MeitY’s Indian Computer Emergency Response Team directed internet service providers to block 1,240 spear-phishing domains that mimicked Employees’ Provident Fund Organisation one-time-password flows, according to an advisory issued early Wednesday. The campaign used SMS lures in Hindi and English urging salaried workers to “verify” unified portal accounts before a fictitious deadline, then harvested Aadhaar-linked mobile numbers on look-alike sites.
How the lure worked
Researchers at a Bengaluru threat-intelligence firm said the domains rotated every few hours, using typosquatted strings that replaced vowels in official EPFO hostnames. Victims who entered OTPs triggered automated unified payments interface collect requests to mule accounts, often for amounts below ₹10,000 to evade bank friction checks.
CERT-In’s order requires ISPs to sinkhole the domains and preserve logs for law enforcement. The agency also asked large enterprises to filter outbound DNS queries to the listed hosts after several IT help desks reported employees clicking links on corporate phones.
EPFO and employer response
EPFO headquarters in New Delhi reiterated that it never requests OTPs over SMS and urged members to use only the unified portal or the Umang app. Payroll outsourcers circulated template emails to clients reminding human-resources teams to flag suspicious messages during October salary runs.
What comes next
Telecom operators must report compliance within 48 hours. CERT-In said a second list is pending once registrar data confirms additional fast-flux hosts. Cyber police in Gurugram and Hyderabad have opened cases tied to at least ₹2.1 crore in reported losses, though investigators say the true figure is higher because many victims do not file complaints.
For account holders, the practical defence remains boring: type epfindia.gov.in manually, ignore urgency language, and report numbers to the national cybercrime helpline. The blocking order buys time, but registrars outside India can spin up replacements within hours—making employee awareness as important as ISP filters.
Enterprise playbooks
Large IT services firms added EPFO-themed phishing templates to internal simulation drills after help desks saw a spike in tickets from employees who clicked SMS links on company phones. Human-resources teams now send payslip notifications only through authenticated apps, reducing the chance that a fake OTP message looks plausible.
Domain registrars outside India hosted a majority of the sinkholed URLs, renewing calls for faster cross-border takedowns. CERT-In’s advisory includes WHOIS fingerprints so banks can block transactions to newly registered look-alikes before the next blocking tranche.
Unified payments interface participants said they are tightening collect-request limits for new merchants during October salary week, when mule accounts historically activate. The combination of ISP blocks and payment friction is meant to shrink the window fraudsters have between launching a domain and cashing out.
Member education
EPFO regional offices in Chennai and Bengaluru scheduled campus-style awareness sessions for employer payroll teams, showing side-by-side screenshots of real versus fake login pages. Unions asked factories to display helpline numbers on shop floors where workers without smartphones might rely on colleagues to complete OTP steps.