A seemingly harmless phone call or a routine delivery update could be all it takes for scammers to gain access to a person’s most sensitive digital information, authorities have warned.
Cybercriminals are increasingly misusing the call forwarding feature on mobile phones to covertly divert incoming calls and critical alerts—such as banking OTPs and authentication codes—to numbers controlled by them. The tactic allows fraudsters to intercept verification calls and security messages without the victim’s knowledge.
The Indian Cyber Crime Coordination Centre (I4C), functioning under the Ministry of Home Affairs, has issued a warning highlighting how scammers are transforming a legitimate telecom feature into a potent tool for financial fraud and account takeovers.
By the time victims realise something is amiss, confirmation calls from banks or alerts from digital platforms may already be reaching the fraudster’s device, effectively locking users out of their own accounts and exposing them to financial losses.
Officials say the rise of such scams underlines the urgent need to raise public awareness about how common mobile phone functions can be exploited for criminal purposes.
In an official advisory, the National Cybercrime Threat Analytics Unit of I4C flagged a surge in USSD-based call forwarding fraud. USSD, or Unstructured Supplementary Service Data, refers to special codes made up of numbers and symbols such as “*” and “#” that enable access to telecom services without requiring an internet connection.
According to the advisory issued last month, scammers often pose as delivery or courier agents, contacting individuals under the pretext of confirming or rescheduling a parcel. Victims are then instructed to dial USSD codes received via SMS—typically beginning with “21” followed by a mobile number operated by the fraudster.
Authorities explained that dialling these codes automatically activates call forwarding on the victim’s phone. As a result, incoming calls from banks, OTP verification messages, and authentication alerts from platforms such as WhatsApp and Telegram are rerouted to the scammer.
“This can lead to unauthorised financial transactions and takeover of messaging accounts,” officials said.
The I4C has urged citizens not to dial or enter any USSD codes starting with prefixes such as 21, 61, 67, or similar sequences when shared by unknown callers.
If call forwarding has already been enabled unknowingly, users can deactivate all forwarding services immediately by dialling ##002#, the advisory noted.
People have also been advised to avoid clicking on suspicious courier or delivery links received via SMS, WhatsApp, or email, and to verify shipment details only through official courier websites or customer care helplines.
“Victims of such scams have been advised to report incidents immediately by calling the national cybercrime helpline 1930 or by lodging a complaint on www.cybercrime.gov.in,” officials said.
