Roman Agabaev of fintech company Paygine has warned that fraudsters are using a short phone command to convince victims their handsets are being tapped.
Speaking to Russian news outlet Lenta.ru, the fraud prevention specialist explained that criminals instruct mobile users to dial the five-character sequence *#62#. The code triggers an automated operator message showing an unfamiliar phone number, which callers falsely claim belongs to an eavesdropper or hacker.
In reality, Agabaev said the command is a standard telecommunications function designed to display call forwarding settings when a handset is unavailable, such as when it is powered off or outside network reception. Cellular providers routinely redirect incoming calls in those situations to automated voicemail platforms or missed call alert systems, and the number displayed on the screen is typically a standard carrier routing number rather than a surveillance device.
How the system command works
The sequence is part of the Unstructured Supplementary Service Data protocol, commonly known as USSD. Mobile network operators have long used these short numerical codes, framed by asterisks and hash symbols, to allow handsets to query cellular network infrastructure directly without using internet data.
Agabaev stressed that dialing the code does not reveal whether anyone has gained access to a handset or read private correspondence. Instead, criminals rely on technical information that average smartphone owners find difficult to interpret, exploiting normal telecom data to manufacture synthetic evidence of a security breach.
The danger does not come from entering the command itself, Agabaev noted. Real financial harm begins when victims succumb to the caller's instructions and share one-time confirmation codes, enter login credentials on fake websites, download unfamiliar applications, or grant third parties remote access to their devices. Such actions expose both personal mobile banking applications and government portal accounts to takeover.
Psychological pressure and fake officials
Agabaev identified artificial urgency as the primary manipulation tactic in the scheme. Fraudsters systematically attempt to make targets feel that their savings are in immediate jeopardy and that hesitation will cause total financial ruin.
According to the security specialist, scammers typically begin by displaying the manufactured proof of an intrusion. They then escalate the tension by claiming that an unauthorized individual has obtained a power of attorney over the victim's bank accounts or is attempting to drain their balances.
To reinforce the deception, the original caller frequently transfers the victim to accomplices posing as senior bank security personnel or law enforcement detectives. Agabaev warned that warning signs include aggressive demands to keep the call secret, strict instructions not to contact the bank independently, and persistent pressure to install remote software or transfer funds immediately.
Any scenario where an unknown caller frightens a person with catastrophic financial consequences while simultaneously presenting a single, exclusive method to protect their savings is almost certainly a fraudulent operation, Agabaev said.
Steps for affected device owners
For individuals who have dialed the code but taken no further action, Agabaev gave reassurance that their handsets remain completely secure. Users can examine their handset settings directly or contact their mobile carrier to verify that the forwarding number belongs to an official voicemail repository.
The situation changes drastically if a user has followed further instructions from a suspicious caller. Anyone who has clicked external web links, installed software, shared authentication codes, or enabled remote screen sharing must act immediately to contain the damage.
Agabaev advised victims in that position to call their bank immediately using official telephone numbers published on cards or verified websites. Customers should review recent transactions, ask the institution to block or restrict account access, audit active online banking sessions, and inspect their devices for unfamiliar software. Any passwords and security codes should be reset from a separate, secure handset or computer.
He also dismissed the common scam claim of secure reserve accounts, emphasizing that no financial institution operates dedicated safe vaults into which customers must transfer their savings over the telephone. Furthermore, he noted that a caller possessing a victim's personal identification details proves nothing, as such information is widely circulating on underground forums following corporate data breaches.
Money mule operations and recruitment
The warning follows earlier disclosures by Agabaev regarding how organized cybercrime syndicates operate illicit networks of money mules, known in the financial sector as droppers. Criminal rings rely on these intermediaries to move and launder stolen money through the formal banking system.
Agabaev pointed out that criminal networks increasingly require mules to carry out routine retail purchases using compromised payment cards rather than relying solely on direct peer-to-peer wire transfers. Combining ordinary shop transactions with illicit money movements helps syndicates evade automated anti-fraud monitoring systems that flag rapid withdrawals or unusual payment volumes.
Recruitment into these illegal networks typically begins with online advertisements promising effortless income, Agabaev noted. Organizers entice individuals by asking them to receive transfers, make store purchases with a provided card, register fresh bank accounts, or process commercial payments in exchange for a modest commission. He warned that participants in such schemes face severe legal consequences as financial institutions and law enforcement agencies step up enforcement against illicit money flows.
