Follow us on Google News
Haridwar: Cyber fraudsters are increasingly targeting unused credit cards kept safely at home, moving beyond active bank accounts and regularly used cards. In a recent case reported from the Kankhal area of Haridwar district in Uttarakhand, a resident was defrauded of Rs 4.89 lakh through online transactions on a credit card he had never used. The fraud occurred after the victim received a WhatsApp message regarding an increase in his credit limit, raising serious concerns among cardholders who assume an unused card stored at home is completely safe.
Unlike conventional cyber scams where fraudsters impersonate bank officials over phone calls to extract one-time passwords (OTPs) or CVV numbers, this incident involved unauthorized transactions without direct interaction to obtain an OTP. Because the victim had never used the card for any purchase or payment, investigators are examining how the card details were compromised and through which payment channels the funds were siphoned off.
Fraud Follows WhatsApp Credit Limit Message
According to the victim, the trouble began after receiving a message on WhatsApp offering a credit limit enhancement. Shortly afterward, multiple online transactions were executed on the card, resulting in a total loss of Rs 4.89 lakh. The victim maintained that the physical card remained untouched at home and had never been used for any transaction, raising questions about how sensitive credentials leaked and how payments were processed without active participation from the cardholder.
A similar incident was reported a few days earlier in the BHEL area of Haridwar. The recurrence of such cases indicates that cybercriminals are adopting newer methods to access credit card data and execute transactions without direct contact with victims.
Why OTP Is Not Always Required for Online Payments
Cybersecurity experts note that not every online credit card transaction requires OTP authentication. Certain international payments, select merchant transactions, saved card setups, tokenization systems, and auto-debit arrangements can process payments without prompting for an OTP each time. Consequently, if fraudsters gain access to a card’s number, expiry date, and CVV, they can attempt payments under specific conditions without needing an OTP from the cardholder.
Phishing websites, deceptive bank messages, fake customer care numbers, and suspicious links circulated on WhatsApp remain primary tools for harvesting card details. Scammers frequently replicate official bank language and logos to make messages appear genuine, using pretexts such as credit limit upgrades, card block warnings, KYC updates, or expiring reward points to trick users into opening malicious links.
Preventive Measures and Police Advisory
Specialists advise cardholders who do not actively use their credit cards to disable online and international transaction features through their bank’s official mobile application or internet banking portal. Users are also urged to set transaction limits according to actual needs, keep SMS and mobile alerts active for every transaction, and refrain from saving card details on unfamiliar apps or websites or entering credentials through links received via WhatsApp or SMS.
Haridwar’s Senior Superintendent of Police has appealed to citizens to remain vigilant, stressing that banks and authorized officials never seek CVV numbers, OTPs, or confidential details over phone calls or WhatsApp. In the event of any unauthorized transaction, victims should immediately contact their bank to block the card and report the incident on the national cybercrime helpline 1930 or the National Cyber Crime Reporting Portal, as prompt reporting improves the chances of freezing defrauded funds before they are withdrawn.
