A new financial scam is rapidly gaining traction across India, prompting the National Payments Corporation of India (NPCI) to issue an urgent warning. Dubbed the "call merging scam," fraudsters are exploiting a simple yet effective method to steal one-time passwords (OTPs) and siphon money from victims' bank accounts.
How the Call Merging Scam Works
Scammers have devised a way to bypass traditional security barriers, preying on unsuspecting victims through a technique that exploits the call merge feature on mobile phones. Here’s how it unfolds:
Unexpected Call: The victim receives a call from a stranger who claims to have their number from a mutual friend. The scammer may offer an exclusive event invitation or a lucrative opportunity to build trust.
Request to Merge Calls: The fraudster then claims that the supposed friend is calling from another number and asks the victim to merge the calls.
Linking to an OTP Call: In reality, the second call is not from a friend but an automated OTP verification call from the victim’s bank.
Unintentional OTP Sharing: With the call merged, the victim unknowingly shares the OTP, which the scammer quickly uses to complete fraudulent transactions.
Financial Loss: The moment the OTP is revealed, scammers finalise the transaction, leaving the victim’s bank account drained.
Why This Scam Is Dangerous
Unlike traditional phishing scams that rely on fake emails or websites, the call merging scam exploits a fundamental phone function. Many people do not suspect foul play and comply without realising they are giving criminals access to their bank accounts. The well-timed nature of the OTP request makes the scam highly effective, even against tech-savvy individuals.
How to Stay Safe?
Recognising the rapid rise of this scam, the NPCI issued a public alert on X (formerly Twitter).
To stay safe, the NPCI has shared key precautions:
Avoid merging calls with unknown numbers. If someone insists on merging a call, refuse and verify their identity separately.
Verify caller identity. If someone claims a friend is trying to reach you, contact the friend independently to confirm.
Banks never ask for OTPs over calls. If you receive an unexpected OTP request, do not share it.
Report suspicious activity. If you receive an OTP for a transaction you did not initiate, immediately call the cybercrime helpline at 1930 and inform your bank.
What to Do If You’ve Been Scammed
If you realise you have fallen victim to this scam, take immediate action:
Contact your bank to block unauthorised transactions.
Report the fraud to the cybercrime helpline (1930) or file a complaint at cybercrime.gov.in
Monitor your bank statements for any suspicious activity and change your online banking credentials.