New mobile scam lets hackers drain bank accounts without OTPs

Cybersecurity experts have warned of a new mobile phone scam that allows criminals to access bank accounts without requiring passwords or one-time passcodes (OTPs), 24NewsHD TV reported on Saturday.

In the latest scheme, fraudsters contact users while posing as bank officials, customer service agents or delivery personnel, and persuade them to dial specific codes on their phones under the pretext of resolving an issue.

Unlike earlier scams that relied on extracting sensitive information, the new method exploits built-in phone settings.

Victims are tricked into dialling codes such as *21# or *401#, which activate call forwarding features without their knowledge.

Once enabled, calls, messages and OTPs are silently redirected to another number, allowing hackers to gain access to banking services and potentially empty accounts within minutes.

Experts warn that messaging platforms and social media accounts, including WhatsApp, may also be compromised.

The fraud is particularly dangerous because it operates discreetly, often leaving users unaware until financial losses occur.

Security specialists advise users to regularly check their call forwarding settings by dialling codes such as *#62# or *#21# to verify whether calls are being diverted. If an unknown number appears, it should be removed immediately.

In suspected cases, users can disable all forwarding settings by dialling ##002#, a step experts say can help prevent further unauthorised access and potential financial damage.