"First and last professional service for your OTP stealing needs. We promise you will be making profit within minutes of purchasing our service..."

and

"Ever wanted to grab a one time passcode for any website? Well now you can! With OTPAgency you can grab an otp for vbv, 30+ sites and also Apple Pay.. it's only £30 a week you really don't wanna miss out".

Callum Picari, 23, from Hornchurch, Essex; Vijayasidhurshan Vijayanathan, 21, from Aylesbury, Buckinghamshire; and Aza Siddeeque, 19, from Milton Keynes, Buckinghamshire, all towns close to the M25 London orbital motorway were charged in January 2023 with conspiracy to make and supply articles for use in fraud. Picari was also charged with money laundering.

They all initially denied knowingly being involved in criminality, but admitted the charges at Snaresbrook Crown Court, with Siddeeque being the last to plead guilty in August last year.

At the same court on 27 January 2025 Picari was sentenced to two years and eight months imprisonment. Vijayanathan and Siddeeque were both given 12-month community orders and ordered to pay costs of £760 each. They will also have to undertake 200 hours and 160 hours of community service respectively.

Confiscation proceedings against Picari have commenced. But, says the National Crime Agency, "It is not known how much money the group made from the venture but estimates show it would have been around £90,000 if the 3,000 subscribers purchased the basic plan once and up to £7.9 million if they opted for the elite package on a weekly basis."

A basic package costing £30 a week allowed access to the OTP.Agency spoof call bot, designed to trick victim account holders into disclosing genuine one-time passcodes for their online accounts. This enabled criminals to bypass multifactor authentication on online banking and telecoms platforms, allowing them to access accounts and complete fraudulent transactions.

An elite plan cost £380 per month, which offered both a bespoke 'free text to speech' service, where criminals could type any message they wanted an automated call to say, and pre-scripted calls specifically designed by Picari, Vijayasidhurshan and Siddeeque to target customers. Officers recovered scripts for use by criminals pretending to call from BT, Sky, Virgin Media, HMRC, Mastercard and Visa.