A New Threat: The USSD Call Forwarding Scam
A sophisticated and highly dangerous form of cyber fraud has emerged, targeting unsuspecting individuals through a simple phone call. Scammers, posing as delivery agents, trick victims into dialing a short USSD code. The most alarming aspect is that victims often remain unaware of the breach for an extended period, allowing fraudsters to silently access their bank accounts and personal information. The Indian Cybercrime Coordination Centre (I4C) has recently issued a warning about this escalating trend.
Understanding the USSD Scam Mechanism
USSD, or Unstructured Supplementary Service Data, is a network-based text session service that functions without an internet connection. It is widely used for banking transactions, checking mobile balances, and accessing various telecom services. Critically, features like call forwarding are also controlled through these codes. When a user dials a specific code, the telecom network interprets it as an authorized command and activates call forwarding at the network level, often without explicitly informing the user that their calls are being redirected.
Who Are the Primary Targets?
Scammers primarily target frequent online shoppers. Receiving a call for address confirmation or an OTP around the time of a delivery is common, making it a perfect cover for their scheme. This familiarity is exploited to gain the victim’s trust and trick them into dialing the malicious code.
How the Fraud Unfolds
Imagine you are waiting for an online order. A call arrives from someone claiming to be a delivery agent. They politely explain that your number is not being verified in their system and ask you to dial a short code to resolve the issue. The moment you dial that code, you unknowingly grant a criminal complete control over your incoming calls. Unlike scams involving apps or links, this fraud operates at the network level, so your phone appears normal, but all your calls are secretly being forwarded to the scammer’s number.
Warning Signs to Watch For
Recognizing the indicators of this scam is crucial for protection. Be alert to the following red flags:
- Sudden Drop in Calls: If you stop receiving calls for an extended period, or if your number frequently shows as unreachable.
- Missing Verification Calls: Voice OTPs or verification calls from your bank or messaging apps cease to arrive.
- Unexpected Messages: A brief message like “Call Forwarding Active” flashes on your phone screen without you initiating it.
- Familiarity with Malicious Codes: Scammers often use specific USSD codes to set up the fraud.
Common USSD Codes Exploited by Scammers
Cybercriminals rely on standard call-forwarding codes. Being aware of these can help you identify a scam attempt:
- 21: Forwards all incoming calls unconditionally to another number.
- 401: Used for call diversion on some specific Indian networks.
- 61 or 67: Forwards calls when the line is busy or unanswered.
Essential Safety Measures: The L-B-W Rule
Experts recommend following the simple L-B-W rule to protect yourself and respond effectively if you suspect you have been targeted.
L: Law Enforcement
If you suspect fraud, immediately file a complaint. Contact the cybercrime helpline at 1930 to report the incident and seek guidance.
B: Bank
Notify your bank without delay if you notice any suspicious transactions or unauthorized access attempts. They can freeze your account and prevent further losses.
W: Wipe and Reset
If you believe your phone has been compromised, secure your important data, then perform a factory reset on the device. After the reset, change all your passwords, especially those for banking, email, and social media accounts.
