Hacking is not breaking the lock. It is tricking you into opening the door.
Most hacking never touches your computer. The thief does not break the lock. He convinces you, and you open the door yourself. OTP fraud, digital arrest, the UPI trap. One rule.
11:43 AM. Phone buzzes.
A phone in an older woman's hand. One SMS on the screen. The name is correct. The bank logo is correct.
"SBI ALERT: Your KYC will expire in 2 hours. Share the OTP sent to your number to keep your account active."
When you hear the word hacking, what do you picture?
Black hoodie. Green code. Someone typing fast in a dark room. Is that what comes to mind?
"If I got hacked, it means some skilled person cracked my password and broke into my account."That is what most people picture. Getting hacked means someone broke through your defences.
The truth? Most hacking does not touch your computer at all. That SMS that reached your mother, the one about KYC expiring, that is the hack. It already happened.
The thief did not break the lock. He rang the bell. He wore a uniform. You opened the door yourself.
"By the time this episode ends, you and everyone in your home need to know just one rule."Once you know it, you will never forget it.
The thief who rang the bell
Your apartment has a good door. A strong lock. A watchman downstairs. A thief has only two ways in.
Way 1: Break the lock, force the door, push inside. Hard. Takes time. Makes noise. The watchman will see him.
Way 2: Put on a delivery uniform, ring the bell, say "Parcel delivery, sir, please sign here." You open the door yourself.
He did not break anything. He needed one thing only. Your trust. Your panic.
Social Engineering. "Social" = it works through people. "Engineering" = it was deliberately designed.
Someone sat down, thought it through, and built a system to make you trust them. That is social engineering. They hack the human, not the machine.
OTP Fraud
The phone rings. A calm, professional voice.
"Naan State Bank of India-la irunthu pesaren. Ungal account-oda KYC update pending. Inniki 6 PM-ku account freeze aagidum."I am calling from State Bank of India. Your account's KYC is pending. Your account will freeze by 6 PM today.
"It will freeze." Just hearing those words, what happens in our heads? Panic. Salary will not come, bills will not clear, no cash from the ATM.
Now the voice says: "Don't worry. I will update it for you right now. Just tell me the OTP that comes to your phone." The OTP arrives. Because the bank system really did send it. That part is true.
The OTP arrived. It really came from the bank. But the person asking for it is not from the bank.
A real bank will never ask for your OTP. Not now. Not ever.
The OTP is the lock. The bank already has the key. They do not need to ask you for it. If anyone asks for an OTP, the call is over. Put the phone down. No explanation needed.
Digital Arrest
In 2024 a new scam spread across India. "Digital arrest."
A WhatsApp or Skype video call. A khaki shirt on the screen. A police-station-style background. Documents on the desk.
"You are involved in a money laundering case. Your Aadhaar was used in an illegal transaction. The CBI is investigating. You are now under digital arrest. Keep the camera on. Do not move."A fake officer, a fake case, a real victim frozen in fear.
Real police never arrest anyone over a video call. Not the CBI. Not the ED. No one.
If the police need to take you somewhere, they come to your door. With a warrant. In person. "Cut the call. Block the number. Call 1930."
Is that all? No.
Here comes the important part.
We saw two scams. Both use the same weapon. Panic.
- Social engineering = hacking the person.
- The person asking for your OTP is not from the bank.
- There is no arrest over a video call.
Make someone feel that something terrible will happen in the next five minutes, and the brain stops asking questions. Let us look at one more scam. Then we will build your defence.
The Jumped Deposit (UPI trap)
This one is clever. Because the scammer starts by giving you money.
Rs 5,000 lands in your account. Unexpected. You did not sell anything. Nobody said they were sending money. Curiosity kicks in. You open your UPI app to check the balance.
Here is what actually happened. The scammer sent you Rs 5,000. At the same time, he sent you a payment request asking you to approve Rs 48,000 back to him. When you enter your PIN to check the balance, UPI processes that pending request. You approved it without even reading it.
TN Police say: if you see an unexpected deposit, wait 15 to 30 minutes. The UPI request will expire. Or report it to the bank.The deposit is bait. The real move is the request riding behind it.
The Call Forwarding Trap. Very few people know about this one.
This one is smarter than the other three. Because this time they do not ask for your OTP at all. You open the door for them yourself, without knowing it.
The phone rings. A calm, helpful-sounding voice.
"Sir, ungal SIM-la oru technical problem. Inniki raathiri ungal number permanent-ah deactivate aagidum. Fix panna romba easy. Naan sollra code-ah mattum dial pannunga. Star, four, zero, one, star, then a number."Sir, there is a technical problem with your SIM. Tonight your number will be permanently deactivated. Fixing it is very easy. Just dial the code I give you. Star, four, zero, one, star, then a number.
Who would not be scared of their number getting deactivated? You dial the code they gave you. A small beep. The call cuts. On the surface, nothing seems to have happened.
That code (star 401 star, then their number) silently turned on call forwarding on your phone. From now on, every call that comes to your phone goes straight to the scammer.
Why is this so dangerous? Not every OTP comes by SMS, some come as a call. The bank calls to verify your account. They call for account recovery. None of those calls ring on your phone. They ring on his. Even with the phone in your hand, your number is already in his.
If anyone on a call says "dial this code," that itself is the scam.
Neither the bank nor the SIM company will ever ask you to dial a code, at any time.
The one rule you must never forget
Four scams. Four different emotions. But one foundation.
Fear of an account freeze. Fear of arrest. Curiosity about unexpected money. Fear of the SIM being deactivated. Each one manufactures an emergency, to push you into a hurried action. But the defence is the same for all of them.
When panic comes, do not trust it.
If it is real, put the phone down.
Call back the official number yourself.
Never dial a code anyone tells you to dial.
Put the phone down. Find the official number yourself. The SBI number is on the back of your ATM card. The cyber crime helpline is 1930. You call them. Not the number the scammer gave you.
The SBI scam spread through WhatsApp groups, hijacked accounts of people your family already trusts. Your brother's WhatsApp sent that link. He had no idea. His phone was already compromised.
In a family, it is not enough for one person to know. Everyone has to know.
One single mental model
Every social engineering attack has the same structure.
- Step 1: They trigger an emotion. Fear, urgency, or curiosity.
- Step 2: They pressure you, saying there is no time.
- Step 3: They ask for one small action (OTP, link, payment).
What is the defence? Stop step 2. Slow down. That is the difference between a trained engineer and a first-time victim. Not intelligence. Not technology. Just one habit.
When something feels urgent and high-stakes, slow down precisely because it feels urgent.
A real emergency, your actual bank, the EB, the government, will still be there in the 10 minutes it takes you to call back. A scam cannot survive a 10-minute pause.
This is for anyone who works in IT too
India lost over Rs 11,000 crore to online fraud in 2024. Most of it. Not weak passwords. Someone panicked.
This matters for anyone who thinks they are careful and security-aware.
Your mother is not less intelligent than you. This scam attacks emotion. Not IQ. The most senior security engineer at any company can get this same call on a bad day and feel that same panic.
Not a technology problem. A human problem. That is why we call it social engineering. The machine is fine. The target is the human.
Let me talk to you for a minute
I am Avinash. I work in cloud infrastructure and security.
For years I have built systems to protect data for companies. And I have watched those same companies get social-engineered. Because we do not train people the way we train machines.
I started Unnal Mudiyum because most tech content either talks down to you, or goes over your head. This channel does neither.
Cloud, AI, security, leadership, the real stuff of working in IT. Explained for a ten-year-old, useful for a senior engineer.
If this episode makes one thing click for you, and you share it with your father or mother, that is the whole reason this channel exists. Subscribe.
Which scene was unclear? What surprised you?
Pick whichever channel works for you. I read every reply personally. If you spot a typo or a factual error, email is the fastest way to fix it.
The other half of hacking, the technical side. How does software actually get broken?
Same burglar-at-the-door frame. But now we open the door and look at the machine inside.