Fraud calls in India: the call-merging scam, fake relative-loan calls and what to do

Most of us have had the call. A stranger who knows your name says something that sounds urgent, and asks you to do one small thing. The newest version going around asks you to take a conference call. The caller says a relative of yours has taken a loan, is not picking up, and may be calling from a new number. It sounds like a favour. Done wrongly, it hands your OTP to a stranger. This guide explains how that call works, what the other common fraud calls look like, and what to do in the first minute. Checked 2 November 2026.

In short

• Never merge or conference a call at the request of someone you do not know. If you are asked to, hang up.
• Never read out an OTP, to anyone, on any call. The RBI says bank officials and genuine entities never ask for it, and that you should not share it even with family and friends.
• Call your relative yourself, on the number already in your phone, after you have ended the call.
• Lost money? Call 1930 at once and report on cybercrime.gov.in. Then tell your bank on its official number. Minutes matter.
• A name on your screen is not proof. Report the number on Chakshu (Sanchar Saathi), even if you did not lose anything.

The call-merging scam, step by step

The reports we have read describe it like this. The caller phones you from an unknown number and uses your name. In the version NPCI warned about in February 2025, the caller says they got your number from a friend and asks you to merge a call because the friend is calling from another number. The version now being reported to us uses a loan story: your relative took money from a loan company, will not answer, and was told that you would be called next. You are asked to bring him on the line.

Then your phone rings with a second call. You press merge, and now three lines are joined. That second call is not your relative. NPCI says it is the bank’s OTP verification call. The Mumbai cyber police say the same, and add that the fraudster stays silent and listens. The OTP is read out by a machine, the fraudster hears it, and uses it to complete a payment or to log in to an account. You never have to say a word. The Mumbai police also note that these criminals often already hold some banking details, taken from data leaks, phishing sites, bad apps or earlier calls. The merge only gets them the last piece.

Hyderabad cybercrime officials described a variant in October 2026. The caller poses as a bank, courier or electricity official, says the case must go to a “senior officer” or “verification cell”, and asks you to press “Add call”. While you wait, the caller starts a transaction, and the OTP call arrives on the merged line.

A fair point, so you are not left frightened. Merging calls is a normal phone feature and does nothing to your money by itself. What matters is that an OTP is spoken on a line the fraudster can hear. So the cure is simple: do not merge, and do not take any call that asks you to.

What an OTP voice call sounds like

Many services can send the one-time password as a voice call instead of an SMS. Typically you hear a recorded or computer voice. It says that it is calling from a service, reads out the digits slowly, and often repeats them. No person speaks to you and nothing needs an answer from you. If that kind of call arrives while a stranger is on the phone, or right after someone asked you to “bring in” another person, treat it as an attack. Do not repeat the digits, do not press anything, and end the whole call. We describe the sound from general experience of such calls, as we did not find an official recording.

The first minute

1. Hang up. Do not merge, do not “just try once”. If the lines are already merged, cut the whole call.
2. Do not say or read out any OTP. If you have heard one, do not repeat it to anyone.
3. Call your relative on his known number. Use the number saved in your phone, not any number the caller gave. Ask a second family member too.
4. If an OTP or a bank alert has already come for something you did not do, call your bank on the number printed on your card or shown on the bank’s own website, and ask it to block the card, UPI or account. The RBI warns that numbers found through search engines may be fake.
5. If money has gone, call 1930 straight away and then file on cybercrime.gov.in. Our guide on reporting UPI and cyber fraud lists what to keep and say.
6. Report the number on Chakshu at sancharsaathi.gov.in, even if you lost nothing. Take a screenshot of the call log first.

Why the first hour matters

The MHA says the Citizen Financial Cyber Fraud Reporting and Management System, run by I4C, was launched in 2021 to stop fraudsters from moving the money onward. Till 30 June 2026 it had saved more than Rs 11,158 crore across more than 32.80 lakh complaints. Hyderabad’s cybercrime police have explained how it works: when you report, an alert goes to the bank where your money went, which can put a hold on it, and if the money has already moved, the next bank is asked to hold it, and so on. The sooner it starts, the more can be caught. A cyber-security faculty member speaking at a PIB workshop in Kohima on 21 August 2026 also urged victims to report in the “golden hours”. That figure of saved money is a count of amounts stopped, not a promise that your own money will come back.

The caller knew my name. Does that make the call genuine?

No. Names reach fraudsters in many ways: leaked data, social media, earlier calls, or a caller-name display. A DoT circular of 13 October 2026 tells telecom operators to introduce Calling Name Presentation (CNAP) on 4G and 5G networks from 1 November 2026. Under it, your phone shows the name saved in your contacts first. If the number is not saved and the call is domestic, it shows the name of the caller as recorded by the caller’s own operator. A call from abroad shows “International Call”. Business connections may show a registered trade mark or GST trade name, checked by the operator.

That is useful, but see what it does not say. It is the name on the connection record, not a check on who is speaking or why. The DoT itself disconnects mobile connections it finds were taken on fake documents, so a SIM can carry a name that is not the caller’s. The circular covers 4G and 5G only, and we could not confirm that every operator and handset was showing names on 2 November. Names shown by other apps are not an official record, and we do not rate any app. Treat a name as one small clue, never as a reason to share an OTP.

Common fraud calls and the right response

Warning signs that fit almost every script

• Urgency: “today”, “in ten minutes”, “before the case is filed”.
• Secrecy: “do not tell your family” or “do not call the bank”.
• A request to stay on the line, merge a call, or move to video.
• A request for an OTP, a UPI PIN, a CVV, or to install an app.
• Money to “verify”, “deposit” or “settle” something.

Remember, a UPI PIN is needed to send money and never to receive it, and no genuine caller will need your OTP to help you.

A talk to have at home

Fifteen minutes with your parents or grandparents can save a great deal. Say it plainly. If a call asks you to merge, to press a button, to read a number, or to hurry, you simply put the phone down. You will never be scolded for hanging up on a real caller, because a real caller will ring again or write. Agree on one family rule: if anyone calls about a relative in trouble or in debt, you ring that relative yourself first. Keep 1930 and your bank’s official number on a card near the phone. And tell them they can call you at any hour about a strange call, before they do anything.

Check what is in your name

The Sanchar Saathi portal lets you see the mobile connections registered in your name and report any you did not take or do not need. It also lets you report an incoming international call that shows an Indian number. It is worth checking once a year.

What we could not confirm

• We found no official advisory that describes the loan story in these exact words. NPCI and the police describe the friend and acquaintance version, and Chakshu counts “impersonation as a relative or friend” as a category.
• We found no public report of arrests for call-merging in the sources we opened.
• No official recording of an OTP voice call, and no official advisory on the missed-call and “press 1” trick.
• Whether every handset and operator was showing caller names on 2 November 2026.
• We could not verify any Instagram, Facebook or LinkedIn video from an official account, so the videos below are from YouTube.

Do this today

Save 1930 and your bank’s official number. Tell your family the rule: no merging, no OTP to anyone, ring the relative yourself. Check your connections on Sanchar Saathi. For more on staying safe, read our guide on digital arrest and the emergency numbers guide.