Scam Alert: The Call Merge OTP Fraud That Emptied Bank Accounts of 40+ Doctors — NPCI Issues Urgent Warning

The National Payments Corporation of India (NPCI) has issued an urgent warning about a rapidly spreading fraud technique called the Call Merge OTP Scam. In one of the most alarming cases, over 40 doctors in Gurgaon fell victim to this scam after a single compromised WhatsApp account was used to target an entire professional network.

How the Call Merge Scam Works — Step by Step#

Step 1: The Friendly Call#

You receive a call from an unknown number. The caller sounds casual and friendly, claiming they got your number from a mutual friend. They invite you to a party, event, or gathering — creating a sense of normalcy so you don't suspect anything.

Step 2: The Merge Request#

While you're still on the call, the scammer says: "My friend is also calling — let me add them to this call. Can you merge the call?" Thinking it's harmless, you tap "Merge" on your phone.

Step 3: The OTP Theft#

Here's what actually happens: the "second call" is NOT from a friend. It's an automated call from your bank delivering an OTP for a transaction the scammer has already initiated. By merging the calls, you give the scammer live access to hear your OTP.

Step 4: Money Gone#

The scammer hears the OTP, enters it, and the transaction completes instantly. Your money is transferred before you even realize what happened. The scammer may even stay on the line chatting to keep you distracted.

Real Case: 40+ Doctors in Gurgaon#

In early 2025, attackers compromised one doctor's WhatsApp account using the call-merge technique. They then used that account to contact others in her professional network, posing as the doctor herself. Over 40 doctors fell victim in a chain reaction — each compromised account was used to target more contacts.

Why This Scam Is So Dangerous#

• No malware needed — It's pure social engineering
• Bypasses 2FA — The scammer hears the OTP in real-time
• Feels normal — Merging calls is a common, everyday phone action
• Chain reaction — One compromised account leads to dozens more
• Anyone can fall for it — Even educated professionals like doctors

How to Protect Yourself#

1. NEVER merge calls with unknown numbers — This is the #1 rule
2. If you receive an OTP you didn't request — Do NOT share it, hang up immediately
3. Banks NEVER send OTPs via phone calls for you to read aloud
4. Use spam detection apps — Truecaller, Google Phone, or Samsung Caller ID
5. Enable SIM lock — Prevent SIM-based attacks
6. Report immediately — Call 1930 (Cybercrime Helpline) if you suspect fraud

What NPCI Says#

"No legitimate institution will ever ask you to merge a call. If anyone requests a call merge, treat it as a red flag and disconnect immediately. Report such calls to 1930." — NPCI Advisory

Scale of the Problem#

• Ministry of Home Affairs: Indians lost nearly ₹7,000 crore to online scams in the first 5 months of 2025
• India is projected to lose ₹20,000 crore to cybercrimes in 2025-26
• SBI, HDFC, and ICICI have all issued separate warnings about this specific scam