So you got a WhatsApp message from an unknown number, claiming to be your relative. Who cares? It’s not like you have spare money to give them anyway. A scammer isn’t getting a penny out of you.
Even if you never send money online, and even if you have no extra money to send, it’s important to know how to recognise WhatsApp scam tactics. Sometimes they’re after your identity, which can lead to a whole mess of other issues.
How do they get at your identity? Well, if they have your number, they can message you. And if they can message you, and you don’t know how to react, then you are vulnerable.
Common Scams On WhatsApp
If you don’t have any money, you probably won’t fall for the ‘Hi Mum’ scam. That’s the one where the scammer messages the user with a greeting, claiming to be a relative saying they’ve broken their phone. They ask for upwards of £1000 sometimes.
Who would fall for that? You’d be surprised. The scammer sends the same specific details to hundreds or thousands of people at a time. It will look like made up gibberish to most folks. But those oddly specific details will match one or two people in the batch. If it sounds believable enough, and if the circumstances match up exactly, they could easily be getting scammed if they don’t take the right general precautions.
What kinds of scams don’t necessarily involve money? How about the ‘Rediroff.ru’ and ‘Rediroff.com’ scams. Someone will send a random link to a raffle or giveaway. The link then takes the user to a webpage where they are offered entry into a prize pool in exchange for completing ‘simple tasks’. These tasks can range from forwarding the link to a certain number of WhatsApp users, to filling out surveys that ask for sensitive information, to information about the user’s workplace or home Internet service. While innocent at first, the page harvests the user’s details quickly. It grabs their name, address, even bank details. The scammers can then use that information to blackmail, hack, identity swap, or even impersonate the user.
Speaking of impersonation, that’s a common theme in WhatsApp scams. A particularly insidious one is the hijacking scam which relies upon users turning on two-step authentication.
Two-step authentication is the use of external security codes, via text or safe third-party authentication apps, to double check the user’s identity after typing in their password. It stops scammers and hackers from logging in using a password alone since the security codes will be sent to the user’s physical devices, which no one else can see or access under most circumstances.
These hijacking scams involve tricking users into sending security codes to the scammers directly. Users will get a notification for an SMS WhatsApp security code that they did not ask for. Then they get a message from their friend or relative – and it is coming from their real number! The scammer will say that they got locked out of their WhatsApp account and that they just sent the security code to the user’s phone by mistake. Then, the scammer asks the user to send the security code to them. There’s no money request on this one, and no bank account information is involved.
But the code the user got sent was actually for their own WhatsApp account! After sending it over to the scammer, they can bypass the two-factor authentication and hijack the user’s account.
Wait, but the message came from your friend’s real number! You guessed it: They got hacked too. Your friend’s list is next.
Protecting Yourself From Scams On WhatsApp
What’s the best method to protect yourself from WhatsApp scams?
Be extra careful. If someone messages you on WhatsApp and you don’t recognize their number, tell them to call you or leave a voice note. Scammers typically refuse to do this, as their voice won’t match the identity of the person supposedly texting the user. As soon as they start to make excuses, you can bet they’re not who they say they are.
This even works if you do recognize their number! What if it’s the 2FA hijacking scam? If they won’t call you and talk, block the user and delete the chat. Then contact the friend or relative via a different messaging network such as Facebook or SMS. When you hook up, ask them to confirm whether the person messaging you on WhatsApp is actually them. If they say it wasn’t, then you were being scammed.
Don’t ever give away sensitive information like bank details, password details, name or address, or anything else to people you don’t recognize. And even if you do think you know them – make sure to confirm their identity. If they were hacked, it doesn’t take much to move on to hacking people in their contact list.
Be careful about giving information about your life away online, too. The more you give to impersonation scammers, the more information they can use against your friends and family to make them seem more believable. Even if they never hack your phone or WhatsApp account, leaving every detail about your life online might help them scam your more vulnerable family members!
Make sure that you enable two-step verification on your WhatsApp account. Never give out a verification code. Those are only used one time, to type into the app directly. Don’t share other people’s SMS security codes with anyone either. If they need a new one, they can easily request it themselves.
Maintaining your privacy online is critical. Scammers get less personal information and are able to establish less of a link between your social media and E-Mail identities when you’re using privacy software such as Hoody.
We hope that you learned a few things about WhatsApp scams, and how to protect yourself. Even if you personally don’t have money to steal, opening yourself up to such attacks can impact your friends, family, and your identity. Be safe out there!
