Imagine you receive a text message saying your electricity will be cut off tonight because of an unpaid bill. Or perhaps you get a call from a “courier boy” asking for a small ₹5 payment to redeliver a parcel. You panic, click a link, enter an OTP, and within seconds, your bank account is empty.
This is the reality for thousands of Indians every day. One-Time Passwords (OTPs) were designed to keep our money safe, but scammers have found clever ways to steal them. In late 2025 and early 2026, these frauds have evolved beyond simple fake calls. They now involve sophisticated tricks like “Call Merging,” screen-sharing apps, and psychological fear tactics like “Digital Arrest.”
Here is a complete breakdown of how OTP fraud happens in India today, the new methods criminals are using, and how you can stay safe.
The Mechanics: How Scammers Steal Your OTP
Fraudsters rarely hack bank servers directly. Instead, they “hack” the human mind. They create urgent situations that force you to act fast without thinking.
1. The “Call Merge” Scam (New Trend)
This is one of the most dangerous trends seen in 2025-26.
- The Setup: You get a call from a scammer posing as a bank official or a friend.
- The Trick: While talking to you, they trigger a transaction (like a password reset or money transfer) on their end. This sends an OTP to your phone.
- The Trap: They ask you to “merge” another call (which they claim is a verification bot or a senior official).
- The Result: Once you merge the call, the scammer can silently listen to the OTP being read out by the automated voice on the other line. You don’t even have to speak the code; they hear it directly.
2. Remote Access Apps (Screen Sharing)
Scammers often trick users into downloading legitimate apps like AnyDesk, TeamViewer, or RustDesk.
- The Lie: They claim they need to fix a problem on your phone, update your KYC, or help you claim a refund.
- The Theft: Once you install the app and share the 9-digit code, they can see your mobile screen remotely. When the OTP pops up on your screen, they read it instantly and steal your money.
3. The “Digital Arrest” and Fear Tactics
A rapidly growing scam involves fraudsters posing as officers from the CBI, Mumbai Police, or Customs. They claim a parcel addressed to you contains illegal items (like drugs) or that your Aadhaar is linked to money laundering.
- The Pressure: They conduct a “video interrogation” (using a fake police station backdrop) and demand you transfer money or share OTPs to “verify” your finances.
- Why it works: The fear of arrest makes people comply immediately.
Recent Case Study: The “₹5 Delivery” Trap
In a recent case reported in Hyderabad (early 2026), a victim lost over ₹2 lakhs while trying to pay a simple ₹25 fee.
- The Scenario: The victim was expecting a package. They received an SMS claiming the delivery failed and asked for a small redelivery fee.
- The Mistake: The victim clicked the link and entered their card details. The site looked exactly like a reputed courier company.
- The Loss: The OTP they entered authorized a transaction for ₹2 lakhs, not ₹25. Scammers use scripts to hide the actual amount on the fake webpage.
Why This Matters for India
India is adopting digital payments faster than any other country. With the rise of UPI and net banking, the “attack surface” for criminals has grown.
- Loss of Trust: Frequent scams make people afraid to use useful digital tools.
- Financial Impact: According to recent cybercrime data, Indians lost crores to financial fraud in the last fiscal year alone.
- Sophistication: Scammers are now using AI voice cloning to sound like your family members, making it even harder to spot a lie.
Official Updates & Government Action
The Reserve Bank of India (RBI) and the Department of Telecommunications (DoT) have introduced new measures to fight this:
- Sanchar Saathi Portal: The government has launched this portal where you can check how many SIM cards are registered in your name and block unknown ones.
- 160 Series Numbers: To help you identify real calls, legitimate businesses and banks are being migrated to numbers starting with 160. If you get a “bank” call from a personal mobile number (+91-9xxxx…), it is likely a fraud.
- Proposed 24-Hour Cooling Period: For some high-value transactions or new beneficiaries, banks are introducing delays to give you time to react if you suspect fraud.
What to Do If You Are Cheated
Time is money. If you share an OTP and realize it’s a scam, act within minutes:
- Call 1930 Immediately: This is the National Cyber Crime Helpline. Reporting within the “Golden Hour” (first hour) increases the chances of freezing the money before it leaves the banking system.
- Block Your Accounts: Call your bank’s official helpline or use your banking app to block debit/credit cards and freeze UPI access.
- File an FIR: Visit cybercrime.gov.in to register a formal complaint.
Read More : February 2026 Tech News
FAQ: Common Questions on OTP Fraud
Q: Can a scammer withdraw money if I only share my bank account number?
A: No. Just having an account number is usually not enough to withdraw money. They need your PIN, password, or OTP to complete a transaction.
Q: Is it safe to share an OTP with a bank employee?
A: Never. A real bank employee will NEVER ask for your OTP, PIN, or password over the phone, email, or SMS. If someone asks, it is 100% a scam.
Q: What is a “fake customer care” scam?
A: Scammers edit Google Maps listings to replace the phone numbers of shops, banks, or courier services with their own. When you search “Bank customer care number” and call, you are actually talking to a scammer who will ask for an OTP.
Q: How do I know if a link is fake?
A: Look at the URL carefully. A fake link might look like sbi-kyc-update.com instead of the official onlinesbi.sbi. Also, banks never send links via SMS asking you to update KYC.
