One dialled code can send your OTPs to scammers

You ordered a package online and are eagerly awaiting its arrival. Suddenly, your phone rings. The caller identifies himself as a delivery executive standing near your location. He sounds polite and professional, but he claims there is a technical glitch - he cannot view your address or verify your location in his system. To fix this "minor" issue, he asks you to dial a specific code starting with 401 or 21 followed by a mobile number.

Trusting the process, you dial the number. The call disconnects, and you think nothing of it. However, you have just unknowingly handed over control of your phone line to a cybercriminal.

Understanding the Trap

This is known as the USSD call forwarding scam, a growing threat that security experts and the Indian Cybercrime Coordination Centre (I4C) are warning citizens about.

Fraudsters exploit a standard telecom feature called Unstructured Supplementary Service Data (USSD). Codes like *401# or *21# are legitimately used to activate call forwarding. When a scammer tricks you into dialling these codes followed by their phone number, your network provider immediately diverts all your incoming calls to the scammer.

Why is this dangerous?

Once call forwarding is active, the victim usually does not realize anything is wrong. Your phone network signal looks normal, but you stop receiving calls. Meanwhile, the scammer receives your incoming calls, including crucial One-Time Passwords (OTPs) for bank transactions, WhatsApp verification calls, and password resets.

With access to your OTPs, criminals can drain your bank account or hijack your social media profiles within minutes.

How to Stay Safe

Experts at CloudSEK and HDFC Bank suggest that awareness is your best defense. Since this scam relies on social engineering rather than hacking your device software, you can stop it by being vigilant.

Follow these safety steps immediately:

• Never dial codes: Do not dial combinations like 21 or 401 based on instructions from an unknown caller, even if they claim to be from a courier service or telecom operator.
• Verify the status: If you suspect foul play, dial ##002#. This is a universal code that cancels all active call forwarding on your number immediately.
• Check settings: regularly go to your phone’s call settings to ensure no unknown numbers are listed under the "Call Forwarding" section.

If you fall victim to such fraud in Odisha, report it immediately to the National Cyber Crime portal or dial 1930 for assistance.