If you are awaiting a parcel and get a call from a 'delivery agent' asking you to dial a short code to confirm details, be extremely cautious. This simple act could be handing over the keys to your digital life to criminals, according to a fresh alert issued by the Indian Cyber Crime Coordination Centre (I4C).
The USSD Call-Forwarding Trap: How It Works
The National Cybercrime Threat Analytics Unit (NCTAU) has reported a sharp increase in sophisticated scams exploiting Unstructured Supplementary Service Data (USSD) codes. These are the sequences of numbers, asterisks, and hashes (like *121#) used to check mobile balance or activate services without the internet. In this scam, fraudsters impersonate courier company staff.
They inform the victim of a minor issue with their package and instruct them to dial a specific code, typically starting with *21* followed by a ten-digit mobile number. The moment you press the call button, you are not confirming a delivery; you are unknowingly activating unconditional call forwarding on your number.
From that instant, all incoming calls to your number are silently diverted to the scammer's phone. This allows the criminal to intercept crucial one-time passwords (OTPs), bank verification calls, and authentication codes for apps like WhatsApp and Telegram, explained a senior official from the Gujarat CID's state cybercell.
The WhatsApp 'Rental' Scam: Selling Your Identity
Parallel to the USSD fraud, another disturbing trend is on the rise: the WhatsApp 'Rental' scam. Enticing advertisements on social media platforms like Facebook and Instagram lure users with promises of 'easy passive income.' The scheme involves simply linking one's WhatsApp account to an external platform via a QR code.
In reality, victims are renting out their accounts to become 'mule accounts.' Scammers then use these legitimate-looking profiles to launch phishing attacks or spread malicious content. For a mere 10% referral commission, users risk becoming legal accessories to transnational cybercrimes, the CID official warned.
Cybercrime units are also noting a persistent surge in frauds originating from matrimonial and dating platforms. Fake profiles, often posing as wealthy professionals working abroad, spend weeks building trust. Eventually, they present an urgent investment opportunity, usually involving cryptocurrency or a scheme promising abnormally high returns, the official added.
How to Protect Yourself and Recover
The advisory provides a crucial emergency measure. If you suspect you have fallen victim to the USSD call-forwarding scam, dial ##002# immediately. This code acts as a universal kill-switch, deactivating all call diversion services on your device instantly.
Authorities urge the public to remain vigilant and follow these guidelines:
- Never dial any USSD code (starting with * or #) suggested by an unsolicited caller, even if they claim to be from a reputable company.
- Verify any delivery-related issues directly through the courier firm's official website or customer care number.
- Avoid schemes that offer money for using your social media or messaging accounts. If it sounds too good to be true, it likely is.
- Be sceptical of online contacts who quickly move conversations to investment topics or request financial help.
The I4C's alert, sent to all state nodal bodies including Gujarat, underscores the evolving tactics of cybercriminals who exploit routine interactions to commit serious financial and identity fraud.
