By Rajnish Singh
New Delhi [India], January 7 : Be alert, as a routine phone call or an innocent delivery update could quietly hand over control of your most sensitive digital information to a fraudster.
An alarming trend is being registered increasingly as the cybercriminals are exploiting the call forwarding feature on mobile phones to secretly reroute incoming calls and critical alerts, such as bank OTPs and authentication codes, to their own numbers.
The trend has prompted a warning from the Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs, which says scammers are turning a legitimate telecom function into a powerful tool for financial fraud and account takeovers.
By the time a victim realises something is wrong, verification calls from banks or security alerts from apps may already be reaching a criminal's phone, leaving the user locked out and vulnerable.
Authorities say the growing sophistication of such scams highlights the urgent need for greater public awareness about how everyday mobile features can be weaponised by cybercriminals.
In an official advisory, the National Cybercrime Threat Analytics Unit of I4C flagged a rising trend of USSD-based call forwarding scams. USSD (Unstructured Supplementary Service Data) codes are special sequences of numbers and symbols, such as "*" and "#", that allow users to access telecom services without an internet connection.
According to the advisory issued last month, fraudsters are impersonating delivery or courier service agents and contacting citizens on the pretext of confirming or rescheduling deliveries. Victims are then asked to dial USSD codes sent via SMS, typically starting with 21, followed by a mobile number controlled by the scammer.
Officials said dialling such codes automatically activates call forwarding on the victim's phone, resulting in incoming calls from banks, payment OTP verifications, and authentication messages from platforms like WhatsApp and Telegram being redirected to the fraudster.
"This can lead to unauthorised financial transactions and takeover of messaging accounts," said the officials.
The I4C has cautioned citizens not to dial or enter any USSD codes beginning with 21, 61, 67, or similar prefixes shared by unknown callers.
In case call forwarding has already been activated, users can immediately deactivate all forwarding services by dialling ##002#.
The advisory also urges people to avoid clicking on suspicious courier or delivery links received via SMS, WhatsApp, or email, and to verify delivery details directly through official courier websites or customer care helplines.
"Victims of such scams have been advised to report incidents immediately by calling the national cybercrime helpline 1930 or by lodging a complaint on www.cybercrime.gov.in," the officials suggest.