TL;DR: In the call merging scam, a stranger calls saying a friend gave them your number, then asks you to merge in a “second call”. That second call is actually your bank’s automated OTP call, triggered by the scammer. Once you merge, they hear the OTP read aloud and use it. NPCI has warned about it. The fix is simple: never merge a call with someone you don’t know.
How the scam plays out
The National Payments Corporation of India (NPCI), which runs UPI, warned users about this trick on its X account. As reported by Business Today and others, it usually goes like this:
- The friendly call. Someone calls about a job interview, an event invite or a deal, and says they got your number from a mutual friend.
- The second call. While you’re talking, another call comes in. The caller says it’s that friend and asks you to merge so all three can talk.
- The trap. The second call isn’t your friend. The scammer has started a login or payment on your account and picked “get OTP by call”. The incoming call is your bank’s automated system reading out the code.
- The merge. You tap merge. The robot reads the OTP into a conference call that now includes the scammer.
You never said the OTP out loud and you never typed it anywhere. That’s why people who “know never to share OTPs” still fall for it.
Why it works so well
- It skips the part you’ve been trained to watch. Most warnings say “don’t share OTPs”. This scam doesn’t ask you for one.
- The “mutual friend” line lowers your guard. It feels social, not financial.
- Merging is a normal phone feature. There’s no strange link, app or code to make you suspicious.
The scammer needs one thing to start: your phone number, ideally with your name and bank. That combination is easy to find when your number has been in a data leak. See how phone numbers end up exposed online.
How to protect yourself
- Never merge a call with an unknown number. This is NPCI’s main advice. If a “friend” wants to join, hang up and call the friend yourself on the number you have saved.
- Treat any OTP you didn’t ask for as an alarm. If an OTP SMS or call arrives while a stranger is on the line, end the call and check your bank app.
- Be wary of anyone who needs you to stay on the line. Pressure plus urgency is the pattern behind most OTP fraud.
- Turn on app-based approvals where your bank offers them, so fewer codes are read out by phone.
If you already merged a call
- Call your bank’s official helpline (from the back of your card or the bank’s website, not Google search results, which can be fake customer care numbers) and block cards, UPI and net banking.
- Call 1930 or file at cybercrime.gov.in straight away. Speed matters: see the golden hour and fund freezes.
- Change your net banking password and UPI PIN, and check that no call forwarding was switched on during the call.
Frequently Asked Questions
What is the call merging scam?
A scammer gets you to merge an incoming call that is really your bank's automated OTP call. Once merged, they hear the OTP and use it to log in or pay from your account.
Who warned about the call merging scam?
NPCI, which runs UPI, posted a warning on X advising people never to merge calls with unknown numbers.
Can I be scammed without sharing my OTP?
Yes. In this scam you never say or type the OTP. The bank's own voice call reads it out on a conference call the scammer is part of.
What should I do if I merged a suspicious call?
Call your bank's official helpline to block cards and UPI, report to 1930 or cybercrime.gov.in immediately, then change your passwords and UPI PIN.
Sources
- Business Standard: NPCI warns against call merging scam
- Business Today: How to save yourself from the call merging scam
- National Cyber Crime Reporting Portal