Your phone rings. You pick up. “Is this Priya Sharma?” Yes. “This is HDFC Bank calling about an urgent issue with your account.” The caller knows your full name, your bank, and sometimes even references a recent transaction. You almost believe them — and that’s the point.
The call is a scam. But the information they have is real. So how did they get it?
The call that almost got you
You didn’t give your phone number to these people. You’ve never heard of them. But they know your name, your city, and exactly which bank to mention to sound credible.
This isn’t a lucky guess. It’s a system. Your personal data passed through at least three or four hands — a data breach, a broker, a Telegram channel, a scam operation — before reaching this caller. Each step adds more detail. By the time someone calls you, they often have a profile: name, number, bank, location, sometimes your UPI handle.
The call feels personal. It’s not. It’s automated social engineering running on a database that includes millions of Indians just like you.
Where they got your name
Your phone number and name are already listed on sites you’ve probably never heard of.
JustDial scraped and published contact details for hundreds of millions of Indian numbers as part of their business listings database. Even if you never listed yourself, anyone who listed a business and included a “contact person” — or anyone a business listed as a customer — is potentially in there.
Truecaller’s contact sync model is a bigger source than most people realize. When any of your contacts installs Truecaller and grants contact permissions, your name and number upload to Truecaller’s servers automatically. You never consented. You weren’t even asked. Truecaller now holds data on hundreds of millions of Indian users who never touched the app.
On top of these platforms, breached databases from Jio, Airtel, and Vi (Vodafone Idea) have circulated since at least 2021, though all three operators disputed that the data originated from breaches of their own systems. These breaches included not just names and numbers but sometimes Aadhaar-linked KYC details — which is far more useful for social engineering than a name alone.
The Telegram angle
The pipeline from breach to caller runs through Telegram.
Indian breach data sells openly on Telegram channels — often for as little as ₹500 for 10,000 records. These aren’t sophisticated dark web markets. They’re public or semi-public groups with usernames like “India Database Resellers” where sellers post sample previews and take payment via UPI. (The irony of using UPI to buy stolen UPI data is not lost on anyone.)
A buyer with ₹5,000 can walk away with 100,000 Indian phone numbers, names, and email addresses. Some bundles include bank names, account types, or credit scores pulled from older financial data leaks. The data quality varies — but enough of it is accurate to make the scam economically worthwhile even if only 1 in 500 calls lands.
This is why spam call volumes in India are so high. The input cost is essentially nothing.
Why they know your bank
This is what makes the calls feel credible — and it comes from a specific source.
In 2021, MobiKwik suffered a breach that exposed approximately 100 million KYC records. That’s 100 million Indian users whose names, phone numbers, email addresses, dates of birth, Aadhaar numbers, PAN numbers, and bank account details were extracted from a single fintech platform and put up for sale.
Financial KYC data is sold separately from basic contact data, and at a higher price. A scammer who buys a combined dataset (basic contact info plus financial data) now knows exactly what to say to establish trust on the call. “We’re calling from HDFC about your savings account” hits differently when they have your name, your registered phone number, and your rough financial profile.
The MobiKwik breach is one example. Similar exposures came from BharatPe, Domino’s India (approximately 180 million order records including customer names, phone numbers, and delivery addresses, 2021; some reports claimed card data was included, though researchers who analyzed the dataset found no evidence of card numbers — Domino’s India relies on cash-on-delivery and digital wallets), and a string of insurance and lending platforms. Your financial data is in circulation. The question is who has it.
Why spam filters don’t stop them
You’ve probably noticed that the “Spam Likely” label from your phone or Truecaller doesn’t prevent these calls. There’s a structural reason.
Scam callers routing into India use VoIP services registered outside the country — often through providers in the US, Singapore, or Gulf countries where Indian telecom regulation doesn’t apply. The number appearing on your screen is spoofed; it looks like a local mobile number or a bank’s official line but routes through an international VoIP trunk that TRAI has no jurisdiction over.
TRAI’s Do Not Disturb registry and its Distributed Ledger Technology framework for commercial communications apply to Indian telecom operators. They don’t reach VoIP spoofing infrastructure hosted abroad. The scammers know this. It’s why the call volume hasn’t dropped despite years of regulation.
What actually reduces your exposure
Spam filters are reactive — they label a number after it’s been reported. What actually works is reducing the surface area of your data in the first place.
The most effective step is removing your data from data broker sites. Sites like JustDial, TruePeopleSearch, and dozens of similar platforms allow removal requests, but the process is deliberately slow and scattered. Submitting these manually is possible but tedious. KnytX Shield isn’t live yet; once it launches, it’s built to automate this and watch for re-listing. For a step-by-step guide, see our post on removing your data from the Indian internet.
Beyond removal: stop handing out your real phone number to apps that don’t need it. Food delivery, shopping, and loyalty apps routinely share user contact data with advertising partners — some of whom sell it onward. Use your email address where possible, and use an alias (not your primary email) for signups you’re unsure about.
The scam caller who knows your name got that name from somewhere. The fewer places your name and number appear together, the fewer databases they can buy you from.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.