In the world of hacking, complicated decryption systems are not always necessary to steal users’ personal data. For years, a fraud as simple as Obtaining the WhatsApp code has managed to steal the identity of thousands of people.
How does the scam start? Through an SMS or text message. First, scammers register or associate their victim’s mobile number with a WhatsApp account on another cell phone. To do this they do not need the account holder.
Immediately, without having done anything, the victim receives a WhatsApp notification on their phone with the following message: “your phone number is no longer registered on this phone. This is probably because you registered your phone number in WhatsApp on a different phone. Verify”.
Then the contact is initiated. Cyber criminals send a message to their victim, stating that the application is not up to date. There, they indicate that it is necessary to check that everything is in order to continue using the service. To do so, they tell you that you will receive a six-digit code and that you must share it with them. It is important to pay attention, because the message usually includes the same company logo.
Shortly after, the victim receives an SMS with said code to verify his account. This is where the fraud happens: if the victim sends the verification code they received, cybercriminals will be able to access their WhatsApp account on another device.
From there, the deceived person’s account will be blocked and a message will arrive warning them that their WhatsApp account is no longer linked to their mobile. Meanwhile, with the access code, cyber criminals will be able to enter contact list and chat history of the user.
Having accessed the account, the fraudsters impersonate the victim’s identity and interact with their contacts, taking advantage of the existing relationship of trust.
By way of example, the Attorney General’s Office has warned these days about a scam developed under this modality, through which the sale of dollars is offered under very beneficial conditions to get contacts to deposit the counter value in national currency in a account indicated by the scammers.
According to what was reported by the Prosecutor’s Office, this type of scam would have already affected a few dozen people in Uruguay.
For damien bourel, Chief Information Security Officer (CISO) of BBVA in Uruguay, this type of fraud is already recurrent in the country. The executive indicated that “at BBVA we have permanent monitoring of this type of matter and, leveraging the experience of other Group countries, we seek to anticipate and warn the market about possible fraudulent modalities before they reach Uruguay.”
In this sense, Bourel warned about the importance of users following the recommendations and taking extreme security measures in order to prevent such situations.
WhatsApp account recovery
There is a way to recover the accountalthough it takes a few hours. In that time, cybercriminals will dedicate themselves to scamming the victim’s contacts: they will pretend to be the victim and, as if it were a friend or relative, they will ask for a loan that they will never return.
How to recover the account? The deceived person will have to download the app again. There, the application will ask you to enter the mobile number and the authentication code. Since the code was recently sent, a new one It will take about six hours to process.
Courtesy BBVA
A fraud as simple as obtaining the WhatsApp code has managed to steal the identity of thousands of people
Measures to avoid identity theft on WhatsApp
WhatsApp account or identity theft is not done through machines, but is done from person to person. Therefore, it is easier to detect than other types of fraud. Below, BBVA in Uruguay provides a series of useful tips on cybersecurity so that users are always attentive:
- It is advisable turn on two-step verification. In this way, those who enter the account on another device will not have access to conversations, contacts, nor will they be able to write messages on behalf of the owner.
- When a friend or family member asks for money, check the message at least twice. If you suspect that it is fraudulent, dismiss it and consult the person by another means.
- A good way to stay away from potential scammers is set the account to be visible only to own contacts. This is done from the “privacy” section, selecting the option to give visibility only to contacts or to no one.
- If you have received a fraudulent message, a new verification code can be requested and enter it before criminals do. In this way, the submitted code will no longer work.
For those who have been a victim of this type of scam, it is necessary to report the incident to [email protected] with the subject “Loss / Theft: Deactivate my account”. Another option is to enter the application’s web page and go to the “Help Center” or “Contact” tab.
