The Kolkata Police cyber cell has an important warning for WhatsApp users. The police issued the advisory after complaints from a student and businessman in the city. Incidentally, this cyber fraud started with impersonation on Facebook. These cybercriminals appear to have hacked victims’ Facebook profiles and contacted the people on their friends' lists through Messenger. In these cases, scammers tried to dupe users’ contacts on the pretext of running yoga classes. Incidentally, the city saw multiple such scams being reported around the World Yoga Day on June 21.
How the scam worked
The fraudsters contact people in victims' contact list asking them to join yoga classes being organised by them. A link is sent and the recipient is asked to click. On clicking the link, the contacts are asked to share a six-digit OTP code. "Once the link is clicked and the OTP shared, the accused can use the WhatsApp number from another phone," said an investigating officer.
As this OTP is actually a WhatsApp verification code. WhatsApp accounts are linked to one phone number on one device. When hackers try to link them on to their own, they try to get it done through a verification code. By sharing this code with fraudsters, users lose access to their WhatsApp account.
In this particular modus operandi, the scammers used yoga classes as a pretext to get the code. They request the victim to tell them the code or forward it to them in order to join classes. The code is not a normal OTP but actually the WhatsApp verification code.
What criminals do with hacked WhatsApp account
The criminals then impersonate the victim, request money from their contacts (usually for an emergency but always on the promise of being repaid). They can also use the hacked account for criminal activities. In some such cases, the investigators said that the accused then extorted their victims to invest in crypto-currency to get back access to their WhatsApp account.
Kolkata Police recently warned netizens about these kinds of hacks through its Facebook page. "WhatsApp Getting Hacked! If you receive this kind of message and if any person on your WhatsApp contacts list (even if known) asks you to forward the same, please don't do so. Fraudsters are using this to take control of your WhatsApp account. We have received a few such complaints and seek your cooperation," it said, sharing a screenshot of the fraud message where a WhatsApp code apparently is asked to be shared.