CHENNAI: As many as seven customers of HDFC Bank in the city lost Rs3.99 lakh this month in a phishing attack that is alleged to have been done with the collusion of employees at telecom service providers. Three customers of State Bank of India in Chennai also lost money in a similar scam, sources said.The modus operandi of the conmen is to call up customers and identify themselves as officials of Reserve Bank of India or other banks.To make the call authentic, first an automated message says, "State Bank of India does not require its customers to share their password, ATM PIN or CVV numbers. Please do not share such information with our call centre representatives." After this, the fraudsters start speaking to customers.Then the fraudster would instruct the customer to SMS *121# to update their e-KYC and Aadhaar details. After the customer sends an SMS to *121, the fraudster using a blank SIM gets the number ported. With the "new ported number" the fraudster does fund transfers as the OTPs are sent to the registered mobile number -which is with him.HDFC Bank lodged complaint with the Vepery police station in the city this week after the fraud was detected."We have seen quite a few instances, where fraudsters are able to obtain duplicate SIMs. They prepare forged documents, submit them to telecom service providers and get a duplicate SIM issued after saying the original was lost. Meanwhile, the genuine customer would have his SIM deactivated and would not even be aware of fund transfers from his bank accounts till it is too late," said inspector D R Anbarasan, cyber crime, Chennai. But to carry out a fund trans fer, the fraudster would need the person's bank account number or net banking user ID -so how does he get it?Banks said a possible area of leaks could be cheque or cash deposit slips from dustbins."Customers fill in their names, bank account number, PAN card information and registered mobile number in the deposit slips. When people make a mistake, they immediately throw it in the dustbin -a potential gold mine for fraudsters.Customers also leave acknowledgment slips around," said an SBI branch manager.Another possibility is attention diversion tactics to obtain bank details. Most bank branches, including SBI, often carry notices warning customers about fraudsters posing as bank officials. "During demonetisation, because of the heavy rush there were a lot of fraudsters who would pose as bank officials.They would pretend to help old people in filling up forms. What they were actually interested in was in getting their bank account details -within a few weeks the same people would get calls asking them for their passwords," said the manager. In the case of HDFC Bank's customers, who were defrauded this month, they received calls threatening that their "bank account or debit card would be blocked, if they did not update their e-KYC, Aadhaar details as mandated by law." Cybersecurity experts said another method for obtaining bank account details was through third-party apps. "If you notice many of the free mobile apps, always ask access to our galleries, location, contacts emails. There is always the risk of fraudsters getting their hands on financially sensitive information through third-party mobile apps," said Vinod Senthil, CEO, Infysec, a Chennai-based security provider for banks.

Stay updated with all the Chennai Latest News headlines here. For more exclusive & live news updates from all around India, stay connected with NYOOOZ.