Fraudsters use cyber security awareness training topics to steal money and personal information from unsuspecting victims, and many of the red flags that would alert us to a scammer’s identity are present in messages sent via the popular messaging app. Messages from unknown numbers, a sense of urgency (“act now” type texts), and spelling and grammar errors are common indicators. Criminals also tend to cite accounts that appear to be legitimate, but are in fact fraudulent conduits for their transfer of funds.

Often, the fraudsters hijack another person’s account by obtaining their phone number. The criminal then installs WhatsApp on their device, and contacts the victim stating that they’re a friend. They will also request the verification code, and text the victim simultaneously to obtain this and gain access to their account.

Cyber Hygiene 101: Exploring Vital Training Topics to Strengthen Your Organization’s Security Awareness

The cybercriminal can then use the victim’s account to steal messages and call logs from their contacts, and can also send malicious links that download malware and redirect the user to fake websites. In addition, a hijacked account can be used to impersonate tech support from WhatsApp and trick users into revealing sensitive details or downloading dangerous software.

It’s been reported that millions of pounds have been lost to WhatsApp scams. The “Mum and Dad” scam is a common one, where a fraudster will impersonate someone familiar to the victim (often a relative) and request money. This type of fraud can have a snowball effect, as the fraudster’s network is expanded by each account takeover, defrauding more and more of the victim’s contacts.