How to Protect Your WhatsApp Account as User Scams Increase

Following the leak of over 487 million WhatsApp user records, users of a popular messaging platform have reported an increase in spam texts.

“Someone definitely bought USA records and now they are messaging my friends and family asking for money – I didn’t click any links or shared any PIN,” a Twitter user complained.

They are referring to a recent post on a well-known dark web forum in which a threat actor is selling the phone numbers of nearly 500 million WhatsApp users.

According to the threat actor, a US user database with over 32 million records costs $7,000.

While we don’t know where the dataset came from and have yet to hear from WhatsApp or its owner Meta, we do know that users who leave their phone numbers out in the open are at risk.

Threat actors could bombard them with spam messages, spoof popular brands such as DHL or Amazon, which are frequently exploited during the holiday season, try to lure victims into cryptocurrency scams, or even attempt account takeovers.

Increase in spam messages

Users have reported an increase in spam campaigns in which threat actors pose as invoices. One tweet reads, “This explains the calls saying an iPhone has been charged to my Amazon account.”

During the holiday season, low-tech scams are popular. It easily gets past defences because there is no malicious link involved. Scammers either call you or force you to call them, for example, to cancel a purchase you did not make.

When a victim dials the number, cybercriminals attempt to obtain as much personal information as possible in order to cancel the order.

Users also report unwanted personal messages from scammers posing as doctors from the United States, when the phone number they are texting from indicates that they are in Nigeria.

These kinds of personal messages are completely harmless. Fraudsters look for their victims on dating apps and social media platforms, and they may even send random texts disguised as the incorrect phone number.

They pretend to be looking for friends and only after gaining the trust of their victims do they make a seemingly innocent suggestion to earn money by investing in cryptocurrency. Recently, US authorities authorised the seizure of seven domains associated with a “pig butchering” scam in which five victims lost $10 million.

Account takeover attempts have also occurred. One Twitter user has received a WhatsApp notification that someone is attempting to register the account with a new device

“It easily happens two to three times a week, and that’s how it’s been since September,” they complained. Even before the ad was posted on the dark web, users were inundated with these messages. This is likely to worsen with the sale of a massive dataset. Fortunately, this WhatsApp user has enabled two-factor authentication (2FA), making it more difficult for attackers to compromise the account.

To deceive victims, threat actors may impersonate well-known brands and celebrities. For example, followers of Binance CEO Changpeng Zhao reported receiving random messages from someone impersonating him. Zhao claimed that attackers were impersonating him and urged everyone to block imposters.

Attackers impersonating Zhao would most likely try to entice victims into some sort of cryptocurrency scam.

While there is no way of knowing whether someone purchased the dataset that is causing the surge in scam attempts, the examples above demonstrate how dangerous it is to have your phone number public.

How can I safeguard myself?

A private phone number belonging to an individual, as opposed to the contacts of government agencies and corporations, is considered personally identifiable information (PII).

As a result, businesses have a responsibility to safeguard the information you share with them. However, due to security flaws or simple scraping that some companies ignore, your data, such as your email address or phone number, may be leaked. There are a few steps you can take to ensure that your disclosed information does not benefit threat actors:

• Do not answer calls and text messages from unknown members. Block anyone who raises suspicion.
• Enable 2FA as soon as possible – head to WhatsApp Settings-Account and turn the feature on.
• Check that your profile information is not publicly visible. Go to Settings-Privacy and choose who can see your profile picture, “about” information, and other account details. Make sure you share those only with a small group of people.
• Don’t fall for scam support messages. We’ve noticed scammers offering their “help” by redirecting WhatsApp users to experts who allegedly can help get the hacked account back. The only way to recover a hacked account is by contacting official support.