No OTP! How Delhi man lost Rs 50 lakh with just blank missed calls

New Delhi, Dec 13: A man who works as director of a security services based in south Delhi reportedly lost Rs 50 lakh to cyber fraudsters who stole the money by repeatedly making blank and missed calls to his cellphone. What's interesting here is that the scamsters did not even ask for any one-time password (OTP).

Going by the reports, the victim received a flurry of calls between 7pm and 8:45pm a few days ago. While no one was speaking on the other side, he picked up some and ignored others. However, after some time, when the victim checked his phone, he was shocked to see messages about RTGS (instant fund transfer) transactions worth nearly half a crore.

An FIR has been filed with the Delhi Police's IFSO unit and the initial initial investigations suggested that the fraud's planners might be based in Jharkhand's Jamtara region.

The reports also suggest the thieves may have performed a 'SIM swap'. They might have called in to start the RTGS transfer and activate the OTP. They might have heard the OTP mentioned in an adjacent call's IVR. "In this fraud, scammers also contact people's mobile phone carriers and trick them into activating a SIM card. Once this happens, they take control over the phone," The Times of India quoted an officer as saying.

What is SIM swap scam? SIM swap fraud occurs when scammers generally targets a weakness in two-factor authentication and two-step verification in which the second factor or step is a text message (SMS) or call placed to a mobile telephone.

What's the modus operandi? Scammers contact your mobile phone service provider and trick them into activating a SIM card that the fraudsters have. This mobile number portability feature is normally used when a phone is lost or stolen, or a customer is switching service to a new phone. Once this occurs, the scammers have control over your phone number. The scam begins with a fraudster gathering personal details about the victim, either by use of phishing emails, by buying them from organised criminals, or by directly socially engineering the victim.

How to protect yourself?

• Beware of phishing emails and other ways attackers may try to access your personal data.
• Avoid sharing personal information online.
• Use strong passwords and security questions.
• Don't build your security and identity authentication solely around your phone number.