WhatsApp: Fraud impersonates technical support to unlink user’s phone number

MADRID (Portaltic/EP) – The National Institute of Cybersecurity (INCIBE) has warned of a new fraudulent campaign on WhatsApp in which cybercriminals pose as the platform’s technical service and collect personal information to take over users’ accounts and unlink phone numbers from their profiles.

A few days ago, a woman contacted INCIBE’s Cybersecurity Helpline to report that she had received a call from a telephone with a US prefix through the application.

When he picked up the phone, a woman appeared, identifying herself as WhatsApp technical support, to warn him that they had detected that another device other than his had accessed his profile. With this, she asked him for the name of the brand of his terminal, under the pretext of identifying the legitimate smartphone.

The alleged technical support operator of the Meta communication platform also asked the victim for the six-digit code received on her mobile phone, also with the excuse of clarifying that she was contacting the account owner.

Believing she was speaking to platform support, she provided the requested data, also indicating that she did not have the two-factor authentication system activated when asked about it.

After this response, the supposed technical support hung up the call and, from then on, the user no longer had access to her WhatsApp account. Despite having reinstalled it and entering again the six-digit code that she received by SMS, she received a warning that her number was no longer linked to her profile and that she should enter a new one.

How to act in the face of this deception

INCIBE explains that if you are a victim of this scam, you should warn all your contacts to be on the lookout for possible fraudulent messages they may receive from the stolen phone number.

It is also advisable to contact WhatsApp via the email provided by the platform ([email protected]) to explain what happened. And if you are unable to recover your account using this means, it is advisable to notify the application’s data protection officer.

Likewise, those affected must report the telephone number that contacted them so that the platform itself can act and take measures, gathering all possible evidence to prove that they have been the victim of fraud.

Finally, and looking to the future, it is ideal to enable two-step verification (2FA) as a preventative measure to avoid scams of this nature from occurring again.

Never share

WhatsApp updated its awareness campaign against digital scams this summer to convey the importance of not sharing the six-digit code with anyone, which is often the resource used by many cybercriminals to take control of an account.

This code is important when registering on WhatsApp or changing your mobile phone. The platform sends it to the user’s phone number via SMS or a call, and when entered into the app it gives access to their profile.

This is why it is a common resource that cybercriminals try to obtain from their victims, because if they access this number, they gain access to their account in the messaging service, and can impersonate them.