Mumbai: What is OTP farming? Inside the underground trade supplying Indian numbers to cybercriminals

A onetime password OTP is meant to be the last line of defence protecting a persons digital identity But in an emerging cybercrime operation these verification codes are being generated in bulk packaged and sold to criminal networks thousands of kilometres away Welcome to the world of OTP farming mdash an underground trade that turns Indian mobile numbers into commodities for international cybercriminalsAt its simplest OTP farming involves procuring multiple SIM cards generating verification codes to register accounts on messaging platforms and supplying these codes or activated accounts to other operators These accounts can then be used to contact unsuspecting victims impersonate legitimate businesses and run investment and other online scamsIndian SIM cards allegedly activated and used by cybercrime networks operating in Southeast Asian countriesUnlike conventional OTP fraud in which victims are tricked into sharing banking or accountverification codes OTP farming involves systematically generating codes for accounts created by the operators themselves The business is not necessarily about stealing an existing digital identity but manufacturing access to hundreds of new onesNew SIMbinding rulesThe Department of Telecommunications DoT will enforce mandatory SIMbinding rules for messaging and communication apps from January 1 2027 Platforms must comply by December 31 2026gtgt Active SIM mandatory The KYCverified SIM or eSIM linked to an account must remain active in the primary devicegtgt Service linked to SIM Removing switching or deactivating the registered SIM may temporarily disable the messaging app until it is reinserted and reauthenticatedgtgt Web sessions to expire Web and desktop versions including WhatsApp Web and Telegram Web must automatically log out every six hoursgtgt Relinking required Users will have to scan a QR code using their primary SIMbound phone to reconnect web and desktop sessionsOTP farming mdash Cases that exposed the networkUttar Pradesh 2020 A SIMcard retailer was arrested for allegedly using customersrsquo biometric details to obtain additional SIM cards and selling OTPs in bulk to facilitate the creation of WhatsApp accountsMumbai September 2026 Three men were arrested in an alleged OTPfarming racket involving 669 active SIM cards and 100 mobile handsets Police suspected that the verification codes generated were being supplied to Cambodiabased handlersMumbai May 2026 Four men were arrested in an alleged WhatsApp accountcloning operation Police recovered hundreds of SIM cards and investigated links to overseas cybercriminals and devices allegedly being sent to CambodiaJodhpur 2026 Police arrested six people allegedly linked to a Cambodiabased cyberfraud network involving thousands of Indian SIM cardsMumbai 2026 Another investigation into SIMcard supply exposed Indian numbers allegedly operating on international roaming in countries including Thailand Myanmar and LaosFrom individual SIM cards to an organised tradegtgt While the term OTP farming has gained attention following recent police investigations the practice of generating and selling verification codes in bulk is not newgtgt In July 2020 a SIMcard retailer in Uttar Pradesh was arrested after police allegedly found that he had fraudulently obtained hundreds of SIM cards using customersrsquo Aadhaarlinked thumb impressions The retailer allegedly used additional biometric impressions to procure SIM cards in their names and sold the verification OTPs in bulk to facilitate the creation of fictitious WhatsApp accountsgtgt Police also found that the accounts were being used for bulk messaging and promotional activitiesgtgt ldquoThis case showed how simple access to mobile numbers and verification codes could be converted into a businessrdquo an official saidgtgt Over time the model appears to have evolved from supplying individual OTPs to providing overseas operators with readytouse accounts and in some cases devices loaded with multiple accountsThe trail from India to Southeast AsiaCambodia Laos and Myanmar have emerged as major hubs for organised cyberfraud operations including investment cryptocurrency and romance scamsA UN Office on Drugs and Crime report has documented how criminal networks in Southeast Asia use cyber fraud underground banking and money laundering Scam compounds increasingly recruit workers from other countriesldquoIndians have been lured to Southeast Asia with promises of lucrative jobs in IT customer service and digital marketing Some are allegedly trafficked into guarded compounds and forced to operate online scamsrdquo said an official involved in a Mumbai cybercrime investigation linked to human traffickingIndian numbers overseas operatorsRecent investigations have begun exposing how Indian mobile numbers and WhatsApp accounts are allegedly being supplied to international cybercrime networksIn May 2026 Mumbai cyber police arrested four men from Tripura in a case involving the alleged cloning of WhatsApp accounts for overseas cybercrime operations Police found that 40 WhatsApp accounts had allegedly been cloned using SIM cards registered in the names of unsuspecting Indian citizens The devices were subsequently sent to Cambodia where police suspected they would be used in scam operationsThe investigation began with a digitalarrest fraud in which a Mumbaibased designer was allegedly cheated of R335 lakh Following the money and communication trails investigators reached the alleged account suppliers in Tripura Police also recovered 360 SIM cards and other equipment ldquoThis case revealed another dimension of the trade instead of merely selling verification codes operators could allegedly prepare devices carrying multiple activated accounts and transport them overseas for use by scam networksrdquo the official addedHow does OTP farming workldquoThe operation begins with procuring SIM cards through intermediaries retailers or other sources sometimes using identity documents of unsuspecting individuals The numbers are activated to receive verification messagesrdquo a senior cyber police official told middayMultiple basic handsets may be used to keep the SIM cards active When a number is entered to register an account on a messaging platform the OTP received on the corresponding phone is relayed to the buyer seeking to activate it Suppliers may sell individual OTPs or provide readytouse accounts sometimes loaded onto separate devices Overseas buyers can then use these accounts to approach potential victims without being physically present in IndiaInvestigations have also pointed to Telegram and Signal being used to coordinate between suppliers and buyers with payments sometimes made through cryptocurrency making transactions harder to trace Indian numbers lend credibility to unsolicited WhatsApp messages targeting local users allowing overseas fraudsters to pose as familiar or legitimate contacts