Hornchurch website operator admits to helping scammers

Callum Picari, 22, from Hornchurch, Vijayasidhurshan Vijayanathan, 21, from Aylesbury, and Aza Siddeeque, 19, from Milton Keynes operated the illegal website www.OTP.Agency.

The National Crime Agency (NCA) has found that criminals were charged a monthly subscription fee to help them use social engineering to trick bank account holders into revealing real one-time passwords or other personal information.

A basic package costing £30 a week allowed multi-factor authentication to be bypassed on platforms such as HSBC, Monzo and Lloyds, allowing criminals to make fraudulent online transactions.

Callum Picari from Hornchurch was the owner, developer and main beneficiary of the website (Image: NCA)

An Elite plan cost £380 per week and gave access to Visa and Mastercard verification pages.

These schemes allowed criminals to access personal bank accounts and steal money.

NCA cyber investigators began investigating the website in June 2020 and believe more than 12,500 citizens were targeted between September 2019 and March 2021, when the site was taken offline following the trio’s arrest.

The organisation said it was not known how much money the group made from the scheme, but estimated it would have been around £30,000 if users had bought the basic package and up to £7.9 million if they had opted for the elite package.

Aza Siddeeque promoted the illegal website and offered technical support to the criminals who subscribed. (Image: NCA)

Siddeeque promoted the website and offered technical support to criminal customers.

Picari was the owner, developer and main beneficiary of the service and promoted the service in a Telegram group with over 2,200 members. In October 2019, he posted a message that read: “First and last professional service for your OTP theft needs. We promise you that you will make profit within minutes of purchasing our service…”

He also said: “Have you ever wanted to get a one-time passcode for any website? Now you can! With OTPAgency you can get a one-time passcode for VBV, over 30 websites and also Apple Pay. It only costs £30 per week and is definitely not to be missed.”

Accomplice Vijayasidhurshan Vijayanathan helped scammers open the door (Image: NCA)

The Telegram group was deleted after a security-related article published by Krebs in February 2021 sparked a panicked exchange of messages between Picari and Vijayanathan.

Picari said: “Brother, we are in big trouble” … “You are going to finish me off” … Brother, delete the chat”

Vijayanathan: “Are you sure?”

Picari: “There is so much evidence in there”

Vijayanathan: “Are you 100% sure?”

Picari: “It’s so distressing” … “Look and look for “fraud” … “Just think of all the evidence” … “we can find” … “in the OTP chat” … “they will find it”

Vijayanathan: “That’s exactly what happens when we just close EVERYTHING”

Picari: “You read our very first message” … “We seem burdensome” … “if we shut down” … “I say delete the chat” … “Our chat is 100% fraud”

Vijayanathan: “Anyone with a brain will tell you to stop here and move on.”

Picari: “Just because we close it doesn’t mean we didn’t do it” … “But deleting our chat” … “That will screw up their investigations” … “There is nothing fraudulent on the site”

The trio was charged with conspiracy to manufacture and supply items for fraudulent purposes.

Picari was also accused of money laundering.

They all initially tried to deny their conscious involvement in criminal acts, but have now all admitted the allegations.

Siddeeque was the latest to plead guilty this week.

All three will be sentenced at Snaresbrook Crown Court on November 2.

Anna Smith, operations manager of the NCA’s National Cyber ​​Crime Unit, said: “Picari, Vijayanathan and Siddeeque have opened the door for fraudsters to access bank accounts and steal money from unsuspecting citizens.

“The trio profited from these serious crimes by operating www.OTP.Agency and their convictions serve as a warning to anyone else offering similar services; the NCA has the ability to disrupt and shut down websites that pose a threat to people’s livelihoods.”

“We also urge everyone who uses online banking services to be vigilant.

“Criminals may pose as a trustworthy person or company when they call, email or message you.

“If you notice anything suspicious or unexpected, such as requests for personal information, contact the organization directly to verify, using the details published on their official website.”