Researchers at CloudSEK have published a report looking at fraudulent customer service phone numbers in India. The researchers found around 20,000 of these phone numbers targeting users in India. The scammers purchase SIM cards from dark web markets, then trick people into handing over their financial information.
“The working of these scams has been more or less the same over the years where the scam begins with the purchase of burner (untraceable) sim cards. These sim cards are issued under fake identities and allow the threat actor to operate without worry. Threat actors are increasingly using this modus operandi to remain undetected. As a next step, they use social media posts, websites with search engine optimization techniques, and advertisements to get a wider reach and be accessible on search engines.”
The scammers use typical social engineering tactics, such as inducing fear and a sense of urgency.
“The unwary users search for them and may end up calling a fake customer care number,” the researchers write. “When customers call these fake call centers, they use this opportunity to retrieve financial information, OTP, etc., from aggrieved customers via social engineering methods. Generally, scammers try to leverage impersonation and the fear factor to collect money from the victims. Thereafter, the threat actors gain access to the victim’s bank account and purchase gift cards, etc, or transfer the amount to another account.”
The majority of the fake phone numbers were registered in the most populous regions of the country.
“An analysis of the area-wise breakdown of fake numbers revealed West Bengal as the most prominent hub, accounting for ~23% of the total registered fake customer care numbers,” the researchers write. “Kolkata served as the center for many large-scale operations. Delhi and Uttar Pradesh tied up for the second place, accounting for ~19% of the total registered fake numbers (9.3% recorded in each state). A possible reason for this can be the presence of various fake SIM card rackets in West Bengal, Delhi, and Uttar Pradesh. Law enforcement in these regions has time and again busted several groups with SIM cards purchased using stolen or forged identification documents.”
New-school security awareness training can enable your employees to thwart social engineering attacks.
CloudSEK has the story.
Here's how it works:
