The Telangana Cyber Security Bureau has registered a case against three telemarketing companies for allegedly misusing the SMS headers and identities of companies, in a matter that also disrupted genuine one-time passwords and transactional alerts. The case was registered on Friday, and an investigation is under way.

According to the complaint, the accused companies allegedly exploited the Distributed Ledger Technology system used to regulate commercial SMSes so that the messages appeared to come from a legitimate chain. The DLT framework is used to manage commercial communication identities and routes, including the sender headers that help recipients and service providers identify messages from registered entities.

The charges

The bureau registered the case under sections 318(4), relating to cheating, and 319(2), relating to cheating by personation, of the Bharatiya Nyaya Sanhita. Police also invoked sections 43, 66, 66C and 66D of the Information Technology Act. The provisions cover alleged unauthorised access or damage involving computer systems, computer-related offences, identity theft and cheating by personation using a computer resource. The charges are based on the complaint and remain subject to investigation.

How OTPs were hit

The alleged misuse had consequences beyond the fraudulent messages themselves. The complainant said repeated blacklisting of the clients’ headers disrupted genuine OTPs and transactional alerts to investors, such as messages used for account access, transaction confirmation and other time-sensitive financial communication. The complaint does not establish how many users or messages were affected, and the extent of any financial loss was not specified.

What the investigation will focus on

A bureau investigator said the agency would seek details of the alleged fraudulent activities from the complainant and other concerned entities to identify the accused. The next stage of the investigation will focus on the message-delivery chain and the role of the three telemarketing companies in the alleged misuse.

The case comes amid a broader regulatory push against spam and SMS fraud. The Telecom Regulatory Authority of India has tightened its framework this year, with rules targeting the misuse of SMS headers and message templates. Under the amended regulations, if a registered header or content template is misused, the originating telecom provider must suspend it within six hours of becoming aware of the misuse, and a telemarketer found responsible can have its telecom resources disconnected across providers.