Hackers pose as bank customers by stealing OTPs, making $500