WhatsApp is the most popular mobile messaging app in the world. According to a survey by Statista, at the end of last year, Brazil was already in second place in the ranking with the largest number of users of the app in the world, totaling more than 99 million accounts, second only to India, with around 340 million, and ahead of the US, with 68 million.
With the growth of this popularity comes the increase in the action of cybercriminals who seek to spread massive scams, reaching an increasing number of victims to earn large amounts of money. Scam types are also becoming increasingly sophisticated, with social engineering techniques to convince people to share security codes for two-factor authentication and gain control of accounts.
When cybercriminals gain access to the victim’s account
There are known forms of scams, such as when, after obtaining the victim’s phone number, the cybercriminal makes a call pretending to be a technical support employee on a known website to ask the victim to share a confirmation code via SMS; in fact, the code was sent by the fraudster himself.
If the victim clicks on the link received, it allows cybercriminals to clone the account and look for more contacts to trick them. With this, the user can lose control of WhatsApp, while the fraudster can read and send messages on his behalf.
Cloning scam on WhatsApp happens due to the victim’s lack of attention or lack of information.Source: agrafica
When using a WhatsApp account on a new device, groups related to the number are automatically transferred to the device. The messages sent do not appear, but the phone number of other members is visible, which probably indicates how cybercriminals choose more victims.
Phone numbers are easy to find
Most people do not consider the phone numbers WhatsApp uses as confidential information, so this data may be available on social media profiles, sent by various services, obtained for marketing actions or even included in database leaks. and, in this case, sold on the dark web. Even random attempts to come up with possible combinations of numbers can generate good results for scammers.
Scams spread in Brazil
Evident themes, such as covid-19, have been explored. In the case of coronavirus, cybercriminals pose as professionals from a recognized research institute, ask questions and, in the end, request the SMS code sent to the victim’s cell phone in order to clone WhatsApp.
Among other blows is one in which victims are invited to a party. The criminal pretends to be a famous person that the victim follows on Instagram.
The criminal pretends to be a famous person that the victim follows on Instagram and invites her to a party
Scammers use appropriate language and sometimes even mention the name of someone the person knows to convince them that they need to confirm their presence, which needs to be done with a verification number sent via SMS, which, in reality, deals with the two-factor verification code of WhatsApp needed to clone the victim’s app.
What to do if your account is cloned?
Users who suspect their WhatsApp account has been hacked should:
- access WhatsApp with the phone number and verify it by entering the code received via SMS. This will log off other devices and give the owner back control of the account;
- speak to your contacts through other channels, informing them of the suspicion and asking them to ignore messages that can be sent until the problem is resolved;
- immediately stop interacting with the person and report them to local authorities if they realize they are dealing with fraud.
How to protect yourself?
- Avoid sharing your phone number on public platforms. If you need to be contacted, the recommendation is to provide the email address.
- Enable two-factor authentication in your WhatsApp account settings. That way, the attacker will also need to enter your 2FA PIN, in addition to the SMS code, making it very difficult to hijack.
- Never share your WhatsApp authentication code, not even with friends and family. No one should request a verification code of any kind via WhatsApp.
If someone says they need to verify one of your accounts, it’s likely to be a scam
If you need to verify an account, do it directly on the platform and never send verification codes through WhatsApp. Two-factor authentication codes must be treated as passwords, which means that they must not be published or shared.
So if someone contacts you and tells a story that seems to be too good, be wary: it could be a scam.
Luis Corrons, biweekly columnist of TecMundo, is Avast Security Evangelist. Always on the lookout for the latest news on cybersecurity, malware and darknet, he is a security industry veteran and industry speaker. He is also a reporter for WildList, a member of the Board of Directors of the Anti-Malware Testing Standards Organization (AMTSO) and member of the Board of Directors of Malicious URLs Tracking and Exchange (MUTE).