The ever-growing landscape of online fraud and digital scams now features sophisticated methods capable of wiping out years of hard-earned savings in a single moment of carelessness. A hasty step taken without adequate caution can deliver a lifelong financial blow. Recently, a brand new cyber fraud technique has emerged, causing widespread alarm. Consider how easily a qualified chartered accountant fell victim to this scam and lost money from his account, illustrating just how difficult it is for ordinary citizens to escape such traps.
The New WhatsApp Banking Fraud Tactic
A recent case has brought to light a novel banking fraud operating entirely through WhatsApp. In this incident, a chartered accountant lost Rs 1.70 lakh from his accounts merely by typing 'No' in response to a transaction inquiry message on the messaging platform. What makes this case particularly alarming is that the cybercriminals executed the hack without requiring the victim to click on any link or share a single OTP, showcasing an entirely new vector of unauthorized access.
How the Scam Was Executed
The victimized chartered accountant initially received a notification claiming a transaction of Rs 90,000 had occurred. The message asked whether he had performed the transaction, instructing him to reply with 'No' if he had not. The moment he complied and sent the reply, he lost a total of Rs 1.70 lakh from his ICICI and IndusInd bank accounts. He had not clicked on any external links nor shared any OTP; he had simply responded with 'No' and watched his funds disappear.
The step-by-step mechanism of this fraud typically unfolds as follows
- Fake Debit Alert: The victim receives a fabricated message stating that a significant amount, such as Rs 90,000, has been debited from their account.
- Prompt to Reply: Immediately afterwards, a follow-up message arrives instructing the user to reply with 'No' if they did not initiate the transaction.
- Hidden Payload: The incoming message contains a concealed auto-execution file embedded within the chat payload.
- Device Takeover: As soon as the user replies with 'No', the hidden file activates, granting hackers complete remote control over the mobile phone.
Insights From Cyber Experts
Kislay Chaudhary, a cyber expert who has resolved complex cases in collaboration with Delhi Police, emphasizes that the most critical elements in this case are WhatsApp and the fraudulent bank notification received through it. He explains that whenever a legitimate banking transaction occurs, customers receive standard text messages via SMS rather than WhatsApp messages. Furthermore, banks never ask customers to click on links within messages, and if a message goes unanswered, banks typically follow up with a call from an official toll-free number. Therefore, if anyone receives a WhatsApp call or message bearing a bank's name, they should never respond, refrain from clicking any links, and instead check their official message inbox.
Chaudhary notes that even in digital arrest scams, fraudsters avoid regular carrier calls and instead initiate video calls over WhatsApp. Citizens are advised to remain vigilant and protect themselves against these emerging fraudulent tactics.
Essential Precautions to Avoid Fraud
To protect oneself from falling victim to such elaborate scams, several crucial precautions must be observed
- Ignore Unknown Numbers: If you receive a WhatsApp message regarding a debit from an unknown number, do not reply and delete it immediately.
- Verify Through Official Apps: To determine whether a message is genuine or fake, always check your account statement and balance exclusively through your bank's official application.
- Trust Official Channels: Rely solely on official bank alerts and verified customer care numbers rather than unverified messaging contacts.
- No WhatsApp Confirmations: Banks never send such interactive 'Yes/No' confirmation prompts over WhatsApp.
