The latest in the ever-evolving 'scam-scape' is the call merging scam, a simple yet crafty phishing method that baits unsuspecting phone users and reels in sensitive information.
From convincing calls posing as familiar contacts to seemingly innocent messages offering rewards, these scams prey on trust and momentary lapses in caution. As cybercriminals become more inventive, it’s essential for users to stay alert and adopt preventive measures to safeguard their personal and financial information.
Cybercriminals are constantly evolving their tactics, and one of the latest scams is particularly crafty. The scam begins with a call from a fraudster who pretends to be a friend or acquaintance, claiming they got the victim's contact details through a mutual connection. The scammer then asks the victim to merge the call with someone else, creating the illusion of a legitimate conversation.
Unaware of the trap, the victim agrees, unknowingly linking the call to an OTP verification process from their bank. The scammer has timed everything perfectly, waiting until the victim receives the OTP.
Assuming it's part of the ongoing call, the victim shares the OTP, only for the fraudster to use it to authorise unauthorised transactions, draining their bank account.
In some cases, scammers may take it a step further. They could pose as media professionals, inviting the victim to cover an event. During the conversation, the victim receives another call from an unknown number.
The scammer claims the second call is from a VIP and convinces the victim to merge the calls. Once merged, the fraudster listens in, capturing OTPs from banking apps or social platforms like WhatsApp and Facebook, which they use to steal money or hack accounts.
The simplicity and deception behind this scam make it especially dangerous. Once the victim shares the OTP, the transaction is completed, and the money is gone, leaving them stunned and helpless. This serves as a stark reminder to be cautious when dealing with unknown numbers and seemingly innocent requests.
In another scam, fraudsters gather personal details from various sources where individuals have shared their phone numbers. Using this information, they send messages claiming the recipient has made a recent purchase. If the recipient clicks on the provided link, their money is instantly stolen.
According to NDTV, in one such incident, a 26-year-old woman from New Delhi, who recently bought an HP laptop from Croma, received such a message a few days later. The message claimed she had won a voucher and asked her to provide personal and banking details to claim it. However, she noticed an inconsistency – the message mentioned both Croma and Vijay Sales, stating the voucher was for a purchase made at Vijay Sales. This error raised her suspicions and helped her avoid falling victim to the scam.
How do these scams work?
The National Payments Corporation of India (NPCI) has issued a warning about the emerging call merging scam. Fraudsters are exploiting the call merge feature on phones to steal one-time passwords (OTPs) and commit financial fraud. In a post on the microblogging platform X (formerly Twitter), NPCI cautioned: “Scammers are using call merging to trick you into revealing OTPs. Don’t fall for it! Stay alert and protect your money.”
How to protect yourself from such scams:
To help you stay safe, NPCI has shared several important precautions
Avoid merging calls with unknown numbers, particularly if someone insists on doing so from an unfamiliar source.
Always verify the identity of anyone claiming to be from your bank. If in doubt, confirm their details before sharing any information.
Remember, banks will never ask for your OTP over the phone. If someone requests it, it's likely a scam.
If you receive an OTP for a transaction you didn't initiate, report it immediately by calling 1930 (the national cybercrime helpline) and contact your bank.
Additionally, consider these extra precautions:
Be cautious of unsolicited calls and messages.
Never share personal or sensitive information with unknown contacts.
Avoid clicking on suspicious links, even if they promise vouchers, discounts, or cash rewards.
Do not install apps from untrusted sources, as they may allow scammers to access your device’s camera and photo gallery, which could be used for KYC verification.
If you receive a suspicious call, always verify the sender's identity through official channels before taking any further action.
Along with phishing links, fraudsters are employing advanced techniques like call merging, call forwarding, voicemail scams, QR code fraud, and screen sharing scams.
APK and RAT Malware Scams
Another growing threat involves the use of Android Application Package (APK) files and Remote Access Trojans (RATs). Such tools allow hackers to remotely control a victim's device without their knowledge.
For example, on May 21, a Deputy Superintendent of Police (DySP) from the Hassan sub-division fell victim to such a scam, losing Rs 15.98 lakh. He had installed an application sent via a text message, which appeared to be from a nationalised bank. The link contained an APK or RAT file, granting hackers full access to his device, resulting in significant financial loss.
As technology continues to evolve, so do the tactics employed by cybercriminals to deceive and defraud individuals. Whether through call merging scams, phishing links, or malware attacks, these criminals exploit trust and manipulate unsuspecting victims.
By staying vigilant, verifying the identity of callers, and avoiding suspicious links or requests, we can significantly reduce the risk of falling victim to such scams. It’s essential to keep our personal information secure and act quickly if we suspect any fraudulent activity. With awareness and caution, we can protect ourselves and our finances from these ever-evolving threats.
