Your OTP Is Not Safe: Bank Account, Gmail, Photos Leak & Safety Tips | Amit Dubey | FO423 Raj Sha...
Executive Summary
Amit Dubey, introduced as a top cyber security expert in India, joins Raj Shamani to explain how everyday digital accounts get compromised. Dubey describes how a simple phone call can lead to an account takeover, how a single OTP can expose a person's whole financial system, what Facebook and Google can track from your phone, how Aadhaar details can be misused, and how SIM and eSIM tricks work in fraud. He shares cases from his own investigations, including how he traced a hack using access logs and device details, why influencer and event invites are used as bait, and how WhatsApp two-step verification protects an account. He also talks about state-level hacking groups and how quantum computing may change future attacks. The episode is mostly in Hindi with English terms. PARTIAL COVERAGE: this summary is built from a sampled reading of the Hindi captions. All claims, figures and cases are the guest's own and not independently verified. Sponsor: ASUS ExpertBook. This is general awareness only, not security, legal or financial advice.
Key Takeaways
One careless click or call can compromise everything
Dubey explains that a simple phone call can be enough to start an account takeover, and that a single careless action can shake even a business foundation.
Fraudsters have a trick to extract OTPs
He argues that people do not simply hand over OTPs: criminals use a script or pretext that makes the victim share the code, and that awareness campaigns often miss how convincing the trick is.
Phone apps can read far more than people realize
Dubey describes how some apps map location and read SMS and financial alerts, and says Facebook and Google collect and log a great deal, such as who downloaded which pictures and when.
Investigators trace hacks through logs and devices
He recounts a case where checking login details and a backup-code file in a laptop downloads folder, plus timing and device access, pointed to the person responsible.
Social engineering often uses credible bait
He gives examples of fake invitations, such as a government-organized influencer event or a gift offer to doctors, where mentioning a familiar name makes the caller seem legitimate.
WhatsApp two-step verification closes a major gap
Dubey says that as long as you never share your six-digit two-step PIN, nobody can get into your WhatsApp even if the OTP or the phone is lost, and the PIN should not be your date of birth.
SIM and eSIM tricks and state-level hackers are bigger threats
He explains how criminals can misuse SIM and eSIM features to send verification messages from your number, and says the most advanced offensive hacking comes from groups linked to countries such as Russia, with China targeting energy, banking and telecom sectors, in his words.
The Conversation Breakdown
One careless click or call can compromise everything
⏱ Untimed topicDubey explains that a simple phone call can be enough to start an account takeover, and that a single careless action can shake even a business foundation.
Fraudsters have a trick to extract OTPs
⏱ Untimed topicHe argues that people do not simply hand over OTPs: criminals use a script or pretext that makes the victim share the code, and that awareness campaigns often miss how convincing the trick is.
Phone apps can read far more than people realize
⏱ Untimed topicDubey describes how some apps map location and read SMS and financial alerts, and says Facebook and Google collect and log a great deal, such as who downloaded which pictures and when.
Investigators trace hacks through logs and devices
⏱ Untimed topicHe recounts a case where checking login details and a backup-code file in a laptop downloads folder, plus timing and device access, pointed to the person responsible.
Social engineering often uses credible bait
⏱ Untimed topicHe gives examples of fake invitations, such as a government-organized influencer event or a gift offer to doctors, where mentioning a familiar name makes the caller seem legitimate.
WhatsApp two-step verification closes a major gap
⏱ Untimed topicDubey says that as long as you never share your six-digit two-step PIN, nobody can get into your WhatsApp even if the OTP or the phone is lost, and the PIN should not be your date of birth.
SIM and eSIM tricks and state-level hackers are bigger threats
⏱ Untimed topicHe explains how criminals can misuse SIM and eSIM features to send verification messages from your number, and says the most advanced offensive hacking comes from groups linked to countries such as Russia, with China targeting energy, banking and telecom sectors, in his words.
Core Frameworks & Ideas
Social engineering
Attackers rely on trust and a believable story, such as a familiar name or an official-looking event, to get someone to share a code or click a link.
Two-step verification
An extra PIN on top of the OTP, so that losing the OTP or the phone does not hand over the account.
Data trail and logs
Platforms keep logs of activity such as downloads and logins, which investigators can query to narrow down who did what.
Actionable Next Steps
- ✓Turn on two-step verification in WhatsApp and every key account, and choose a PIN that is not your birth date.
- ✓Never share an OTP or backup code with anyone who contacts you, whatever story they tell.
- ✓Verify unexpected invitations or gift offers through an official channel before talking further.
- ✓Review which apps can read your SMS and location and remove access you do not need.
Notable Quotes
“OTP never goes like that. There is a trick to getting an OTP. (translated from Hindi)”
“Even if the OTP goes, even if the phone goes, even if anything happens. (translated from Hindi)”
“As long as you have not shared that six-digit code with anyone, nobody can get into your WhatsApp. (translated from Hindi)”
The One Thing to Remember
Digital safety is a necessity, not a luxury: turn on two-step verification with a PIN that is not your birth date, and never treat an OTP request as harmless.