financial details were shared

How to report Account Takeover via Call-Merging OTP Scam in India?

Report to cybercrime.gov.in or call 1930 (National Cyber Crime Helpline). You can also contact your local police station's cyber cell.

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.