Last week, one of my close friends visited my home. During our conversation, he said something that immediately caught my attention.
“For the last two days, I’ve been receiving more than a hundred OTP (One-Time Password) messages every day—from 9 a.m. to 6 p.m. I haven’t registered on any new website or app. Yet I keep getting OTPs from banks, e-commerce platforms, food delivery companies, loan providers, insurance firms, and social media platforms. What is happening?”
To understand the issue, I called one of the reputed insurance companies whose name appeared in several of those OTP messages. Their response was surprising.
“Sir, this has become a major problem for us as well. Many people like you have been calling us over the past week. Unfortunately, there is very little we can do. We recommend that you report the incident to the National Cyber Crime Helpline by calling 1930.”
Such incidents are no longer isolated. Complaints of receiving hundreds of unsolicited OTPs are increasing across Karnataka and many other parts of India. Many people dismiss them as a mobile network glitch, a software issue, or even a prank by friends. However, cybersecurity experts warn that this could be a sign of a new type of cyber attack known as OTP Bombing or an OTP Flood Attack.
What is OTP Bombing?
Normally, you receive an OTP when logging into your bank account, signing in to an online service, registering on a website, or resetting a password. In an OTP Bombing attack, cybercriminals use automated tools, websites, or mobile applications to repeatedly submit a victim’s mobile number across hundreds of online platforms. As a result, the victim’s phone is flooded with OTP requests throughout the day.
In many cases, these messages are cleverly designed to look genuine. Some even appear to originate from legitimate sender IDs used by banks and well-known companies, making it extremely difficult for users to distinguish between genuine and fake notifications. At first glance, this may seem like nothing more than an annoyance. In reality, however, it is often the first step in a carefully planned cyber fraud. Once victims become frustrated and start ignoring the constant stream of OTP notifications, cybercriminals attempt to exploit that distraction to carry out financial fraud.
Why Do Cybercriminals Launch OTP Bombing Attacks?
A common question people ask is: “If I never share my OTP, how can criminals steal my money?”. The answer lies in the strategy behind the attack.
1. Creating a Distraction
In many cases, cybercriminals may have already obtained your internet banking username, password, or email credentials through previous phishing attacks or data breaches. When they attempt to transfer money from your account, your bank sends a genuine security alert or OTP. To ensure you don’t notice this important message, attackers flood your phone with hundreds of fake OTP notifications. The genuine banking alert gets buried among hundreds of irrelevant messages, reducing the chances that you’ll notice suspicious activity in time.
2. Exploiting Confusion
As your phone continues to buzz with endless OTPs, you become anxious and confused. This is when the criminals call you, pretending to be officials from your bank or cybersecurity department.They may say: “Someone is trying to hack your account. To stop the attack, please tell us the latest OTP you received.”
Panicked by the ongoing flood of messages, many victims unknowingly share the genuine banking OTP, allowing the criminals to complete fraudulent transactions.
3. SIM-related Fraud
Some attackers go a step further. While the victim is distracted by the OTP flood, they attempt to perform an eSIM activation or SIM swap fraud. A few missed calls or deceptive requests may eventually lead to the victim’s SIM card being deactivated, giving criminals greater control over banking-related communications.
What Should You Do If You Become a Victim?
If your phone suddenly starts receiving hundreds of OTP messages, do not panic. Instead, follow these steps immediately:
- Stay calm. Do not react impulsively.
- Do not click on any links contained in SMS messages or reply to suspicious messages.
- Do not switch your phone off or put it in Airplane Mode. Criminals often benefit when victims become unreachable.
- Carefully monitor your SMS inbox for genuine banking alerts or transaction notifications.
- Immediately change the passwords and PINs of your internet banking and financial accounts.
- Do not answer unknown calls. If you do answer, never share OTPs, passwords, PINs, or any personal information. Never click links, scan QR codes, or install applications suggested by unknown callers.
- Report the incident by calling the National Cyber Crime Helpline (1930), filing a complaint at cybercrime.gov.in, or visiting your nearest police station.
- Inform your mobile service provider immediately about the incident.
- If you have shared your Aadhaar details or a copy of your Aadhaar card, lock your Aadhaar using the official UIDAI website or the mAadhaar application.
- If you suspect that you clicked a malicious link or installed a harmful application, back up your important data and perform a factory reset to remove any malware from your device.
Awareness is the Best Defence
Cybercriminals today are no longer relying only on sophisticated hacking techniques. Increasingly, they are exploiting human psychology—creating panic, confusion, and urgency to manipulate victims into making costly mistakes.
OTP Bombing is not merely about flooding your phone with messages. It is a carefully crafted distraction designed to lower your guard at the exact moment criminals attempt to compromise your digital identity or financial accounts.
The golden rule remains unchanged: Never share an OTP with anyone, regardless of who they claim to be. No bank, insurance company, government agency, or law enforcement authority will ever ask for your OTP over a phone call.
In today’s digital world, awareness is your strongest cybersecurity tool. A few moments of caution can prevent significant financial loss and protect your personal information from falling into the wrong hands.
