OTP Farming Busted in Mumbai - A KYC Failure Before a Cyber Crime
Nayona Roy | Partner
Last week, the Western Region Cyber Police of the Mumbai Crime Branch arrested three people and seized 669 active SIM cards and 100 handsets in an OTP-farming syndicate. Reportedly, a senior citizen from Mumbai was robbed of ₹22.30 lakh in an online stockmarket investment scam after being lured via Telegram and WhatsApp in a malicious ecosystem set up by the trio. Police have informed the press that the accused had activated the SIMs using the documents of unsuspecting individuals and sold the verification OTPs over Telegram for about USD 13 each to Cambodia-based handlers in exchange for cryptocurrency. The numbers were, in turn, allegedly used by the Cambodiabased handlers to run stock market investment frauds. Ironically, OTPs and KYC were both introduced to prevent cybercrime that they are currently being misused to commit. A pertinent question is raised: is verifying the identity of a telecom subscriber enough to protect the digital identity attached to that SIM? The case is significant because the underlying abuse allegedly occurred after the SIM had entered the telecommunications system as a seemingly legitimate connection.
Before we proceed further, let us understand what “OTP-farming” actually means. An OTP has a unifocal objective to prove that the person punching in the OTP, being an identifiable individual, controls a phone number at a given point of time. OTP-farming commoditises that very proof. SIMs are activated in bulk, verification codes are harvested, and the data of verified accounts is sold further to people who want to look Indian and local. The scheme works because the number and the identity behind it are in fact real, but the individual in whose identity lies behind the SIM card is simply unaware of their documents, lent in good faith, being used.
In times when a mobile number has added functionalities of being an authentication layer for messaging platforms, financial services and other digital accounts, the integrity of the identity attached to that number becomes an inseparable part of digital security.
The Department of Telecommunications in India has put in place a Digital KYC framework to ensure subscriber verification which mandates authorised processes, controlled access for Point of Sale (PoS) agents and verification of the subscriber during activation. The framework also requires safeguards such as capturing a live photograph and relevant PoS details during the KYC process. Further, it penalises users for furnishing false particulars, suppressing material information or impersonating another person while establishing identity for obtaining telecommunication services under Section 29.
The difficulty exposed by the Mumbai case is therefore not the absence of a KYC framework but the usage of data mined for the KYC verification itself when the identity is subsequently used in a manner completely inconsistent with the circumstances in which the connection was issued.
Traditional KYC largely examines who obtained the connection. OTP-farming networks add an additional layer to explore how that connection is subsequently being used. The Mumbai incident shows that a SIM may successfully pass the verification process and still become part of a larger network involving multiple connections, devices and digital accounts. The reflex is to add another verification step. But every additional document collected and every additional channel through which it passes is another point of leakage. Verification without custody discipline simply enlarges the attack surface. What modern technology demands is not just the ease of detection but a line of accountability for the documentary trail after the incident. In other words, the gap is in governance.
This is where regulatory situations become murkier for telecom operators. The Digital Personal Data Protection Act, 2023 frames the responsibility clearly for organisations that collect identity data or rely on OTPs and places them in vicarious responsibility for personal data processed on their behalf, including through agents and distributors. Misuse of an individual's documents without their knowledge qualifies as a personal data breach under the Act invoking the onerous penalties prescribed thereunder. In the wake of the phased deployment of the Act, it becomes even more pertinent for telecom operators to establish detailed accountability and governance chains through the course of their internal and external operations and to prepare the incident team to manage CERT-In reporting and the DPDP breach process together, since they will run concurrently. Compliance is no longer a one-time exercise and calls for continuous, proportionate and risk-based monitoring of how verified connections are being used.
While self-governance sure is the most sustainable way forward, the Government of India has also put in place mechanisms to detect and intercept suspicious SIM card activities, and the I4C’s Suspect Registry and Samanvaya platform have been designed to facilitate the sharing and analysis of cybercrime-related identifiers and linkages between lawenforcement agencies. Read with the data protection laws, these safeguards may be effective in identifying gaps in governance from the telecom operator thereby calling for data privacy investigations and prosecutions by the Board.
The Mumbai investigation demonstrates why the legal conversation around telecom identity cannot stop at whether the initial documents were genuine.
The more difficult question is whether the existing governance framework can identify when a legitimately issued connection is being systematically repurposed for fraudulent digital activity, while also ensuring that legitimate users are not subjected to disproportionate surveillance or automated restrictions. In other words the issue is about the lifecycle of digital identity.
The Mumbai case is still under investigation, but it highlights a broader principle for digital governance: verification establishes identity at one point in time; effective cybersecurity requires protecting that identity throughout its lifecycle.
