Three teenagers deceived the system and earned $10 million: the story of OTP Agency

[Friend]

The young people will now be held accountable for creating the scam of the century in court.

Three teenagers pleaded guilty to creating and managing the OTP Agency service, which helped criminals bypass bank fraud protection systems.

During the investigation of the British intelligence services (NCA), it was found that the site www[.] OTP. The agency was run by three young people from the UK: 22-year-old Callum Piquari, 21-year-old Vayasidhurshan Viyayanathan and 19-year-old Aza Siddiq.

Criminals using OTP Agency paid a monthly subscription to access the service, which allowed them to manipulate bank account holders into revealing one-time passwords and other personal information. The basic package cost £30 a week and bypassed multi-factor authentication on HSBC, Monzo and Lloyds, making it easier to conduct fraudulent transactions. A more advanced package, costing £380 per week, provided access to Visa and Mastercard verification sites.

The use of such services gave criminals the opportunity to penetrate personal bank accounts and steal money. According to the investigation, from September 2019 until the arrest of the attackers in March 2021, more than 12,500 people were affected. The site was shut down in March 2021 after the arrest of three suspects.

Although the exact amount earned by the group remains unknown, calculations show that if users purchased only the basic package, the revenue could be around £30,000, and if the elite package was chosen, up to £7.9 million (more than $10.3 million).

The site was actively promoted by Callum Picari through a Telegram group with more than 2200 members. In one of his posts, Picari stated that the service is the first and last professional solution for obtaining one-time passwords, promising a profit within minutes after purchasing the service. When an article was published on the Krebs on Security website in February 2021, it caused panic among the group members, which led to the deletion of the chat and an attempt to hide the traces of their activities.

All three were charged with conspiracy to manufacture and distribute tools for fraud, as well as money laundering. Initially, the teenagers denied their involvement in criminal activities, but later pleaded guilty. Aza Siddique was the latest to plead guilty this week. Sentencing in the case is scheduled for November 2, 2024 at Sneysbrook Royal Court.

The NCA stressed that the actions of Piquari, Viyayanathan and Siddique opened the way for fraudsters to access bank accounts and steal money from unsuspecting citizens. The agency also urged everyone who uses online banking to be vigilant and not to transfer personal information without verification.

Source