A Chennai IT employee allegedly lost ₹1.90 lakh after cyber fraudsters tricked him into entering a one-time password on a fake banking website while pretending to help him cancel a credit-card protection plan.
The victim, 36-year-old Subburaj, works at a private IT company in Guindy and stays at a men’s hostel in Jafferkhanpet.
According to police, he received a phone call from an unidentified person who claimed that a new protection plan had been activated on his credit card.
The caller told him that the plan could be cancelled online.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Fake Website Resembled Bank Portal
The caller allegedly directed Subburaj to a website that appeared similar to an ICICI Bank portal.
He was asked to enter an OTP to cancel the supposed protection plan.
Believing that the caller was genuine, Subburaj followed the instructions.
Shortly afterwards, he received an SMS saying that ₹1,90,097 had been debited from his account.
He then realised that he had been deceived.
The incident shows how fraudsters increasingly use fake banking websites that closely imitate legitimate portals.
Such websites may copy logos, colours, layouts and login screens to make victims believe they are dealing with the actual bank.
The fake page can then capture sensitive information entered by the victim.
How the Scam Worked
The fraud began with a simple fear trigger.
The caller allegedly told Subburaj that a credit-card protection plan had been activated without his consent.
That gave him an immediate reason to act.
The fraudster then presented cancellation as the solution.
Instead of asking directly for card information, the caller guided the victim towards a fake website and persuaded him to enter the OTP himself.
That technique can be effective because people are often aware that they should not verbally share OTPs with strangers.
But entering an OTP into a fraudulent webpage can be just as dangerous.
An OTP is generally used to approve a transaction or authenticate access.
If the victim enters it on a page controlled by fraudsters, the criminals may be able to use that code to complete an unauthorised transaction.
Credit Card Protection Scams Are Not New
Similar scams have appeared in other Indian cities.
Earlier this year, a software engineer in Pune allegedly lost nearly ₹4.8 lakh after a caller claimed that a credit-card protection plan was about to expire and would result in an automatic charge.
The victim was sent a cancellation link and later discovered that a large transaction had been made using his card details.
Such cases show that the “protection plan” claim is becoming a familiar social-engineering tactic.
Fraudsters may say a plan has been activated, is about to renew or will attract a fee unless immediately cancelled.
The purpose is to create urgency and convince the victim to follow instructions without independently checking with the bank.
Police Register Case in Chennai
Subburaj lodged a complaint with MGR Nagar Police after discovering the loss.
Police have registered a case and are trying to trace the fraudsters.
Investigators are expected to examine the phone number used to contact the victim, the fraudulent website, transaction records and the account or merchant destination to which the money was transferred.
It is not yet clear whether the website was created specifically for this fraud or used against multiple victims.
No arrest has been reported so far.
The case also highlights a basic rule for banking security.
Customers should never use websites or links sent by unsolicited callers claiming to represent banks.
Any request involving cancellation of a service, reward points, account protection or card activation should be verified independently through the bank’s official app, website or customer-care number.
Banks do not require customers to enter OTPs on unknown websites to cancel unsolicited services.
What this means for you:
Never enter an OTP on a website opened from a link or address given by an unsolicited caller. If someone claims that a bank service or protection plan has been activated, disconnect the call and verify it directly through the bank’s official channels.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
