
So besides hacking them, cyber criminals can also hire these services. Such services can be hired by businesses for US$16 (S$21) in the United States to redirect SMSes, business news outlet Business Today reported. One such technology that can be hacked is that used for text-messaging management services. Mr Eric Nagel, general manager for the Asia-Pacific at cyber-security firm Cybereason, said SMS OTPs rely on third-party technology on an operating system that is not immune to sophisticated attacks.

It is also unclear where the hackers are from.

Investigations are ongoing to identify the criminals and bring them to justice. The compromised overseas telecommunication networks have been identified and notified, but the agencies did not reveal who they were or where they were from. This matches with the victims saying they did not get the OTPs. The stolen OTPs were then used to complete the fraudulent card payments. So when the banks sent out SMS OTPs to the victims to verify the transactions, the crooks were able to divert these text messages to the overseas mobile network systems.
