A Special Investigation Team (SIT) probing the alleged voter deletion case in Karnataka's Aland constituency has uncovered an international operation involving a US-based website that provided One Time Passwords (OTPs) through virtual SIM cards to bypass Election Commission security systems.
How the International OTP Scam Operated
The investigation revealed that SMSAlert, a Delaware-registered website, harvested OTPs using virtual SIMs for 72 randomly selected but genuine Indian phone numbers. These OTPs were then channeled through OTPbazaar.com, operated by 27-year-old Bapi Adya from West Bengal's Nadia district.
Adya was arrested on November 13 from the Ghuguragachhi-Hanskhali region, marking the first arrest in this high-profile case that involves attempts to delete names of 5,994 voters from the Aland Assembly constituency electoral rolls between December 2022 and February 2023.
The Money Trail and Technical Operation
According to SIT sources, the Kalaburagi data centre operator paid ₹700 for every OTP provided by OTPbazaar.com. The money trail shows that Adya converted these payments received in his Indusind Bank account into cryptocurrency before making payments to SMSAlert, retaining a small commission for himself.
The technical operation involved an Application Programming Interface (API) that connected OTPbazaar.com with SMSAlert, enabling real-time transmission of OTPs generated for Election Commission sites to the data centre in Kalaburagi. This system allegedly initiated multiple voter deletion requests during the summary revision of voter lists in Karnataka.
An SIT official explained: "It was not hacking of EC online services but a subversion of the telecom system by creating virtual SIMs for actual numbers. The OTPs were sent to both the original holder of the phone number and the virtual SIMs created by SMSAlert. The original owners did not know why they received the EC OTPs."
Political Connections and Investigation Progress
The SIT probe has found that BJP leaders hired the services of the Kalaburagi data centre, whose operators subsequently discovered the online service offered by OTPBazaar. The data centre operators, identified as Md Akram, Ashfaq and three others, received ₹80 for every illegal voter deletion request placed with the Election Commission.
The case gained national attention after Congress leader Rahul Gandhi raised the "vote chori" allegations in September. Following his press conference on September 18, the SIT was established two days later, replacing earlier investigations by Kalaburagi police that had shown limited progress.
In a significant development, the SIT will send a formal request to US authorities under the Mutual Legal Assistance Treaty seeking information about the SMSAlert website. The investigation has revealed that the 72 phone numbers misused in the scam belonged to individuals across 17 Indian states, all unaware that their numbers were being used to access EC services.
The Aland illegal vote deletions case was initially registered in February 2023, just before the Assembly elections when the BJP governed the state. In response to this security breach, the Election Commission has since introduced an Aadhaar-enabled OTP authentication system for accessing its online services, replacing the previous system that relied solely on phone number-based OTPs.
