Bhadrak SIM Agent Supplied OTPs to Chinese Cyber Fraudsters, 1,333 SIM Cards Seized

Police in Bhadrak, Odisha, have arrested a local SIM-card agent accused of activating mobile connections in the names of unsuspecting people and passing the one-time passwords (OTPs) on those numbers to cyber fraudsters allegedly operating from China and other Indian states.

The Cyber Crime and Economic Offences (CC & EO) Police Station seized 1,333 activated SIM cards from the accused, Subhamjyoti Nayak (23), son of Brajakishore Nayak, of Raghunathpur under Bhandaripokhari police station, Bhadrak district. Police described him as a key member, and the Bhadrak agent, of the network. He has been forwarded to court. Superintendent of Police Manoj Rout said five other suspects are absconding and efforts are on to arrest them.

Bhadrak Police present the accused and the seized material at the press briefing.

The Modus Operandi

Police set out a four-step chain, from a SIM counter in Odisha to fraudsters abroad.

1. SIMs in other people's names. According to the police press brief, Nayak and his associates fraudulently procured and activated SIM cards in the names of members of the public, using SIM-card agent IDs of Vodafone Idea and BSNL. Sources told that forged identity documents were used and the people named on the connections did not know.
2. Numbers held in Bhadrak. The activated SIMs stayed with the gang. Police recovered 1,333 of them along with six keypad phones, an iPhone and a smartphone.
3. OTPs passed to Chinese handlers. When a WhatsApp, Telegram or other account is opened on a mobile number, the platform sends an OTP to that number to verify it. Police said the gang supplied these OTPs over WhatsApp and Telegram to fraudsters allegedly based in China and other states. With the OTP, a fraudster can run an account on an Indian +91 number from anywhere, while the number traces back to an Indian subscriber who never asked for it.
4. Paid in crypto, cashed out through banks. The gang was allegedly involved in cryptocurrency transactions through Binance to convert and encash suspected fraud proceeds. Sources told that payments were made in cryptocurrency to evade police and security agencies. Police seized 13 bank passbooks, four cheque books, an ATM card, a Google Pay QR code and Rs 1,73,500 in cash.

How a Relayed OTP Activates WhatsApp Remotely

WhatsApp, Telegram and similar apps verify a new account by sending a six-digit code, by SMS or voice call, to the phone number being registered. The app does not check where that code is typed in. Anyone who enters it, on any phone, anywhere in the world, gets the account.

The following explains how the method generally works; it is not taken from the police brief. The SIM never has to leave India:

1. The handler starts registration abroad. A fraudster, on a phone in another country, enters an Indian +91 number from the batch and requests a verification code.
2. The code lands in India. The SMS or call reaches the SIM sitting in a keypad phone with the local operator.
3. The code is relayed. The operator reads it and forwards it to the handler over WhatsApp or Telegram, as police allege happened in Bhadrak.
4. The account goes live overseas. The handler enters the code and the WhatsApp account now runs on the foreign device. The handler can switch on two-step verification with a PIN, so the person in whose name the SIM was issued cannot easily take the number back.

Once verified, the account keeps working over Wi-Fi or a foreign mobile connection without the SIM. Each relayed code costs the network only a few seconds, which is why a single stock of SIMs, like the 1,333 seized in Bhadrak, can supply a large number of accounts.

How the Accounts Are Used in Scams

A +91 WhatsApp account carries an Indian identity that a foreign number does not. Such accounts are commonly used in the frauds Indian police deal with daily. They include task-based part-time job offers, stock-tip and investment groups, "digital arrest" video calls by fake police or customs officers, loan-app harassment, and sextortion. When victims report an account and WhatsApp bans it, the handler activates the next number from the stock.

For investigators, the trail runs backwards to the wrong person. The subscriber on record is an Indian citizen whose documents were misused. The SIM agent is a small local figure. The handler who actually spoke to the victim is outside the country, and the money moves through cryptocurrency.

The Rule Meant to Close This Gap

The Department of Telecommunications issued SIM-binding directions on 28 November 2025, under the Telecommunications (Telecom Cyber Security) Rules, 2024. They require messaging apps that use Indian numbers, including WhatsApp and Telegram, to verify that the registered number's SIM is active and present in the device on which the app is running. The DoT has set 31 December 2026 as the compliance deadline, with the requirement applying from 1 January 2027. If the SIM is removed or inactive, the app may suspend its functions.

In its press release, the DoT described this pattern: Indian SIMs bought, used to register messaging accounts, and then run from outside India, where a session verified once can continue without fresh checks. The original six-hour forced logout for web and desktop versions has been replaced by risk-based logout in suspected fraud cases, according to officials.

Until SIM binding takes effect, an Indian OTP relayed over a chat app is enough to hand a +91 identity to a fraud operation anywhere in the world.

The Telegram Trail

Printouts laid out at the police press briefing appear to show Telegram chat lists. They carry Chinese-language group names, several "Deleted Account" senders, and English messages about new numbers and bots. Police have not publicly described the printouts, and their contents have not been independently verified.

The Case

The case, CC & EO PS Bhadrak Case No. 22/2026, has been registered under Sections 318(2), 318(4), 319(2), 338, 336(3) and 3(5) of the Bharatiya Nyaya Sanhita, Sections 66C (identity theft) and 66D (cheating by personation using a computer resource) of the Information Technology Act, and Section 42(3)(e) of the Telecommunications Act, 2023, which penalises obtaining a SIM or other telecommunication identifier through fraud, cheating or impersonation.

Articles Seized

• Activated SIM cards: 1,333
• Bank passbooks: 13
• Cheque books: 4
• ATM card: 1
• Google Pay QR code: 1
• Cash: Rs 1,73,500
• iPhone: 1
• Smartphone: 1
• Keypad mobile phones: 6
• KTM motorcycle (OD-34-Y-5623): 1

Investigation Continues

Police said they are working to identify the remaining associates, trace the financial and cryptocurrency transactions and uncover the entire network.

Citizens can check the mobile connections issued in their name on the Department of Telecommunications' Sanchar Saathi portal and report any number they do not recognise. Victims of cyber fraud can call the national helpline 1930 or report at cybercrime.gov.in.