Data Leaked/ Cards Hacked

[beingmohit]

I randomly started getting SMSs regarding OTPs and transaction alerts. As I was already asleep, I did not bother. But, my wife checked it and to our horror, we were getting OTPs for random transactions on Flipkart, and all of them were getting successful. I immediately disabled online transactions on my card. Just then, I started getting OTPs on my RBL card. By the time I was able to disable transactions on my RBL card, another transaction went through successfully. I am confused and unable to understand how this can happen. How can someone hack the OTPs on my phone? Please let me know what I should do now.
Update: The hacker used my RBL card to purchase Flipkart GVs worth 50k. Fortunately, I could add these GVs to my Flipkart account before the hacker could. I discussed the incident with Flipkart and they have initiated a refund for these 50k.
The hacker used my Axis card to purchase 45k worth of Google Play vouchers. As the voucher codes were delivered to the hacker's email, I could not do anything about it. I am in discussions with Google Play support, but the conversations so far don't give me much confidence. I have also registered a complaint with the Cyber Crime Division of Bengaluru Police. They have not yet registered an FIR (only a complaint) as they want us to try and get out money back (You won't be wrong if you are wondering why we pay taxes to fund their salaries). Axis Bank has denied any responsibility as the payments were authorized using OTP.
Please let me know if anyone here has any suggestions about how to get my money back. Should I try to register an FIR? Should I try mailing Axis again?

 

[Deathsnatcher]

Following need to be aware if such situations arise
experts will advice
but yes otp come on emails also so change ur email pass first

 

[Mysterio_6174]

I recommend calling customer care to explain the situation. They will issue a new card number. If your phone is hacked, it's best to reset it. The bank will reverse unauthorized transactions and you won't be held liable if reported within 3 days.

 

[Predator]

Have you installed any app recently?

For now block your cards and file a complaint on cyber portal or call their helpline.

Use this copy of FIR at respective merchants where transaction has taken place and tell them its a fraud transaction and cancel the order

 

[prc1990]

I randomly started getting SMSs regarding OTPs and transaction alerts. As I was already asleep, I did not bother. But, my wife checked it and to our horror, we were getting OTPs for random transactions on Flipkart, and all of them were getting successful. I immediately disabled online transactions on my card. Just then, I started getting OTPs on my RBL card. By the time I was able to disable transactions on my RBL card, another transaction went through successfully. I am confused and unable to understand how this can happen. How can someone hack the OTPs on my phone? Please let me know what I should do now.

Did your money get deducted or you were getting OTPs only through some bomber app?

 

[plastikman]

I randomly started getting SMSs regarding OTPs and transaction alerts. As I was already asleep, I did not bother. But, my wife checked it and to our horror, we were getting OTPs for random transactions on Flipkart, and all of them were getting successful. I immediately disabled online transactions on my card. Just then, I started getting OTPs on my RBL card. By the time I was able to disable transactions on my RBL card, another transaction went through successfully. I am confused and unable to understand how this can happen. How can someone hack the OTPs on my phone? Please let me know what I should do now.

Also you may want to check your email / phone number and password on Have I been pwned website. That way you'll come to know if your details were leaked and available to scammers.

 

[beingmohit]

Following need to be aware if such situations arise
experts will advice
but yes otp come on emails also so change ur email pass first

Thanks for the suggestion. I have already changed my Email password. But, for my RBL card, I don't even get OTP on my email. So, I just don't understand how this can happen.

 

[beingmohit]

Did your money get deducted or you were getting OTPs only through some bomber app?

The money got deducted. The Axis customer care says that the transactions have already been transferred to the merchant as well. I am worried because knowing how terrible their customer support is, I don't know if they will do anything about it.

 

[Mysterio_6174]

Thanks for the suggestion. I have already changed my Email password. But, for my RBL card, I don't even get OTP on my email. So, I just don't understand how this can happen.

Some international transactions don't required otp

 

[beingmohit]

Have you installed any app recently?

For now block your cards and file a complaint on cyber portal or call their helpline.

Use this copy of FIR at respective merchants where transaction has taken place and tell them its a fraud transaction and cancel the order

Unfortunately, I am not in India. I called up Axis customer support and they have registered my complaint. They say they will transfer it to their respective team who will verify if the transactions are fraudulent and they will provide a resolution in 120 days! This has to be a joke!

 

[beingmohit]

Some international transactions don't required otp

These were all domestic transactions. I got an SMS for OTP for all the transactions.

 

[Strange]

The money got deducted. The Axis customer care says that the transactions have already been transferred to the merchant as well. I am worried because knowing how terrible their customer support is, I don't know if they will do anything about it.

Axis and RBL both send otp over email. I think your email password might have been compromised.

 

[4uziaul]

Axis and RBL both send otp over email. I think your email password might have been compromised.

He did mention that for his RBL Card he doesn't receive OTP on his email.

 

[beingmohit]

Axis and RBL both send otp over email. I think your email password might have been compromised.

Now that I see it, my email inbox does not have OTPs for any of the Axis or RBL emails. So, I guess whoever got access to my email must have deleted the emails.
All the emails are in Trash. So, it is clear that my email was compromised.

 

[Walter White]

I randomly started getting SMSs regarding OTPs and transaction alerts. As I was already asleep, I did not bother. But, my wife checked it and to our horror, we were getting OTPs for random transactions on Flipkart, and all of them were getting successful. I immediately disabled online transactions on my card. Just then, I started getting OTPs on my RBL card. By the time I was able to disable transactions on my RBL card, another transaction went through successfully. I am confused and unable to understand how this can happen. How can someone hack the OTPs on my phone? Please let me know what I should do now.

Start taking more proactive steps to keep your cards secure even it makes you more paranoid. If you use your cards on dodgy sites, change your cards every 1-1.5 years.

 

[Rkr]

Now that I see it, my email inbox does not have OTPs for any of the Axis or RBL emails. So, I guess whoever got access to my email must have deleted the emails.
All the emails are in Trash. So, it is clear that my email was compromised.

Always set 2 factor authentication for Email/Gmail...even if your password is compromised second option of validation is still there..

 

[Predator]

Unfortunately, I am not in India. I called up Axis customer support and they have registered my complaint. They say they will transfer it to their respective team who will verify if the transactions are fraudulent and they will provide a resolution in 120 days! This has to be a joke!

Complaint can be registered online. I suggest you to file complaint on Cyber Crime Portal.
As OTPs are shared due to your fault. Banks don't have any liability here, so don't depend upon Bank alone.

If the amount is significant, ask Flipkart and all the merchants to share details of the account used for transactions along with IP address. If you attach copy of FIR, then they will share these details easily

 

[moriarty]

Almost all apps require SMS permission nowadays. Can it be mischief from any of the apps installed on the phone?

 

[beingmohit]

Complaint can be registered online. I suggest you to file complaint on Cyber Crime Portal.
As OTPs are shared due to your fault. Banks don't have any liability here, so don't depend upon Bank alone.

If the amount is significant, ask Flipkart and all the merchants to share details of the account used for transactions along with IP address. If you attach copy of FIR, then they will share these details easily

The cybercrime portal does not even open outside India!
These people got access to my Flipkart account and made all these transactions. So, I guess I am screwed here. Let me try to reach out to Flipkart Support.

 

[beingmohit]

I

Always set 2 factor authentication for Email/Gmail...even if your password is compromised second option of validation is still there..

I already have that enabled. I have no idea what went wrong here