Hackers impersonate couriers, exploit WhatsApp to steal money

Scammers pose as contacts of the victims and request money transfers. Representation Pic/istock

Cyber fraudsters have devised new methods to hack WhatsApp accounts and scam users by sending urgent messages to their contacts, often requesting money for medical emergencies. In one method, hackers send six-digit verification codes from a victim's contact number, and once the user shares the code, their WhatsApp account is compromised.

Another tactic involves fraudsters posing as courier service representatives and instructing victims to dial a specific number. The moment the number is dialled, the victim is logged out of their WhatsApp account. "In today's digital age, safeguarding your online presence is paramount. We urge everyone to remain vigilant by never sharing verification codes, refrain from dialling unknown numbers, and enable two-factor authentication on WhatsApp and other social media platforms" said Datta Nalawade, DCP cyber.

Victims speak

Speaking to mid-day a Mumbai based senior journalist requesting anonymity said, "I was in a hurry to board a local train when I received a call from an unknown number claiming to be from Blue Dart. The caller said a parcel agent was outside my house and shared a number, asking me to call the agent. I asked him to message it to me. I later received a number that started with '21'# followed by a mobile number. I dialled it, but the call didn't connect. Instead, I received activation messages, which I later realised was related to call forwarding to another number."

"When i didn't get a follow-up call from the courier agent, I grew suspicious. Soon after, my I began receiving calls from my contacts saying they had received urgent messages from my number requesting Rs 42,000. I immediately posted on social media that my WhatsApp had been hacked, but by then, some people had already transferred the money. It took 24 hours to regain control of my WhatsApp," he added.

Film curator and Sunday mid-day columnist Meenakshi Shedde also fell victim to a WhatsApp hack, losing access to her mobile phone for a month. "This happened to me last year in August or September. I was in Toronto, travelling to the USA, when I received a message from a close friend asking me to share an OTP I had just received. Since I was about to board a flight to New York at 4 am, I was distracted and forwarded it to her. Immediately after, I put my phone on flight mode, as I was boarding my flight to the USA," Meenakshi said.

"After landing, I was shocked to see over 100 missed calls and messages from people asking if my WhatsApp had been hacked. I panicked and checked my phone, only to realise my WhatsApp had been hacked, and I had been blocked out of my own account. I quickly posted about the hack on social media, and many people blocked my number to prevent falling victim to the scam," Meenakshi said.

"I repeatedly emailed WhatsApp for help, but to no avail. When I returned to India, I went to the police cybercrime HQ at BKC, but they told me they only handle fraud cases involving amounts above R10 lakh. They directed me to the local Vakola Police Station, but it was useless. I was asked to fill out a digital form, but the officer in charge of cybercrime was clueless and unable to record my complaint digitally, and refused to even register a physical written complaint!" Meenakshi said.

"In the end, it was my neighbour Vihangi Jani who helped me regain access to my account. I lost all my saved WhatsApp data, including important messages, documents, and work-related videos and photos. A friend also sent the hacker a tidy sum of money thinking I was in distress, asking for help," Meenakshi added.

Experts speak

"To prevent such scams and hacks, people must enable two-step verification. Even if someone gets hold of the six-digit code, they won't be able to access WhatsApp without it, giving users control over their accounts," said Ritesh Bhatia, cyber expert, director and founder of V4WEB cyber security.

"I have been stressing this time and again, but the real question is - if intermediaries are aware of these hacks, why aren't they making two-step verification mandatory for all WhatsApp users, especially when it is the only effective solution at this point?" Bhatia added.