A dangerous phone scam is making the rounds again, and it is one that too many people still have not heard about. It is known as the USSD code call forwarding scam, and it is particularly effective because it does not involve hacking your phone, stealing your password, or swapping your SIM card.
The scam usually starts with a convincing message or phone call. You might get a text claiming to be from a delivery company like FedEx or UPS, saying there was a problem delivering a package. Other versions pretend to be from your mobile carrier and warn about a security issue with your line. The message creates urgency and then offers a simple fix.
That fix is the trap.
The scammer tells you to open your phone’s dialer and enter a short code that looks harmless, something like 21 followed by a phone number and ending with a pound sign. They may call it a verification code or a tracking code. The cellular call forwarding functions may look like this:
- Verizon:
*72+ [Phone Number] - T-Mobile:
**21*+ [Phone Number] +# - AT&T is not clear on how to forward so here are some various options:
**21*+ [Phone Number] +#*21*+ [Phone Number] +#- 21 + [Phone Number] + #
In reality, it is a USSD command. USSD stands for Unstructured Supplementary Service Data, and these codes talk directly to your mobile carrier. (Some of us may remember call forwarding back when we had landlines.)
When you dial that code, you are not checking a package. You are turning on call forwarding.
Once call forwarding is active, all your incoming calls are silently sent to the scammer’s phone. Your phone still has signal. You can still text and browse the internet. The only thing you might notice is that calls stop coming in, which many people do not realize right away.
This is where the real damage happens. Many banks, email providers, and apps like WhatsApp offer a “call me with a code” option for account recovery. When the scammer tries to log in as you, that verification call goes straight to them. They hear the code, enter it, and take over your account.
Never dial a code that starts with an asterisk and ends with a pound sign if it came from a text, email, or phone call you did not initiate. Legitimate companies will never ask you to type a code into your dialer to fix a delivery or secure your account.
