If someone on the phone asks you to punch in a short string like *21 or *67 followed by a number, they are very likely trying to get your carrier to forward your incoming calls to a line they control. This is not a hypothetical edge case: call-forwarding codes are built into nearly every mobile network specifically for convenience, and that same convenience makes them trivial to weaponize over a single phone call. More broadly, Pew Research Center found that 81% of Americans say the risks of companies collecting their personal data outweigh the benefits, and the same research shows that 67% of Americans say they understand little to nothing about what happens to data tied to their phone number. That gap in understanding is exactly what this kind of call relies on, because the attacker doesn’t need to break into anything — they just need you to trust the instructions enough to dial a few digits yourself.
How a single dialed code hands over your calls
The attack starts with a phone call, often from someone posing as a bank, a delivery service, or even your own mobile carrier’s support line. They build urgency: a suspicious charge, a failed delivery, a security alert that needs ‘verification.’ Then they ask you to dial a specific combination of symbols and digits, something like a call-forwarding code that most phones recognize natively, no app required. Once you dial it, your carrier’s network silently reroutes some or all of your incoming calls to a number the scammer owns. From that point on, any service that calls you to confirm an identity, reset a password, or approve a transaction is actually reaching the scammer, not you. Because the forwarding happens at the network level, there is no suspicious app to find and no obvious pop-up warning you that something changed. The only sign is that your phone stops ringing for calls it used to receive, and by the time anyone notices, the fraudulent transfer or account takeover is often already complete. This technique predates smartphones entirely — call forwarding codes were standardized decades ago for landlines, long before anyone anticipated they could be used as a vector for account takeover. Carriers rarely notify customers when forwarding is enabled through a code dial, because from the network’s perspective, the subscriber themselves performed a routine, intentional action, not an intrusion that would trigger a fraud alert.
A typical version of the call
This scenario is illustrative and does not describe a real individual or event.
Someone receives a call claiming to be from their bank’s fraud department. The caller already knows the last four digits of a card, which feels reassuring, and explains that an unusual overseas charge was just blocked. To ‘confirm the account is secure,’ the caller asks the person to dial a short code starting with a star symbol, wait for a tone, then hang up. The person complies because the request sounds like a routine verification step, not a configuration change. Minutes later, the real bank tries to call about a separate matter, but the call is silently redirected. A new card is requested using details gathered from the first call, and the one-time verification call that should have stopped it never reaches the actual account holder. By the time the account holder checks their phone and realizes they missed a call from an unfamiliar number claiming to be the bank, the new card has already shipped to an address that was never theirs, and canceling the fraudulent order requires untangling a mess of calls that never should have reached anyone but them.
How to shut this down before it starts
The single most reliable defense is refusing to dial any code read to you by a caller, no matter how official the request sounds. Legitimate institutions do not need you to type anything into your phone’s dial pad to confirm your identity. Beyond that reflex, a few habits make it much harder for this kind of manipulation to succeed, and much easier to notice quickly if it ever does.
Refuse to dial any code during an unsolicited call
If a caller asks you to enter a sequence on your keypad, whether it starts with a star, a pound sign, or digits like 21 or 67, stop and hang up. There is no legitimate reason a bank, carrier, or delivery company needs you to dial anything mid-call. Call back using the number printed on your card or on the official app instead of any number the caller gives you, since that number may route straight back to them. Treat this as a hard rule rather than a judgment call, because the whole point of the scam is to make the request sound reasonable in the moment.
Check your call-forwarding status directly with your carrier
Every major carrier lets you check or disable call forwarding from the phone’s settings menu or by dialing a standard status code published on the carrier’s own support site. Do this periodically, especially after any call that felt even slightly off. If forwarding is active and you did not set it up, disable it immediately and change your account PIN with the carrier. Make this check part of a recurring routine, not just a one-time reaction, since forwarding can be re-enabled quietly if the underlying account access is not also secured.
Lock down your carrier account against unauthorized changes
Most carriers offer a PIN or passcode requirement for any account change, including forwarding settings, SIM swaps, or new lines. Set this up proactively rather than after an incident. Pair it with a password manager that flags reused or weak credentials tied to your carrier account, so the login itself is not the weak point. If your carrier supports additional identity verification for in-store or phone-based changes, enable it too, since account takeovers often start by impersonating you to the carrier rather than attacking you directly.
Watch for missed calls from known contacts
If friends, family, or services mention they tried calling and could not reach you, do not dismiss it as a network glitch. Treat a sudden pattern of missed calls as a signal worth checking against your forwarding status, particularly if it follows a recent suspicious call. A quick call to your own number from a different phone is often enough to confirm whether something has quietly changed.
Why a dedicated privacy tool fits this specific risk
This scam works because a phone number quietly became a master key: it is the destination for password resets, two-factor codes, and account recovery calls across dozens of services. The fewer places that number is exposed, and the more visibility you have into unusual access attempts, the smaller the blast radius when a call-forwarding attempt almost succeeds. A privacy-focused monitoring and identity protection service helps by watching for your phone number and associated accounts showing up in breach data or being used in unfamiliar sign-in attempts, giving you an early warning rather than discovering the forwarding only after a fraudulent transaction clears. Some of these services also include guided account recovery support, which matters because untangling a hijacked call-forwarding setup, a reset bank card, and a compromised email account at the same time is genuinely hard to do alone under stress. None of this replaces the basic habit of never dialing a code read to you by a stranger, but it closes the gap between ‘something went wrong’ and ‘I know exactly what changed and how to reverse it.’ Given how little visibility most people have into what happens behind their own phone number, that kind of monitoring turns an invisible network-level change into something you can actually see and act on quickly, often before a single fraudulent charge has a chance to settle.
Numero eSIMaffiliate link
A second number without a SIM card, in 80+ countries