Three men have been sentenced for operating a website that helped criminals evade banking anti-fraud measures.
A National Crime Agency (NCA) investigation revealed that the website www.OTP.Agency (one-time passcode) was managed by Callum Picari, 23, from Hornchurch, Essex; Vijayasidhurshan Vijayanathan, 21, from Aylesbury, Buckinghamshire; and Aza Siddeeque, 19, from Milton Keynes, Buckinghamshire.
The site charged criminals a monthly subscription fee to access personal bank accounts and other online accounts for the purposes of account takeover and fraud. A basic package priced at £30 a week provided access to an OTP.Agency spoof call bot, which was designed to deceive victims into revealing genuine one-time passcodes for their online accounts. This allowed criminals to bypass multifactor authentication on banking and telecom platforms, thereby gaining access to accounts and executing fraudulent transactions.
An elite plan, costing £380 per month, included a customized ‘free text to speech’ service, enabling criminals to create any message they wanted for the automated calls. Additionally, pre-scripted phone calls targeting customers were developed by Picari, Vijayanathan, and Siddeeque. Law enforcement recovered scripts for impersonation calls pretending to be from companies like BT, Sky, Virgin Media, HMRC, Mastercard, and Visa.
According to the NCA, over 12,500 members of the public were targeted, receiving more than 65,000 spoof calls from September 2019 to March 2021, when the operation was shut down following the trio’s arrests.
While it’s unknown how much money the group generated, estimates suggest profits could have reached around £90,000 if 3,000 subscribers opted for the basic plan, and up to £7.9 million if they consistently chose the elite package.
In January 2023, the men were charged with conspiracy to make and supply articles for use in fraudulent activities. Picari faced additional charges of money laundering. Initially denying involvement in any crime, they later pled guilty at Snaresbrook Crown Court, with Siddeeque being the last to do so in August of the previous year.
Ring-leader Picari received a sentence of two years and eight months in prison. Vijayanathan and Siddeeque were sentenced to 12-month community orders and required to pay £760 in costs each. Additionally, they were mandated to complete 200 hours and 160 hours of community service, respectively.
Tim Court, a senior manager from the NCA’s National Cyber Crime Unit, commented, “As this case shows, the NCA is equipped to disrupt and dismantle websites like www.OTP.Agency that pose risks to the public and to hold those accountable.” He also cautioned online banking users to remain vigilant.