Cybersecurity analysts and law enforcement experts have issued a stark warning regarding a rising cyber fraud tactic that allows scammers to gain remote control over victim phone numbers without executing a physical SIM swap. By tricking mobile users into dialing specific Unstructured Supplementary Service Data (USSD) code sequences—most notably code combinations starting with *21#—fraudsters silently enable call forwarding protocols. This mechanism diverts all incoming voice calls, including voice-based one-time passwords (OTPs) and multi-factor authentication checks, straight to attacker-controlled devices, effectively compromising bank accounts, messaging profiles, and personal digital identity portals.
Evolution from Physical SIM Swapping to Stealth Call Forwarding
In recent years, regulatory interventions and enhanced Know Your Customer (KYC) protocols enforced by telecom authorities made unauthorized physical SIM duplicate issuance significantly more difficult for criminal syndicates. In response, cybercriminals pivoted toward legacy network settings built directly into global mobile standards. USSD codes, which were originally engineered decades ago to permit mobile users to easily configure supplementary telecom services, allow immediate modification of call settings without requiring secondary passwords, identity verification, or carrier approval.
The modus operandi typically begins with a missed call followed by an urgent SMS or automated voice call impersonating courier services, utility providers, or banking representatives. The victim is informed that a package delivery is pending or an account service requires immediate verification, instructing them to dial a specific numeric sequence on their phone keypad. When a user dials the recommended code, such as *21# followed by a designated ten-digit phone number, the mobile carrier automatically redirects all incoming voice traffic. Because mobile phone numbers serve as the core anchor for financial transactions, social media account recoveries, and multi-factor authentication, intercepting voice calls gives attackers complete administrative leverage over the victim’s digital accounts.
Institutional Vulnerabilities and Legal Accountability Under DPDP Act
Cybersecurity specialists highlight that the root cause of targeted cyber fraud extends beyond individual user oversight to systemic vulnerabilities within corporate data repositories. Personal data leaks from private sector databases, customer service portals, and third-party vendors routinely expose citizens’ contact details, enabling fraudsters to craft highly convincing social engineering scripts. While major corporate entities invest heavily in public marketing campaigns, infrastructure audits frequently reveal lagging investments in robust data security architectures and end-to-end encryption standards.
The enforcement of India’s Digital Personal Data Protection (DPDP) Act marks a pivotal regulatory shift by establishing strict corporate accountability for data breaches. Under the statutory framework, regulatory bodies can impose heavy financial penalties ranging up to ₹100 crore to ₹200 crore per data breach instance on non-compliant data fiduciaries. By categorizing mobile phone numbers and associated metadata as critical Personally Identifiable Information (PII), the legislation obligates telecom operators and enterprise organizations to patch legacy security backdoors, enforce multi-factor administrative authentication, and actively protect customer records from unauthorized exposure.
Strategic Recommendations and Immediate Remedial Steps
To combat the rapid proliferation of USSD-based fraud schemes, cybersecurity experts advocate for a multi-pronged national response framework. Law enforcement agencies require specialized centralized research hubs to analyze emerging threat vectors in real time and rapidly disseminate standardized operating procedures across state police forces. Furthermore, given the pace at which technical exploit scripts evolve, training programs for investigative officers must transition from periodic annual sessions to continuous weekly technical updates. Widespread public awareness campaigns published in multiple regional languages are also essential to educate vulnerable demographics, such as senior citizens and young adults, regarding digital safety protocols.
For individual smartphone users, immediate preventative measures are vital to safeguard personal devices. Citizens are advised never to dial unknown numeric sequences containing special characters such as * or # upon the request of unverified callers. To verify whether unauthorized call forwarding has been activated on a mobile device, users can check their network settings through their mobile carrier or dial standard diagnostic commands. If unauthorized forwarding is detected, dialing ##002# immediately erases all active call forwarding configurations across all mobile networks, instantly severing any unauthorized redirection established by fraudsters.
