For years, the golden rule of cybersecurity has been: "Never share your OTP."
But what if a scammer could completely take over your WhatsApp account, message your friends asking for money, and lock you out—all without you ever receiving or sharing a single OTP?
This is not a theoretical threat. It is the *401* Call Forwarding Scam, and it is currently one of the most sophisticated and rapidly spreading cybercrimes in India. Here is exactly how scammers bypass your OTP security, and why relying on your telecom provider for app security is a critical mistake.
What is the 401 Call Forwarding Scam?
The scam relies on a standard, entirely legal feature provided by Indian telecom operators like Jio, Airtel, and Vi: Call Forwarding.
When you dial *401* followed by a 10-digit mobile number on your phone's dialpad, you instruct your telecom provider to forward all your incoming phone calls to that 10-digit number.
Scammers exploit this feature using psychological manipulation. The trap unfolds like this:
- The Hook: You receive a phone call from someone claiming to be a customer service agent from Jio, Airtel, or a delivery company like Swiggy or Blue Dart.
- The "Fix": They tell you there is a network issue on your line, or that your delivery address is incomplete. To "fix the network" or "confirm the delivery," they ask you to open your phone dialer and dial a specific code:
*401*followed by a 10-digit number they read out to you. - The Trap Springs: You dial the code, assuming it's a technical command. Instantly, all your incoming calls are rerouted to the scammer's phone.
How Your WhatsApp Gets Hacked in Seconds
Once the call forwarding is active, the scammer moves incredibly fast to hijack your digital life:
- The scammer opens WhatsApp on their own device and tries to log in using your phone number.
- WhatsApp attempts to send a 6-digit OTP via SMS to verify the login. The scammer does not have access to your SMS, so this fails.
- After the SMS timer runs out (usually 60 seconds), WhatsApp offers a secondary option: "Verify via Call."
- The scammer clicks "Verify via Call." WhatsApp initiates an automated voice call containing the 6-digit verification code.
- Because you previously dialed
*401*, the WhatsApp verification call bypasses your phone entirely and rings directly on the scammer's phone. - The scammer answers the call, enters the code, and takes total control of your WhatsApp account. They immediately set up Two-Step Verification, locking you out permanently.
The Fatal Flaw of Telecom-Based Security
The 401 scam highlights a massive vulnerability in how modern apps handle security. Platforms like WhatsApp, Telegram, and traditional banking apps rely almost entirely on the telecom network (SMS or Voice Calls) to verify that you are who you say you are.
But telecom networks were built for communication, not for identity verification. SMS messages can be spoofed. SIM cards can be cloned (SIM Swapping). And as we've seen, calls can be forwarded with a simple USSD code.
If your app's security relies purely on your phone number, your identity is fragile.
How AirlockChat Secures Your Identity
To truly secure communication, we must decouple identity from vulnerable telecom networks. This is the foundational architecture of AirlockChat.
AirlockChat does not rely on fragile SMS OTPs or easily-hijacked phone calls to prove who you are.
- Cryptographic Identity Lock: Access to AirlockChat requires mandatory government-issued ID verification (like DigiLocker). Your account is mathematically bound to your legal identity, not just a 10-digit phone number.
- Immune to Telecom Hacks: Even if a scammer manages to clone your SIM card or forward your calls using the 401 scam, they cannot access or hijack your AirlockChat profile. They do not have your biometric or cryptographic government credentials.
- Absolute Account Security: By moving the security layer away from the telecom provider and into the verifiable identity layer, AirlockChat makes account hijacking economically and technically unviable for scammers.
Key Takeaways
The most dangerous hacks are the ones that use the rules of the system against you.
- Never dial USSD codes: Do not dial
*401*,*21*, or any other code starting with an asterisk on the instruction of a stranger. - Enable 2-Step Verification: Go to your WhatsApp settings and enable a 2-Step Verification PIN immediately. This acts as a final barrier even if your calls are forwarded.
- Cancel Call Forwarding: If you think you might have accidentally enabled call forwarding, dial
##002#on your phone to erase all forwarding settings.
For communication that is fundamentally immune to telecom hacks and OTP theft, switch to AirlockChat. Available for free on iOS and Android.