The complaints we read follow a rhythm. Somebody registers on a gaming platform in the evening. Before they have finished looking around, the phone rings. The caller already knows their name and the platform they just joined, speaks with the slightly bored efficiency of someone doing a job, and explains that a verification code has been sent in error and needs to be read back so the account can be released.
By the following morning the account belongs to somebody else.
What makes this worth writing about is not that it happens. It is how reliably the timing holds. Not an hour later, not the next day. Minutes. Once you understand why it has to be minutes, the whole thing stops looking like bad luck and starts looking like what it is, which is a process with a deadline.
The deadline belongs to them, not to you
A one-time password expires. Depending on the platform it might last five minutes or ten, occasionally thirty. That window is the entire opportunity. Someone who has your number and is attempting to open or take over an account has to get the code out of you inside it, which is why the call arrives while you are still holding the phone and still half expecting a message from the service you just signed up to.
The urgency in the caller’s voice is not performance for its own sake. There is a real clock running, and it belongs to them. Everything about the script is shaped by it: the immediate reason, the pressure to act now, the refusal to let you hang up and call back. Nobody doing this has the luxury of patience.
Which gives you an unusually clean rule. Anything that cannot survive you saying “I will call you back on the number published on the website” is not legitimate. Real support can wait ten minutes. This cannot.
How they knew you had just registered
This is the part that unsettles people most, and the explanations are duller than the fear suggests. There are three common routes and none of them requires anyone to have hacked anything.
The first is that the registration never happened on the platform at all. A lookalike domain collects the number and password, and the person running it uses them immediately, because stolen credentials have a short shelf life. In this version the call is not an attack on your account. It is the account being opened, with you supplying the code.
The second is a leaked list. Numbers gathered from an unrelated breach get dialled in bulk against a platform’s login page, and the call follows an automated attempt that has already triggered a code on your handset. The caller does not know you registered. They are guessing, and the guess happens to land because you did.
The third is the least interesting and the most common: the number was passed on. Referral groups, aggregator sites and chat channels collect phone numbers in exchange for codes and offers, and those lists move around.
Where the clone problem actually begins
Of those three, the first is the one you can do something about, and the window for doing it closes before you type anything.
A copied registration page costs an afternoon to build and a few hundred rupees to host. It will look correct, because it was copied from something correct. It will have a padlock in the address bar, because certificates are free and automatic and a fake site has one within minutes of going live. The padlock tells you the connection is encrypted. It tells you nothing whatsoever about who is on the other end, and the number of people who believe otherwise is the reason the technique still works.
The only defence is boring. Type the address yourself rather than tapping a forwarded link. If the platform is BDG game register, then that string of characters, typed by hand and read back once before you press enter, is the thing you are trusting. Anything that differs by a doubled letter or a swapped pair is a different website run by different people, and it does not matter how familiar the page behind it looks.
Search advertisements deserve a specific warning here. Paid placements sit above organic results, they can be bought against a brand name by anybody, and on a phone the small “Sponsored” label is easy to miss entirely. More than one complaint we have seen began with somebody searching for a platform by name and tapping the first thing they saw.
What the code is actually worth
People hand over one-time passwords because the code feels like a formality rather than a credential. It arrives unprompted, it expires on its own, it is six digits that mean nothing. Compared with a password it feels like small change.
It is the opposite. For the few minutes it is alive, that code is worth more than the password, because it is the thing that proves possession of the handset. Support staff never need it, cannot use it, and have access to the account record without it. There is no circumstance in which a legitimate employee of any platform asks you to read one aloud. Not for a bonus, not for a refund, not to fix an error on their side.
If you take one sentence from this page, that is the sentence.
If you already gave it to them
Most people realise within a minute of hanging up. That minute is worth a great deal, because accounts in this situation are emptied quickly rather than quietly.
Change the password from a device you trust, not the one you were just talking on if there is any chance something was installed on it. Remove any saved payment method. Look for a sessions or devices screen and end everything except the one you are on, and do that before the password change rather than after, so the change does not happen while somebody else is still logged in. Then take screenshots of the account page, the transaction list and the call log.
The screenshots are the step everyone skips. A complaint raised six weeks later is settled on what you can produce, and account pages change in the meantime. A handful of images taken on the day costs nothing and is frequently the whole difference.
Where money has actually moved, your bank is the party with the power to act, and the same day matters more than the same week. Raise it with them directly, keep the reference number they give you, and do not let it sit over a weekend. We have written separately about the OTP scripts themselves, including the variants that arrive as messages rather than calls.
A note on how this reads from the inside
Written down, the whole thing looks obvious. Of course you would not read a code to a stranger. The people it happens to are not careless, though, and almost all of them could have recited that rule beforehand.
What defeats them is context. The call arrives at the exact moment a call would make sense, from someone who knows what you just did, about a thing you were already half expecting. The rule and the moment do not meet. Which is why the useful habit is not knowing the rule but deciding in advance what you will do when the phone rings, so the decision is already made by the time it does.