In our hyper-connected world, a simple phone call can feel like the safest way to connect. But what if a scammer could weaponize the very features on your phone to steal from you in real-time? A sophisticated and alarmingly effective scam known as Merge Call Fraud does exactly that.

This isn’t your typical phishing attempt. It’s a calculated social engineering tactic that manipulates your trust and uses your own actions against you. Understanding how it works is the first and most critical step to protecting yourself.

The Anatomy of the Scam: A Four-Step Deception

The success of Merge Call Fraud lies in its carefully orchestrated sequence of events. The scammer creates a sense of urgency and familiarity, guiding the victim through each step without raising suspicion.

Step 1: The Initial Contact

It begins with a phone call. The scammer might pose as a mutual friend, a potential employer, or someone responding to an online ad you posted. They build rapport, creating a plausible story that makes you feel comfortable and lowers your guard. They are friendly, professional, and entirely convincing.

Step 2: The Urge to Merge

While you’re on the line, engrossed in the conversation, the scammer initiates a second, incoming call to your number. They’ll quickly say something like, “Oh, hold on, that’s my other line,” or “That’s our friend joining in now.” They then instruct you to accept the new call and merge it with the current one. To you, it seems like a normal part of a conference call. In reality, the trap is being set.

Step 3: The OTP Interception

This is the heart of the scam. The second call isn’t another person—it’s an automated call from your bank or another service. The scammer, in a separate process, has just initiated a transaction (like a password reset or a large money transfer) that requires a One-Time Password (OTP). That incoming call is the system reading the OTP aloud. Because you’ve merged the calls, you are unknowingly broadcasting the secret code directly into the scammer’s ear.

Step 4: The Financial Loss

With the OTP captured in real-time, the scammer immediately uses it to authorize their fraudulent transaction. Funds are drained from your account, or access to your digital life is compromised in seconds. By the time you realize something is wrong, the damage is already done.

Your Shield: How to Defend Against Merge Call Fraud

Knowledge is power. Now that you know the playbook, you can easily spot the red flags and protect yourself. Internalize these rules to make them second nature.

• NEVER Merge Calls From Unverified Sources. This is the golden rule. If someone calls you and asks you to merge another incoming call, refuse. There is no legitimate reason for a stranger or an unverified contact to ask this of you. Hang up.

• Guard Your OTPs Like Cash. A One-Time Password is for your eyes and ears only. Your bank, a tech support agent, or any legitimate service will never call you and ask for an OTP. Treat any such request as a scam.

• Verify, Then Trust. If a call feels even slightly off, end the conversation. If the caller claimed to be from your bank or a company, find the official phone number from their website and call them back directly to verify the situation.

• Listen for Clues. Be alert for the sound of an automated voice reading numbers during a call you’re on. This is a massive red flag that an OTP is being read into the line.

• Trust Your Gut. Scammers rely on creating a sense of urgency or excitement to make you act without thinking. If a situation feels strange, rushed, or too good to be true, it almost certainly is. It’s better to be skeptical and safe than trusting and broke.

• Secure Your Phone. Use strong, unique passwords for your accounts and enable biometric locks (fingerprint or face ID) on your device. Be mindful of app permissions.

This scam is clever, but it’s also preventable. By staying vigilant and sharing this information with friends and family, you can help shut down this avenue of attack and keep everyone’s hard-earned money safe.