Numerous IT
employees fall victim to a new type of OTP theft currently on the rise in
Bengaluru. No culprit has been caught so far as lakhs of rupees go stolen via
the utilization of this technique.
This theft
stands diverse as contrasted with the rest as here, an individual calling
posing like a bank employee requests from the victim to provide with them their
card number and CVV so as to update or review their debit or credit card.
And the
'unsuspecting victim' does not realize that any person would at present need an
OTP to complete any exchange, in this way the scamster then says the victim
will get a SMS, which would need to be sent back to the sender.
And such
SMSes while not containing any intelligible content obviously, are in encoded
shape. Acting like links when the
victims tap on them, the incoming SMS is consequently sent to the scamster's
phone, which at that point completes the cash exchange — utilizing the OTP from
the victim's record.
“The thefts were
initially of relatively small amounts of ₹5,000-10,000. However, of late,
larger amounts ranging from ₹50,000 to up to a few lakhs have been stolen. We
have not been able to apprehend anyone yet. The victims also include several IT
employees,” says a cybercrime personnel further adding that such cases came to
light about 2-3 months ago.
“India as a
country has not taken privacy seriously. Most of the time, most hackers
are able to find out the bank you are banking with,” says Harsha Halvi, co-founder
of TBG Labs, “OTP theft is more a privacy matter than a technological one.
Perpetrators often gain the victim’s trust by dropping a name for reference,
which would make the victim trust them. After that finding information about
the victim’s bank is also quite easy,” he added later.
Although Halvi later recommends that since it is not
possible to build up a product\software as a safeguard against this as there
are many apps that request access to SMSes, the solution to this problem will
only begin to emerge if the users are increasingly mindful and don't offer
authorization to get to SMSes, at that point the developers will be compelled
to change their strategy.
In this way, it proposed to the users, when accepting such
calls, to check with the customer care numbers of their banks in order to
smoothly avoid from being entrapped in such wreckage.
