'OTP farming' racket sells Indian SIM cards and WhatsApp accounts to overseas cyber gangs

An OTP is considered the last line of defence for a person's digital identity. But in a new form of cyber crime, verification codes are being generated in bulk, packaged and sold to criminal gangs thousands of kilometres away. The practice is called "OTP farming". Indian mobile numbers have become a commodity sold to international cyber criminals.

In simple terms, several SIM cards are obtained, verification codes are generated to open accounts on messaging platforms, and those codes, or the activated accounts, are supplied to other operators. The accounts can then be used to contact unsuspecting people, imitate legitimate businesses, and carry out investment and other online frauds. Indian SIM cards are alleged to be activated and used for cyber gangs based in Southeast Asian countries.

In the usual OTP fraud, people are tricked into revealing bank or account verification codes. OTP farming is different. Here, operators systematically generate codes for accounts they open themselves. Stealing someone's existing digital identity is not necessarily the main point; the business lies in making hundreds of new accounts available for use.

Meanwhile, the Department of Telecommunications (DoT) will enforce mandatory SIM-binding rules for messaging and communication apps from January 1, 2027. Platforms must comply by December 31, 2026. A KYC-verified SIM or eSIM linked to the account must remain active in the primary device. If the registered SIM is removed, replaced or deactivated, the messaging app may be temporarily disabled until the SIM is reinserted and verified afresh. Web and desktop versions, including WhatsApp Web and Telegram Web, will be logged out automatically every six hours, and reconnecting will require scanning a QR code with the primary SIM-bound phone.

The practice is not new. In July 2020, a SIM card seller in Uttar Pradesh was arrested. Police allegedly found that he had fraudulently obtained hundreds of SIM cards using customers' Aadhaar-linked thumbprints. He was alleged to be selling OTPs in bulk, taking SIM cards in their names to open fake WhatsApp accounts. Police also found that the accounts were used for bulk messaging and promotion. "The case showed how a business can be built if mobile numbers and verification codes are easily available," an officer said. The pattern has since changed. Instead of supplying individual OTPs, ready-made accounts, and sometimes devices loaded with many accounts, are now being given to overseas operators.

In a case in Mumbai in September 2026, three people were arrested. In the alleged OTP-farming racket, 669 active SIM cards and 100 mobile handsets were found. Police suspected the codes generated were being supplied to handlers in Cambodia. In Jodhpur, Rajasthan, police in 2026 arrested six people allegedly linked to a Cambodia-based cyber-fraud network; the case involved thousands of Indian SIM cards. Another Mumbai investigation found that Indian numbers were allegedly active on international roaming in several countries, including Thailand, Myanmar and Laos.

In May 2026, Mumbai cyber police arrested four people from Tripura in a case of alleged cloning of WhatsApp accounts for cyber crimes abroad. Forty WhatsApp accounts were allegedly cloned using SIM cards registered in the names of unsuspecting Indian citizens. The devices were then sent to Cambodia, where police suspected they would be used for fraud. The investigation began with a Rs 33.5 lakh "digital arrest" fraud on a Mumbai designer. Tracing the money and contacts, the investigating team reached the alleged account suppliers in Tripura. Police also seized 360 SIM cards and other material. "This case showed another side of the business: instead of only selling verification codes, devices with many active accounts are prepared and can be taken abroad for fraud networks, it is alleged," the officer added.

Cambodia, Laos and Myanmar have become major hubs of organised cyber crime such as investment, cryptocurrency and romance fraud. A report by the United Nations Office on Drugs and Crime (UNODC) documents how criminal gangs in Southeast Asia use cyber fraud, underground banking and money laundering. The employment of people from other countries in such scam compounds is growing. An officer involved in a Mumbai cyber crime investigation linked to human trafficking said: "Indians were taken to Southeast Asia lured by well-paid jobs in IT, customer service and digital marketing. Some were allegedly trafficked, held in guarded compounds and forced to carry out online fraud."

Describing how it all works, a senior cyber police officer said: "It starts with obtaining SIM cards through middlemen, sellers or other routes; sometimes the identity documents of unsuspecting people are used. These numbers are activated so that verification messages can be received." Several simple handsets can be used to keep the SIM cards active. When a number is entered on a messaging platform, the OTP that arrives on that phone is forwarded to the buyer. Suppliers can sell individual OTPs or, at times, hand over ready-made accounts loaded on separate devices. Buyers abroad can contact potential victims through these accounts without coming to India. Investigations have found that Telegram and Signal are used to coordinate between suppliers and buyers, and that payments are sometimes made in cryptocurrency, making transactions hard to trace. Local people trust unknown WhatsApp messages from Indian numbers, so fraudsters abroad can pass themselves off as familiar or legitimate contacts.