A UK court has sentenced three individuals behind a fraudulent service designed to bypass bank security measures. The trio operated OTP.Agency, a website that enabled cybercriminals to gain unauthorized access to victims’ bank accounts, circumventing standard security protocols.
The National Crime Agency (NCA) identified the masterminds behind the operation as 23-year-old Callum Pickari from Essex, 21-year-old Vijayasidhurshan Vijayanathan from Buckinghamshire, and 19-year-old Aza Siddiq, also from Buckinghamshire.
Criminals using OTP.Agency paid a monthly subscription fee for access to the platform, which allowed them to manipulate bank account holders into revealing one-time passcodes (OTPs) and other sensitive credentials.
- The basic service package, priced at £30 per week, enabled fraudsters to bypass multi-factor authentication (MFA) for major banks, including HSBC, Monzo, and Lloyds, facilitating unauthorized transactions.
- A more advanced tier, costing £380 per week, provided access to Visa and Mastercard verification systems, making it even easier to conduct financial fraud.
Between September 2019 and March 2021, the platform facilitated over 65,000 fraudulent calls, targeting more than 12,500 victims. While the exact financial gains of the perpetrators remain undetermined, estimates suggest their earnings ranged between £90,000 and £7.9 million.
The architect and primary beneficiary of the scheme was Callum Pickari, who aggressively marketed OTP.Agency through a Telegram channel with over 2,200 members, promising “instant profits” to subscribers. Vijayanathan handled website administration, while Siddiq provided technical support to users.
Their operation unraveled following an investigative report by Krebs on Security in February 2021, which exposed the service. In a panic, the trio attempted to erase all digital traces, but their efforts failed to evade law enforcement. By January 2023, they were charged with conspiracy to commit fraud.
On January 27, 2024, Snaresbrook Crown Court handed down sentences to the offenders:
- Callum Pickari was sentenced to two years and eight months in prison.
- Vijayanathan and Siddiq received suspended sentences and were ordered to complete 200 and 160 hours of community service, respectively.
The case highlights the growing threat of cyber-enabled financial fraud and underscores the importance of international cooperation in combating online crime.
