Exploiting Android's MMI Functionality to Bypass OTP Security Mechanisms

This paper presents a detailed attack methodology demonstrating how an adversary can bypass SMS/voice OTP-based two-factor authentication by abusing Android’s built-in Man-Machine Interface (MMI) codes. The attack chain involves (1) open-source intelligence gathering to profile the target, (2) social engineering to persuade the user to dial a special code, (3) abusing an MMI code to enable call forwarding to the attacker’s phone, (4) triggering an OTP delivery that is forwarded to the attacker, and (5) using the intercepted OTP to hijack the victim’s account. Prior reports have shown that call-forwarding codes can silently redirect a victim’s calls – including authentication calls – to criminals. We document each step of this chain in a rigorous manner, referencing real-world examples and technical details where available.