Call Merging Scam: NPCI Warns About New OTP Fraud—Stay Safe!

Digital banking has made financial transactions faster and more convenient, but it has also opened the door to new types of fraud. The latest threat to emerge is the call merging scam, a sophisticated trick that fraudsters are using to steal One-Time Passwords (OTPs) and access bank accounts. The National Payments Corporation of India (NPCI) has issued a warning about this scam, urging users to stay vigilant and protect their hard-earned money.

In a recent alert on social media platform X (formerly Twitter), NPCI stated, “Scammers are using call merging to trick you into revealing OTPs. Don’t fall for it! Stay alert and protect your money. 🚨💳 Share this post to spread awareness!”

Scammers are using call merging to trick you into revealing OTPs. Don’t fall for it! Stay alert and protect your money. 🚨💳 Share this post to spread awareness!​#UPI #CyberSecurity #FraudPrevention #StaySafe #OnlineFraudAwareness #SecurePayments pic.twitter.com/kZ3TmbyVag

— UPI (@UPI_NPCI) February 14, 2025

This scam is particularly concerning because it exploits a common phone feature and preys on trust. Here’s everything you need to know about the call merging scam, how it works, and how to protect yourself.

How the Call Merging Scam Works

The call merging scam is a multi-step process that relies on social engineering and the call merge feature available on most smartphones. Here’s how it unfolds:

Step 1: The Initial Contact

Scammers initiate a call, often pretending to be a friend, bank representative, or event organizer. They claim to have received the victim’s number from a mutual contact and engage in friendly conversation to build trust.

Step 2: The Fake Call Merge Request

During the call, the scammer requests to merge another caller into the conversation. They may claim it’s a mutual friend, a bank officer, or someone from customer support. However, the third person is actually another fraudster.

Step 3: OTP Theft in Real Time

While on the call, the fraudster triggers an OTP verification request on the victim’s phone—this could be for an unauthorized transaction or a banking password reset. Posing as a bank official or a trusted entity, they manipulate the victim into sharing the OTP, making it seem like part of a routine verification process.

Step 4: Money Gets Transferred

The moment the OTP is shared, the scammer swiftly completes the transaction, leading to financial loss. The victim only realizes what has happened when they check their bank statement or receive a deduction alert.

Why This Scam is Dangerous

The call merging scam is particularly dangerous because it exploits two key elements: trust and technology.

1. Trust: By claiming to have a mutual connection, scammers create a false sense of familiarity, making victims more likely to comply with their requests.
2. Technology: The call merge feature, which is commonly used in legitimate scenarios, is weaponized to deceive victims into thinking they are speaking with a trusted party.

This combination makes the scam highly effective, especially for those who are less tech-savvy or unfamiliar with such tactics.

How to Protect Yourself from Call Merging Scams

The NPCI has shared several practical tips to help users avoid falling victim to this scam:

1. Avoid Merging Calls with Unknown Numbers

If someone insists on merging a call, especially if they are unfamiliar, decline immediately.

2. Verify Caller Identity

If someone claims to be from your bank or a trusted organization, hang up and call the official customer service number to confirm their identity.

3. Never Share OTPs

Banks and legitimate organizations will never ask for OTPs over the phone. If someone requests your OTP, it’s a red flag.

4. Enable Transaction Alerts

Activate SMS and email alerts for all transactions. This will help you track any unauthorized activity in real-time and take immediate action.

5. Report Suspicious Activity

If you receive an OTP for a transaction you didn’t initiate, contact the national cybercrime helpline at 1930 and inform your bank immediately.

What to Do If You’ve Been Scammed

If you suspect you’ve fallen victim to the call merging scam, act quickly:

1. Contact Your Bank: Inform your bank about the unauthorized transaction and request them to freeze your account if necessary.
2. File a Complaint: Report the incident to the cybercrime helpline (1930) and file a formal complaint with your local police.
3. Monitor Your Accounts: Keep a close eye on your bank statements and credit reports for any unusual activity.

The Bigger Picture: Staying Vigilant in a Digital World

As digital transactions become more prevalent, so do the tactics used by fraudsters. The call merging scam is just one example of how criminals are adapting to new technologies. Staying informed and cautious is the best defense against such threats.

The NPCI’s warning serves as a timely reminder to always question unsolicited calls and requests, no matter how convincing they may seem. By spreading awareness and following basic safety measures, we can collectively reduce the risk of falling victim to these scams.

Final Thoughts

The call merging scam is a stark reminder of the importance of vigilance in today’s digital age. By understanding how these scams work and taking proactive steps to protect yourself, you can safeguard your hard-earned money and personal information. Share this information with your friends and family to help them stay safe too. Remember, when it comes to your finances, it’s always better to be safe than sorry.

FAQs About the Call Merging Scam

1. What is a call merging scam?
The call merging scam is a fraud where scammers trick victims into merging calls with a third party, often posing as a bank or trusted contact, to steal OTPs and commit financial fraud.

2. How do scammers steal OTPs in this scam?
Scammers manipulate victims into sharing OTPs by triggering a verification call during the merged conversation and posing as bank officials or trusted entities.

3. What should I do if I receive a suspicious call?
If someone asks to merge a call or requests your OTP, hang up immediately. Verify the caller’s identity by contacting the official customer support number of the organization they claim to represent.

4. Can banks ask for OTPs over the phone?
No, banks and legitimate organizations never ask for OTPs, PINs, or passwords over the phone. If someone does, it’s a scam.

5. How can I report a call merging scam?
If you suspect fraud, call the national cybercrime helpline at 1930 or report it via cybercrime.gov.in. Also, inform your bank immediately to prevent further losses.