Mumbai/New Delhi: Behind many of India’s digital-arrest scams, fake investment groups and online frauds lies a little-seen underground supply chain: “OTP farming.” It is a cybercrime-as-a-service business in which fraudulently obtained Indian SIM cards are used to generate one-time passwords, activate WhatsApp and other accounts, and sell that access to criminal networks operating from Cambodia, Malaysia, Laos, Thailand, Myanmar and beyond.

To advertise here,

At its simplest, OTP farming turns an ordinary mobile number into a commodity. Criminals acquire SIM cards—often using stolen or misused KYC documents—insert them into banks of basic phones or SIM-box devices, receive verification codes, and forward them to overseas handlers through Telegram or Signal. The buyers then use Indian numbers to appear local while targeting victims in India.

How the racket works

An OTP is designed as a second layer of security for banking, e-commerce, messaging and other digital services. OTP farmers exploit that system at scale by controlling the SIM card that receives the code, rather than persuading a victim to reveal it.

Police describe a layered operation:

  • A SIM agent activates connections using identities or biometric details of unsuspecting people, sometimes for a commission.
  • The SIMs are placed in keypad phones, smartphones or multi-port SIM boxes capable of holding dozens or hundreds of connections.
  • Verification OTPs are generated for WhatsApp, shopping, gaming and other platforms.
  • The codes or ready-made accounts are sold to fraud handlers abroad, often for cryptocurrency payment.

In illicit SIM-farm operations, hardware gateways can route international calls and messages through local Indian SIMs. That makes foreign-origin traffic appear domestic, reduces international termination costs and helps operators evade carrier blocks by rotating numbers.

Mumbai case reveals the scale

Mumbai Cyber Police’s West Region unit recently arrested three men -- Pramod Kumar alias Bipin, Dharmendra Gupta and Rajiv Kumar Gupta -- for allegedly running an OTP-farming network that supplied Indian WhatsApp numbers to fraudsters in Cambodia.

Police seized 669 active SIM cards, 100 handsets, 120 batteries, chargers, a computer CPU, a Wi-Fi router and an optical fingerprint scanner.

According to investigators, Rajiv Gupta, a point-of-sale agent, allegedly activated SIM cards using documents belonging to people who were unaware of the misuse. The cards were allegedly passed through Dharmendra Gupta to Pramod Kumar, who used 91 Samsung Guru keypad phones and nine smartphones to generate WhatsApp verification codes.

The OTPs were allegedly sold to Cambodia-based handlers through Telegram for about USD 13 -- roughly Rs 1,150 -- per code, paid in Tether cryptocurrency. Police said the Indian WhatsApp numbers were then used to run stock-market investment frauds against Indian citizens, with proceeds routed through rented mule bank accounts.

Nationwide supply chain

The practice is not confined to one city. In Ahmedabad, police and the Indian Cyber Crime Coordination Centre alleged that a network operating across 26 states sold about 21,000 OTPs over five years, largely for e-commerce and gaming platforms, at around Rs 100 each.

The same network was accused of selling roughly 900 WhatsApp OTPs at about Rs 250 each.

Investigators said a telecom sales agent allegedly misused customers’ biometric data to activate dummy SIMs without their knowledge. Those SIMs received OTPs, which were forwarded to criminals to create fake WhatsApp, shopping and gaming accounts.

In Tamil Nadu, cybercrime police have separately raided alleged SIM-box sites in Tiruchirappalli and Thanjavur, seizing 10 e-SIM-enabled devices during a wider investigation that began in Bengaluru. Officials said the equipment was used to make cyber-fraud calls and that probes were focusing on the procurement, deployment and control of SIM-box infrastructure.

Why Indian numbers matter

For international scam syndicates, an Indian mobile number is valuable because it lends credibility. A victim is more likely to answer a call or trust a WhatsApp message that appears to originate from an Indian number than one from an unknown overseas caller ID.

The numbers are used to create WhatsApp groups promoting fake trading apps, cryptocurrency schemes, “high-yield” investment plans and stock-advisory services. Trichy cybercrime police said many investment-fraud rings targeting Indians are based in Malaysia, Cambodia, Laos, Thailand and Myanmar, with Indian operators often working in or trained at overseas scam compounds.

The infrastructure also supports other forms of fraud. Cybercrime-as-a-service operators may sell virtual numbers, OTPs and activated accounts without ever contacting victims themselves, allowing specialist suppliers to feed larger fraud networks.

The cost to victims

The immediate harm is financial: fake investment schemes, phishing, account takeovers and digital-arrest scams can drain savings within minutes. But OTP farming also creates a second, less visible injury -- identity misuse -- when SIM cards are activated using another person’s documents or biometric details.

Maharashtra Cyber Cell’s guidance notes that criminals may also obtain a duplicate SIM in a victim’s name or persuade a bank to change the mobile number linked to an account, allowing them to receive transaction OTPs. Such methods can make even a cautious customer vulnerable if the fraudster controls the number receiving the code.

Authorities are increasingly treating OTP farming as critical fraud infrastructure rather than an isolated scam. The National Cyber Crime Reporting Portal allows citizens to report suspicious phone numbers, WhatsApp accounts, Telegram handles, SMS headers, websites and other identifiers, and to check identifiers against its suspect repository.

But investigators face structural challenges: SIM cards can be activated using compromised identities, devices can be dispersed across states, payments can move through cryptocurrency and mule accounts, and handlers can operate from jurisdictions outside Indian law-enforcement reach.

The Department of Telecommunications has also moved toward SIM binding, requiring app-based communication services to maintain a continuous link with the active SIM in a user’s device -- a measure intended to make it harder to use OTPs or accounts detached from the original SIM.

What users can do

  • Never share an OTP, UPI PIN, banking password or card details with an unknown caller, courier agent, bank representative or “KYC” verifier.
  • Treat unexpected OTPs as a warning: if you did not initiate a login, payment or account change, do not enter or disclose the code.
  • Check whether your mobile number is still linked to your bank account and important apps; report unexplained service disruption immediately.
  • If a number suddenly stops working, contact the telecom operator at once—this can be a sign of a duplicate-SIM fraud.
  • Report cyber fraud promptly through the National Cyber Crime Reporting Portal or by calling 1930, and preserve messages, transaction records and call details.

For now, OTP farming remains largely invisible to the public: victims see the scam call or fraudulent WhatsApp group, not the room full of inexpensive phones and SIM cards that made it possible. Police say dismantling it will require coordinated action across telecom operators, banks, digital platforms and international agencies.