WhatsApp Scam

Red_Army

My dad and brother have a WhatsApp group chat setup with each other. Recently the chat showed my dad sent a message to my brother saying:

“Hi dad I’ve changed my number. Can you WhatsApp me on the new number? If you press the link you will get me on WhatsApp”


Obviously it’s a scam as why would our dad call his son dad. My dad told us he didn’t send the message. I have checked both my dads and brothers WhatsApp accounts and they both have two-step verification turned on and have not received texts from WhatsApp with the 6 digit verification code you need to input when you log in on another device so I am wondering how this message was sent in there WhatsApp chat?

Has anyone had experience of this? I’ve read in the media about the Hi mum Hi dad scam but usually this is done by the fraudster using a different mobile number.

debitcardmayhem

Red_Army said:

My dad and brother have a WhatsApp group chat setup with each other. Recently the chat showed my dad sent a message to my brother saying:

“Hi dad I’ve changed my number. Can you WhatsApp me on the new number? If you press the link you will get me on WhatsApp”


Obviously it’s a scam as why would our dad call his son dad. My dad told us he didn’t send the message. I have checked both my dads and brothers WhatsApp accounts and they both have two-step verification turned on and have not received texts from WhatsApp with the 6 digit verification code you need to input when you log in on another device so I am wondering how this message was sent in there WhatsApp chat?

Has anyone had experience of this? I’ve read in the media about the Hi mum Hi dad scam but usually this is done by the fraudster using a different mobile number.

Well did the message say it's from your dads/brother (i.e. as from their phone as registered on their contacts) or was it from another unknown number ?

[Deleted User]

You need to take immediate action

Two-step verification for Whatsapp is via email, not text message for obvious reasons - the WhatsApp account is tied to a mobile number so 2FA with the same number is actually 1FA and therefore pointless.

I'd assume your Dad has had his email account hacked and therefore assume that his email password is now compromised and any other account that uses that password or is accessible via an email password reset.

1. Reset the password for your Dad's email account immediately and enable 2FA if not already - must be done before following the steps.
2. Thoroughly check all devices used to access your Dad's accounts for malware, malicious apps, etc
3. If your Dad uses that same password as the email account for any other account - change that immediately
4. Check all other online accounts - start with high-priority ones with financial or sensitive data and reset the password.

Take this opportunity to review password security - people don't get "hacked", they expose their credentials via phishing, malware, etc.

Red_Army

debitcardmayhem said:

Well did the message say it's from your dads/brother (i.e. as from their phone as registered on their contacts) or was it from another unknown number ?

Yes. My dad and brother have had a WhatsApp group chat setup with each other for years and it was sent within that from my dad but my dad didn't send it.

Red_Army

[Deleted User] said:

You need to take immediate action

Two-step verification for Whatsapp is via email, not text message for obvious reasons - the WhatsApp account is tied to a mobile number so 2FA with the same number is actually 1FA and therefore pointless.

I'd assume your Dad has had his email account hacked and therefore assume that his email password is now compromised and any other account that uses that password or is accessible via an email password reset.

1. Reset the password for your Dad's email account immediately and enable 2FA if not already - must be done before following the steps.
2. Thoroughly check all devices used to access your Dad's accounts for malware, malicious apps, etc
3. If your Dad uses that same password as the email account for any other account - change that immediately
4. Check all other online accounts - start with high-priority ones with financial or sensitive data and reset the password.

Take this opportunity to review password security - people don't get "hacked", they expose their credentials via phishing, malware, etc.

1. Reset the password for your Dad's email account immediately and enable 2FA if not already - must be done before following the steps. My dad has reset his email password and he setup 2FA on his email account a few years ago.

2. Thoroughly check all devices used to access your Dad's accounts for malware, malicious apps, etc Done a scan with Antivirus and Malwarebytes and all clear. He only uses 1 device.

3. If your Dad uses that same password as the email account for any other account - change that immediately He uses a different password for every account and keeps them written down on a piece of paper that he locks away in a box.

According to the Met Police when you try registering a WhatsApp account on a different device with your number it sends you a verification SMS code to your phone to verify it. My dad has not been sent a text with this code and even if he had he would never share it with anyone.

https://www.bitdefender.co.uk/blog/hotforsecurity/received-a-whatsapp-verification-code-without-requesting-it-beware-you-might-be-about-to-have-your-account-stolen/

[Deleted User]

Thanks, yes so I was pushing all angles on the above to try to minimise any further issues from a compromised account.

According to the Met Police when you try registering a WhatsApp account on a different device with your number it sends you a verification SMS code to your phone to verify it. My dad has not been sent a text with this code and even if he had he would never share it with anyone.

Two-step verification is totally different to the 6-digit registration code received via SMS when you register a new phone. 

Maybe your father doesn't have Whatsapp two-step verification but you specifically stated "2-step verification" in your first post so I was working with that one. This is not the SMS verification, this is where you need to periodically log into your WA account with a PIN. If you forget your PIN you can request a reset link via email - hence my thinking email was compromised.

From what you said, it appeared to be a message initiated from your Dad's mobile number and not a new number - which fitted in with the above scenario when I was thinking it through last night - can you confirm it was sent from the same number?

Anyway, I'm now thinking of an app on the device sending the message by tricking the user into clicking on something that allowed sharing of a message for example rather than another instance of the app being used.

Another possibility is that the mobile account has been compromised and a new SIM issued, but I'd expect a more sophisticated scam such as a banking breach rather than the low-quality one your brother received - and of course, your Dad's SIM will probably be disconnected.

Red_Army

Maybe your father doesn't have Whatsapp two-step verification but you specifically stated "2-step verification"

I checked and he does have it enabled. He changed the pin yesterday to be on the safe side.

From what you said, it appeared to be a message initiated from your Dad's mobile number and not a new number - which fitted in with the above scenario when I was thinking it through last night - can you confirm it was sent from the same number?

Yes. The WhatsApp chat my dad and brother have going it shows my dad sent the message and when my brother checked on his phone he could see he received it from him. My dad uses Android and my brother uses IOS.

[Deleted User]

Personally, I'd wipe the phone and start again - that might seem a bit extreme but if an employee contacted my IT support team at work with the exact same issue that is exactly what I would do.

The following are the scenarios I would consider:

• SIM is cloned
• Whatsapp account is compromised
• Rogue Whatsapp app - ie "Whatsapp Plus" or some other "fake" Whatsapp app.
• Phone has malware
  
• The user has clicked a dodgy link that shared a message via Whatsapp

Hoping it is the last one for your Dad as that is easy, just advise you to be careful what you click on in the future.