Scammers are now using call merging to eavesdrop on bank OTP calls and steal money without victims directly sharing any details.