Police warn of rising OTP and eSIM scams targeting bank and social media accounts

The Maldives Police Service has urged the public to give special attention to a rise in scams in which fraudsters obtain one-time passwords (OTPs) and switch victims' numbers to eSIMs to compromise bank and social media accounts, as well as scams involving the creation of unauthorised digital wallets. The police said investigations covering the past month show that parties using deception and trickery are working to obtain OTPs and verification links through deceptive phone calls and text messages. One of the most commonly used methods now is to call the victim and deceive them by claiming that the mobile number they are currently using was previously used by the caller, then obtain a code and compromise the OTP channels of banks, digital wallets and social media accounts. More recently, the scammers are also obtaining verification codes sent to the phone by claiming they are calling from abroad and that the victim's previous email or social media accounts need to be recovered. The police said sharing such codes is more dangerous than merely losing a social media or email account, and that the parties committing the crime use the OTPs and verification links they obtain to carry out many more things. Accordingly, parties running unauthorised scams transfer the victim's mobile number to their own phone via eSIM. As a result, the person's phone line comes under the control of the criminals, who then receive all incoming calls and banking SMS alerts. The police also said that, using the compromised mobile number and personal information, unauthorised digital wallets are being created in the victim's name and unauthorised transactions carried out. Using the information obtained quickly, bank accounts are accessed without authorisation, money is transferred out of those accounts, and large financial losses are caused. To avoid becoming a victim of such crimes and to keep personal information and money safe, the police have requested that an OTP, PIN or verification link not be shared with any party — even if the person contacting you says they previously used your number, claims to be a friend, or says they are calling from a bank or telecom company. The police also requested that no attention be given to requests from unknown numbers claiming an account recovery code is needed and presenting it as an emergency, noting that in the official stages of recovering an account it will never be necessary to contact a party who currently holds a phone number that was previously used. The police advised that if the network signal on a physical SIM card is suddenly lost for no reason, the telecommunications provider should be contacted immediately without delay, as this may be a sign that the eSIM has been switched without permission. The police requested that suspicious phone calls or messages, or suspicions that another party has accessed an account, be reported immediately to the National Emergency Centre's number 911, and that the relevant bank be contacted to freeze accounts and the relevant social media platform's support or the Maldives Police Service's Cyber Crime Centre be sought to recover social media accounts. The police also said that increasing public awareness and sharing this information with more parties is very important in stopping such financial deception and trickery carried out over the internet.