India busts Transnational WhatsApp OTP Farming Network Tied to Telegram Investment Frauds, Cambodia Links
Investigators seized 100 mobile handsets, 669 SIM cards, 120 batteries, chargers, a CPU, Wi-Fi router, and other devices while tracing ₹22.30 lakh in suspected fraud proceeds across multiple bank accounts.
Mumbai, September 20, 2026, Mumbai’s West Region Cyber Police have arrested three men accused of running an “OTP farming” operation that supplied Indian WhatsApp numbers to overseas fraudsters, including those based in Cambodia.
The network allegedly supported stock-market investment scams targeting Indian victims through Telegram groups and WhatsApp.
Background
The case surfaced after a 68-year-old resident of Andheri reported losing ₹22.30 lakh (approximately $26,700) in April after being contacted on WhatsApp by people posing as representatives of a reputed investment firm.
The victim was added to a Telegram group and lured with promises of high returns before transferring funds into multiple accounts.
Technical analysis of the complaint led investigators to the alleged suppliers.
The Arrested
The arrested men are Pramod Kumar, also known as Bipin, 34, a college dropout from Delhi; Dharmendra Gupta, 43; and Rajiv Kumar Gupta, 51, a point-of-sale agent from Uttar Pradesh.
Police say Rajiv Gupta obtained SIM cards using documents of unsuspecting individuals and passed them to Kumar via Gupta for a commission.
Kumar then used basic keypad phones, primarily Samsung Guru models, to generate WhatsApp verification codes that were sold to foreign handlers.
Investigators recovered 100 mobile handsets (91 keypad phones and nine smartphones), 669 active SIM cards, 120 batteries, 20 chargers, a computer CPU, a Wi-Fi router, an optical fingerprint scanner, cheque books, and a passbook. Payments for the codes were reportedly received in cryptocurrency, often around $13 in USDT per OTP, and converted through informal exchangers. One accused allegedly spent large sums on personal expenses, including trips.
Response
Deputy Commissioner of Police (Cyber) Bajrang Bansode said the arrests resulted from technical tracing after the victim’s complaint.
Assistant Police Inspector Nitin Gachhe described the activity as OTP farming: generating verification codes from multiple SIM cards on simple handsets and selling them via Telegram and similar apps to handlers abroad.
The overseas operators then used the Indian-registered WhatsApp numbers to contact victims while appearing local.
Impact
The bust forms part of a broader crackdown.
In a related operation, four additional men were arrested for allegedly supplying mule bank accounts used to move proceeds from similar investment frauds, with combined losses in the two cases exceeding ₹2.11 crore.
Police continue to trace further links and additional victims.
For a global technology audience, the case highlights persistent weaknesses in SMS-based account verification.
Messaging platforms such as WhatsApp still rely heavily on one-time passwords sent to phone numbers.
When large volumes of SIMs can be obtained and used at scale, fraudsters can create seemingly legitimate Indian numbers that increase the credibility of investment pitches.
Encrypted apps like Telegram facilitate both the sale of these numbers and the subsequent scams because of group features and limited content moderation on financial discussions.
India has seen a sharp rise in cyber-enabled investment and “pig-butchering” style frauds, many with operational bases in Southeast Asia.
Earlier this year the Enforcement Directorate identified tens of thousands of Indian SIMs being operated from Cambodia and linked to frauds worth hundreds of crores.
Crypto payments add another layer of difficulty for investigators tracking proceeds.
The episode underscores the need for stronger SIM-card Know Your Customer enforcement, alternative verification methods beyond SMS, and closer cooperation between messaging platforms, telecom operators, and law enforcement across borders.
Mumbai Police have urged citizens to treat unsolicited investment approaches on Telegram or WhatsApp with extreme caution and to report incidents immediately via the national cybercrime portal or local cyber cells.
India's Department of Telecom has issued a SIM-binding mandate in November 2025 under the Telecom Cyber Security Rules which requires messaging apps such as WhatsApp and Telegram to function only when the registered SIM remains physically active in the user’s device. Once fully enforced, OTP-farming operations that rely on detached SIMs and long-lived remote sessions become far harder to sustain.
Further investigation is underway to map the full international network.