Unauthorized VFS Global OTP SMS And Personal Data Security Concerns

On March 29, 2026, at approximately 3:09 AM, I received an SMS on my personal mobile phone number—which I actively use—apparently sent through VFS Global systems. The message stated: “xxxxxxx is the OTP for registration to your VFS Global application. Valid for 5 mins. Please do not share with anyone. B076.”

It is important that the following points regarding this matter are officially recorded and addressed:

Unauthorized Use: I have not applied for a visa to any country, nor do I have any membership or registration with VFS Global. My personal data (my phone number and possibly my identity details) appear to have been used or attempted to be used in your system by unknown third parties without my knowledge or consent.

Data Security Breach: This unauthorized attempt constitutes a serious vulnerability and breach concerning the security of my personal data. Under Law No. 6698 on the Protection of Personal Data (KVKK), this situation creates liability for you as the data controller.

Protection of Future Rights: You must ensure that this unauthorized attempt will not result in any blacklist, restriction, or system-related barrier affecting any legitimate visa applications I may submit in the future.

Request and Conclusion: Based on the above, I request the following:

My phone number and any other data associated with me be immediately disassociated from these suspicious or incorrect records and deleted from your systems
An urgent investigation into which IP address, user account, or application file triggered this SMS
A written and official response informing me of the investigation results and the security measures taken

Otherwise, I formally state that I will exercise my legal rights before the Personal Data Protection Authority (KVKK) and relevant judicial authorities under applicable data protection laws.