Mumbai: The latest case of the alleged “courier scam” targeting prominent individuals has surfaced in Mumbai, where Brihanmumbai Municipal Corporation (BMC) Commissioner Ashwini Bhide’s WhatsApp account was taken over by fraudsters. The accused first contacted her under the pretext of delivering a parcel and then allegedly persuaded her to dial a specific code that redirected incoming calls from her mobile number to a number controlled by them. The call-forwarding facility was subsequently used to gain control of her WhatsApp account.
According to police, the same modus operandi has previously been used against Shiv Sena leader Shaina NC, Marathi actress Vanita Kharat, NCP leader Supriya Sule and BJP leader Sambit Patra. Investigators have previously linked similar operations to areas along the Jharkhand-Bihar border.
Algoritha Security Launches ‘Make in India’ Cyber Lab for Educational Institutions
Fake Parcel Call Followed by a Malicious Code
Bhide received a call on Saturday from a man who claimed that he had arrived to deliver a parcel to her. When she told him that she had not ordered any such parcel, the caller asked her to contact a mobile number he sent to her for further information. A message sent during the conversation contained “**21*”, followed by a mobile number and ending with “#”.
Police said the sequence was not related to any legitimate courier procedure. Instead, it was a telecommunications command that activated call forwarding from Bhide’s number to another mobile number. Once the process was completed, incoming calls to her number began reaching the fraudsters.
Call Forwarding Used to Take Over WhatsApp
After activating call forwarding, the accused attempted to register Bhide’s WhatsApp account on another phone using her mobile number. Instead of receiving the verification code through SMS, they selected the voice-call verification option.
Because incoming calls to Bhide’s number had already been redirected, the WhatsApp verification call also reached the fraudsters. This enabled them to gain control of the account.
Once inside the account, the accused accessed the contact list and conversations and began sending messages to people known to Bhide, asking them to transfer money. The activity was detected soon afterwards, allowing the call-forwarding facility to be disabled and the WhatsApp account to be restored. No FIR has been registered in the case so far.
Why Fraudsters Target Public Figures
Police said the scam exploits trust and the perceived authority of prominent individuals. When a message requesting money appears to come from a senior official, politician or well-known public figure, recipients may be less likely to question the request or independently verify it. Fraudsters exploit this familiarity to make the deception more convincing.
Similar attacks have also been carried out during weekends, when people may be away from their regular workplaces and less likely to immediately verify an unusual request through official channels.
Renowned cyber crime expert and former IPS officer Prof. Triveni Singh said such incidents demonstrate how social engineering can be combined with ordinary telecommunications features to compromise digital accounts. According to him, fraudsters do not necessarily need sophisticated malware when they can manipulate a victim into activating call forwarding. Once incoming calls are redirected, voice-based verification mechanisms can potentially be exploited to gain control of important digital accounts.
How the Scam Works
The case highlights that cyber fraud does not always require sophisticated hacking tools or malware. In many cases, social engineering is used to persuade victims to enter a telecommunications code that activates call forwarding. Fraudsters can then attempt to use redirected voice calls to intercept verification processes.
Cybersecurity experts advise users never to enter unfamiliar USSD or star-hash codes at the request of an unknown caller. If WhatsApp suddenly logs out, an unfamiliar device appears to have accessed the account, or phone calls begin reaching another number unexpectedly, users should immediately contact their telecom service provider and check whether call forwarding has been activated. They should also follow WhatsApp’s official account-recovery process to regain control.
The courier scam remains particularly dangerous because the fraud begins with an apparently routine problem, such as a parcel that the victim claims not to have ordered. The conversation is then manipulated to make the victim activate a telecommunications feature. Once control of incoming calls is obtained, the fraudsters can move to the next stage by targeting messaging accounts and the victim’s contacts.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
