FRAUD ALERT

Picture this: your bank account, your digital wallet, every photo you've ever taken, your emails, your identification (ID) documents, your social media, even your mobile phone number itself — gone. Not over weeks but within minutes.

 

Sounds like the setup for a thriller, doesn't it? 

 

Except it actually happened and it is a fairly brutal reminder of just how fragile modern digital life can be when it's all stacked behind one login.

 

Time magazine recently ran a first-person account by Ryan Pettit, an airline pilot, describing exactly how this happened to him after he did something almost anyone would do without a second thought — he replied to what looked like a routine message. 

 

His story is a good, if uncomfortable, illustration of where cybercrime has actually moved to. It is not really about malware anymore. It is about people like you and me. Specifically, about how easy it still is to talk someone into handing over the one thing that matters.

 

Mr Pettit received a text message stating that there had been an unauthorised transaction on his credit card. Nothing unusual there — banks and financial institutions, including credit card issuers, send these all the time.

 

He replied that no, he had not made that purchase.

 

Minutes later, his phone rang. Caller ID showed his card provider's genuine support number which was spoofed. The person on the line sounded exactly like you would expect — very calm, courteous, professional, on top of things. Messages even started appearing in the same verified iMessage thread the real company used. Every visual cue said this was legitimate.

 

Then the caller mentioned a verification code (one-time passcode-OTP) was on its way, and asked Mr Pettit to read it out.

 

That was the moment everything fell apart.

 

The OTP was not there to confirm his identity to the company at all. It was there to let the fraudster confirm their own login attempt. Once he read it out, they were in — his cloud account, email ID, his trusted phone number swapped out for theirs, and just like that, he was locked out of his own digital existence.

 

Most of us think of email as, well, email. Somewhere long text messages land.

 

This really is not that anymore.

 

Your main email — your Apple ID, your Gmail or Google account, your Microsoft account, whichever one sits at the centre of things — is effectively the master key to nearly everything you do online. It touches your banking alerts, password resets, social media, cloud storage, online shopping, digital wallets, government portals, your photos, your password manager, your two-factor codes and even your UPI registrations.

 

Get control of that one email account, and you can often reset your way into a dozen others.

 

The Time article made a comparison Mr Pettit, the pilot, keeps coming back to: no aircraft is ever built with just one critical system, because a single point of failure is unacceptable at that altitude. 

 

And yet most of us are quite happily running our entire digital lives on exactly that — one login, no backup plan.

 

Once the cybercriminals were inside Mr Pettit’s account, stealing his money turned out to be just the opening move. They pulled cards from his digital wallet. Wiped his phone remotely. Switched on security settings specifically to keep him locked out. Went digging through the passwords saved in his cloud account. Messaged his wife for money pretending to be him. Tried to squeeze more money out of people using fake payment requests. Even opened financial and crypto accounts in his name.

 

The fraud did not end after that first phone call — it dragged on for weeks, because the cybercriminals still held the keys.

 

That is really the shift worth understanding here. This is not about draining one account and disappearing. It is about taking over the whole ecosystem that a person's life runs on.

 

Yes. Absolutely and easily.

 

Indian investigators are coming across the same playbook — phishing, spoofed numbers, fake customer-care calls, all wrapped in the kind of social engineering that used to take real skill and now takes barely any at all. The callers pose as your bank, a UPI-provider, the income-tax (I-T) department, Aadhaar authorities, your mobile service provider, a courier, Reserve Bank of India (RBI), your card issuer, an e-commerce site — pick one, someone has probably impersonated it this month.

 

Usually, it starts the same way: an SMS about ‘suspicious activity’ in your account, followed almost immediately by a call that sounds far too well-informed to be fake. And that is because it often isn't guesswork — the caller may already have your name, number, email, PAN details, maybe even fragments of your Aadhaar, lifted from old data breaches or simply bought on the grey market (dark web).

 

Whatever route they take, the endpoint is the same: get you to read out an OTP, approve a login, install some ‘support’ app, or just hand over your credentials directly.

 

There is a comforting myth that only careless or inexperienced people fall for scams like this. It is just not true. Some of the highly educated and very smart people we have spoken to about this have said, almost word for word, "I genuinely didn't think I could be fooled that easily."

 

The thing is, by the time the phone rings, the scammer has usually already done their homework — weeks of quietly piecing together your name, number, birthdate, address, banking details, even family information, scraped from leaks and social media. 

 

Add artificial intelligence (AI) tools into the mix now and the illusion of legitimacy they can build is honestly very convincing. When everything checks out on the surface, people comply. It is not stupidity. It is a well-built trap.

 

A lot of services still lean entirely on SMS-based OTPs. They help, but they are not bulletproof — not if you can be convinced into reading one out over a phone call, and not if someone has already hijacked your registered number. Either way, that one small text becomes the weak link that the whole chain hangs from.

 

Security professionals have been saying this for a while now: where possible, move to an authentication app or a hardware key rather than relying solely on SMS.

 

This is not about being fearful of technology. It is about not leaving your whole life resting on one login.

 

1. Never read an OTP out loud to anyone. No bank, no tech company, no government office will ever ask you to do this. If someone does, just hang up.

 

2. Don't trust the call just because the number looks right. Caller ID can be spoofed convincingly. Hang up and dial the number printed on your card, bank passbook, or the company's official website instead.

 

3. Split up your digital identity. Using one email address for absolutely everything is asking for trouble. Separate addresses for banking, government services, personal messages, shopping and social media means a breach in one place doesn't take down everything else. For example: [email protected] can be used for your banking or financial transaction accounts. You can use a similar pattern for other services as well.

 

4. Guard your primary email like it's a bank vault. A genuinely strong, unique password (13+ characters, mixed case, numbers, symbols), multi-factor authentication (MFA), a recovery email and phone number kept current and security alerts switched on. This is your most valuable digital possession — treat it that way.

 

5. Don't put every password in one basket, unprotected. Password managers are great, but only if the manager itself is properly locked down with strong authentication.

 

6. Check your recovery settings every few months. Trusted devices, backup emails, registered numbers — old, forgotten devices sitting on that list are a liability. Remove them.

 

7. If you think your account has been compromised, move fast. Change your passwords straight away. Call your bank. Freeze your debit and credit cards if needed. Contact your mobile services provider. Report it through cybercrime.gov.in or call 1930, the national cybercrime helpline. And tell your friends and family — because the attackers will likely try them next, pretending to be you.

 

Mr Pettit did not conclude that one dodgy text message was the actual problem. The problem was that one single account controlled almost everything about his life. That is the part worth sitting with, because it applies just as much here as it did to him.

 

Nobody needs to break into your house or lift your wallet anymore. If they get into your primary email, they can often work their way into your money, your identity, your memories and everything you've built.

 

Your email account was never just an inbox. It is the master key. Guard it the way you would guard the keys to your home, your office, and your locker — because to a fraudster, that is exactly what it is.