Ask HN: How was this fraud committed?

Hello, a friend who lives in India was the target of an online fraud recently. I've been trying to think of ways the attack might have been orchestrated. I was hoping that some the security experts on HN might chime in on what may have happened.

Before going into the details of what happened, for those that aren't familiar, online transactions in India use OTPs (for One-Time Password). When a user makes an online transaction, they receive a unique, temporary code that is valid for a short period of time. The user must enter this code to complete the transaction. OTPs are typically sent to the user's registered mobile number via SMS. The message that contains the OTP also has information re. the transaction - the amount, etc.

DETAILS OF THE FRAUD

1. My friend was using a iPad with up-to-date security updates. He uses Safari as his browser.

2. My friend wanted to purchase tickets to an exhibition so he googled the exhibition's website.

3. On the website, there was a link (this is no longer available since the exhibition ended) to purchase tickets. https://indiaartfestival.com/

4. Clicking on the link opened a page on a very popular ticketing website (similar to Ticketmaster in the U.S.). https://in.bookmyshow.com/explore/home/national-capital-region-ncr

5. My friend entered his credit cards details and clicked on 'Purchase'. I'm guessing this was via a payment gateway the ticketing website uses.

6. He received an OTP via text message and entered it on the site.

7. The site displayed an error message saying that there was some problem with the transaction and that a new OTP was being sent. Note that he did not do anything to get the new OTP, it was sent automatically.

8. My friend recd. the 2nd OTP and entered that. His mistake was that he did not check the rest of the text message which contained the amount of the transaction, etc.

9. The site displayed an error message again and sent another OTP.

10. My friend entered the OTP for the 3rd time. He made the same mistake and did not check the rest of the message.

11. He doesn't remember what exactly happened after this but there were no more OTPs sent to his phone.

12. Instead of 1 transaction, his credit card had been charged 3 times:

  a) A valid transaction for the tickets he was trying to purchase.

  b) 2 fraudulent transactions, each for about 50 times the price of the tickets.

He's opened a dispute with his credit card company but I'm curious how was this done.

The ticketing website (and I'm guessing the payment gateways they use) are pretty big in India and if it was compromised and a lot of people were defrauded, I would've expected to hear something in the news. Haven't heard anything.

I got him to check his browser history and there were only 3 sites he opened when this happened:

1. Google when he searched for the exhibition's website.

2. The exhibition website.

3. The ticketing website.

We confirmed that 2 & 3 above were legit sites and not something set up for a phishing attack.

I've discussed this with a couple of my tech friends (no one specializing in security though) and none of us have been able to come up with a reasonable explanation of what may have happened. Any security gurus on HN have any thoughts? Thank you!