Key Takeaways:
- Scammers trick victims into dialing codes like *401# to activate forwarding
- Fraudsters intercept calls to hack OTPs, PINs, and hijack accounts
- Dial ##004# or check phone settings regularly to deactivate forwarding
- Never dial unknown codes from unsolicited callers claiming account issues
- Scam warning signs include calls going to voicemail and unexplained phone charges
Call forwarding scams are an increasingly common form of fraud that compromise financial security and personal privacy. By exploiting a safe and legitimate phone service feature, scammers can intercept incoming calls, steal one-time passwords (OTPs), and even hijack WhatsApp accounts.
Robocalls are the most common form of call forwarding phone scam, and victims lost an average of $3,690 per incident in the first half of 2025, as reported by PIRG.
How Legitimate Call Forwarding Works for Your Phone Number
Call forwarding itself is a legitimate phone service that allows you to redirect incoming calls to another phone number. It can be helpful in various situations, such as when you’re unavailable to answer. You can forward calls to voicemail, a colleague’s phone, or your mobile phone number when you’re in a meeting or on vacation.
There are two types of call forwarding, unconditional and conditional:
Unconditional call forwarding forwards all calls, regardless of your availability. It’s useful when you have a temporary work number or are traveling internationally.
Conditional call forwarding allows you to set specific conditions for call forwarding, such as forwarding calls when your phone is busy, unanswered, or out of range.
How Scammers Execute Call Forwarding Scams
Call forwarding scams involve tricking individuals into unwittingly forwarding their incoming calls to a phone number controlled by scammers. Once the call forwarding is in place, scammers can intercept important calls and messages intended for the victim, enabling them to carry out various fraudulent activities.
Here are the common approaches scammers use:
1. Initiating Contact to Steal Personal Information
First, the scammer initiates contact with the victim using various channels to compromise their personal information:
Phone Calls, Texts, Emails, Social Media (SMS Phishing or “smishing”): This is the most common approach, where scammers pose as fake customer service representatives or use social engineering tactics to create a sense of urgency or trust.
Many call forwarding scams begin with a fake delivery text. In 2024, text-based scams alone accounted for $470 million in reported losses, a five-fold increase since 2020, per the FTC.
In-Person Contact: Scammers may also approach victims in public places like markets or bus stops, feigning an emergency situation. They might claim someone close is in the hospital, their phone was stolen, or they’ve lost contact with someone and urgently need to make a call.
2. Creating Urgency
Regardless of the approach, the scammer will try to make the victim feel rushed and worried.
They might say:
- Their bank account is in danger.
- Their phone has a problem.
- They need to verify their identity for a bogus “special offer.”
- A loved one is in trouble and they need to make an urgent call (for the in-person approach).
3. Gaining Access to Your Phone (In-Person Approach)
When approaching you in public, the scammer might:
- Ask to borrow your phone to make a quick call due to their supposed emergency.
- Offer to “help” you make the call while subtly enabling call forwarding on your device.
4. How Scammers Enable Call Forwarding
Once urgency is established, the scammer will instruct the victim to dial a carrier-specific code, typically commencing with something like *401# and then the scammer’s number to initiate call forwarding activation. The scammer may offer deceptive instructions or false explanations to rationalize this action, deceiving the victim into unwittingly enabling the scam.
5. Rerouting Calls to Access Financial Accounts
After activating call forwarding (whether through remote instructions or physical access to the phone), all calls intended for the victim’s phone are rerouted to the scammer’s phone number. This includes calls from critical institutions such as banks and credit card companies. The victim’s communication is effectively intercepted, putting sensitive personal information at risk of unauthorized access and potential misuse by the scammer.
6. Intercepting Personal Information & OTPs
Having successfully rerouted calls, the scammer intercepts sensitive personal information by posing as the victim. This deceptive tactic allows them to acquire confidential details such as bank account numbers, PINs, and security codes during interactions with callers. The victim’s vulnerability is exploited as the scammer gains unauthorized access to valuable information and user accounts.
Identifying Scammers & Call Forwarding Schemes
While becoming increasingly sophisticated, there are still signs of suspicious activity to watch out for:
Service Disruptions: Experiencing unusual call behavior like incoming calls going straight to voicemail or delayed connections.
Unexplained Charges: A sudden spike in your phone bill, especially with international or premium-rate calls you didn’t make.
Request a Demo: See how Bolster stops these scams in real-time.
Unfamiliar Numbers: Numbers you don’t recognize appearing on your call log.
Missed Calls: People reporting they couldn’t reach your phone number despite their calls showing as connected on their end.
USSD Code: Code *#21#, when dialed upon, initiates the USSD (Unstructured Supplementary Service Data) code that reveals all the information (Enabled or Disabled) about your device’s call forwarding settings.
Protecting Accounts & Preventing Call Forwarding Scams
Be Wary of Unsolicited Requests: Never share personal information or financial details over the phone, even if the caller seems legitimate, as legitimate institutions won’t ask for such details through phone calls.
Verify Contact: If contacted about a potential bank account issue, hang up! Contact the organization directly using their official contact information found on their website or a trusted source.
Never Dial Unknown Codes: Scammers may instruct you to dial specific codes to “fix” a problem. Never dial codes provided by unknown callers.
Review Call Forwarding Settings Regularly: Familiarize yourself with how to deactivate call forwarding on your phone. Check your settings periodically to ensure it’s not enabled without your knowledge.
Deactivating Call Forwarding to Secure Accounts
NOTE: Instructions may vary slightly by device/carrier
General: On most GSM networks, ##002# cancels all call forwarding and ##21# cancels unconditional forwarding only. ##004# clears conditional forwarding, but on many carriers it also disables voicemail routing, so check with your provider first. To check status before changing anything, dial *#21#. Verizon and some other US carriers use their own codes, such as *73. Consult your phone’s manual or carrier’s website for specific instructions.
Android: Open the Phone app > Settings (three dots) > Call Settings > Call Forwarding and disable the desired forwarding options.
iPhone: Go to Settings > Phone > Call Forwarding and toggle it off.
Call forwarding is useful, but in the wrong hands it becomes a dangerous tool for fraud. By recognizing the signs of call forwarding scams and regularly checking your phone’s settings, you can reduce the risk of losing money or control of your accounts.
Stay cautious, and treat any unsolicited request to dial a code or change your call settings as a red flag.
Protecting Business & Personal Accounts from Call Forwarding Hacks
Understanding how modern scammers abuse telecom features is crucial for protecting sensitive personal information and enterprise security. When cybercriminals redirect incoming calls away from your primary phone number, they bypass traditional two-factor authentication (2FA) protocols. Voice-based verification codes, often used by bank portals, email providers, and social networks, are silently routed to unauthorized numbers.
For enterprise teams, a compromised executive phone number rarely stands alone. It usually sits alongside lookalike domains, spoofed profiles, and phishing pages built to use the access it provides. Organizations should implement mobile security policies, monitor for suspicious activity on carrier portals, and ensure employees receive continuous security training on telephone social engineering tactics.
If a call or text like this arrived with a link, you can scan it for free with CheckPhish to check whether it points to a known phishing or scam site.
