WhatsApp Rolls Out New Anti-Takeover & Scam Call Security Features: How to Enable Protection Settings Immediately
As WhatsApp users have become aware of, there have been increasingly advanced attempts by criminals through fraudulent customer care calls, impersonation or device linking tactics for account takeover. In particular, the concern is important in India as the Indian Cyber Crime Coordination Centre recently issued a warning concerning a WhatsApp takeover that uses malicious files that are masqueraded as account statements and regulatory notifications.
In light of this, WhatsApp has been expanding its security portfolio through the provision of additional security measures that are aimed at giving users sufficient time to protect themselves against any potential attempts at takeover or manipulation of users into providing confidential information.
This new security measure includes the use of Device Linking Warnings, Screenshare Warnings, Context Cards and Silence Unknown Callers.
Why WhatsApp Is Strengthening Anti-Takeover Protection
Taking over an account does not necessarily require advanced hacking skills. In most instances, attackers just trick people into doing something that grants them entry.
Attackers may pose as bank officials, government employees, company executives or even friends. They may then prompt the victim to send them a verification code, scan a QR code or confirm device linking.
If attackers manage to link their devices to the victims’ accounts, they can get access to WhatsApp accounts and leverage the identity to attack contacts.
Recent warnings by the Indian government regarding this threat illustrate the reason why it should not be ignored. According to I4C, attackers have managed to install malicious files under the guise of financial and regulatory files with the aim of taking over WhatsApp accounts.
Stay updated with the latest WhatsApp privacy, calling, and security changes.
Ready for WhatsApp Web Calling?
Check out the latest calling features, setup steps, and updates.
What Should You Know About Usernames?
Find the key things to know before creating your WhatsApp username.
Why Are Activists Questioning WhatsApp?
Uncover the privacy concerns surrounding WhatsApp’s latest policy changes.
Why Did Meta Receive Notice?
Reveal why the Indian Government raised concerns over WhatsApp’s new feature.
How Can You Hide Your Location?
Learn how IP Protection Calls can help protect your location.
Device Linking Warning: The Setting You Should Not Ignore
A vital protection measure is the Device Linking Warning.
Users of WhatsApp can link their account to computers and other compatible devices. It is helpful, but there are cases where scammers may try to make their victims agree to maliciously link to their accounts.
The device linking warning is meant to offer more context in case the WhatsApp app suspects a malicious attempt to link with an unknown device. The information provided will give you a chance to think about it and then decline.
It is simple; if you did not create an attempt to link your device to an account, never allow it.
Silence Unknown Callers Can Reduce Scam Interruptions
Another useful feature is Silence Unknown Callers.
When enabled, calls from numbers that are not saved in your contacts are silenced rather than ringing normally. They can still appear in your Calls tab and notifications, so you do not completely lose the ability to see who attempted to contact you.
This can be particularly useful for users who frequently receive calls from unknown numbers.
It also reduces the pressure created by an unexpected call. A scammer cannot immediately put you into a high-pressure conversation simply because you answered a ringing WhatsApp call.
Screenshare Warnings Can Stop a Costly Mistake
Screen sharing has now emerged as yet another method adopted by fraudsters.
A fraudster may tell you that they would be required to assist with a bank-related problem and even ask you to start video conferencing and allow them access to your screen.
The problem here is that any information being displayed on your screen like OTP, bank alerts, passwords, or other sensitive data can come into view of the fraudster.
Screenshare Warning on WhatsApp is meant to warn users about screen sharing with people they do not know.
Context Cards Give You More Information Before You Respond
Another upcoming WhatsApp feature will be Context Cards, which would give users extra information about conversations and groups.
For example, whether a number has been saved, whether users are in the same group, whether the account has been created recently or if it has been created outside of a user’s country.
This does not mean that the user will automatically label someone as a scammer. It only means that the user would have additional details that could help them decide what kind of response is needed.
And it’s important to remember that the unknown or foreign number doesn’t mean it’s definitely a scammer, and the feature gives additional information.
Steps to Protect Your WhatsApp Account Immediately
The warnings are very useful for the users, however, it would also be good for people to check other security measures in WhatsApp.
Firstly, you should open your WhatsApp app and go to Settings > Account > Two-step verification. If two-step verification is enabled in your WhatsApp account, set up a unique PIN code which is different from your other passwords and codes.
Additionally, you should check Settings > Linked devices. Remove any computer or browser from your list of linked devices, if you notice some device which you don’t know.
Never give your WhatsApp verification code or two-step verification PIN code to anyone. Official WhatsApp representative won’t need these security credentials from you.
Be Careful With Files Sent Over WhatsApp
Given the new government advisory, this becomes especially crucial for professionals and organizations.
I4C has particularly issued warnings regarding malicious Windows executable files that masquerade as documents like bank statements and files purportedly related to the MCA or RBI. This campaign targets corporate executives and financial professionals and results in the compromise of user accounts along with major financial fraud.
It is clear from here that just because a file is received from a familiar contact does not mean it is safe to trust.
If any file is sent that is out of the ordinary regarding finances, regulation, or payments, the request needs to be independently verified before the file is opened or actioned upon.
Why These Features Matter for Indian Users
Since WhatsApp is deeply entrenched in the communications of Indians, the hijacking of such accounts is highly valuable for scam artists.
The hijacked account can be used to impersonate the person, contact relatives, reach out to colleagues, or conduct a financial scam. Once the user recognizes the identity of the contact, he or she will not be as suspicious.
Thus, the security features introduced by WhatsApp work by creating friction when necessary.
What You Should Never Do on WhatsApp
No security measure will offer any protection if the user chooses to disclose important details willingly.
Do not provide an OTP, WhatsApp registration code or 2FA PIN since someone claims that they are from WhatsApp, a bank, the police or any other agency.
Do not scan any unknown QR code just because someone claims that it is necessary for securing your account.
Do not download an application or open executable files sent via WhatsApp.
In case of unexpected contacts seeking money from you, please authenticate their identity over a phone call prior to sending any funds.
Conclusion
The anti-scam mechanisms introduced by WhatsApp show that the nature of internet scams is evolving. The app is moving away from solely relying on passwords and account protection and now is trying to identify the suspicious activity and alert users at the moment when a scam can be performed successfully.
By using device linking alerts, screen share alerts, context cards and Silence Unknown Callers, the risk of getting scammed or having your account hijacked can be reduced.
For users, however, the best way to avoid getting scammed is simple: Stop, verify and never disclose your security credentials to anyone.
