In a recent update, the Singapore Police issued an advisory warning people about a new phishing scam that uses fake WhatsApp Web websites. Due to the interconnected and always-online nature of the world today, this issue applies to every WhatsApp user, not just Singaporeans.
These phishing websites trick users into authorising access to their WhatsApp accounts for scammers. These websites work by taking advantage of a victim’s use of search engines to find the official WhatsApp Web website.
While using online search engines, victims tend to click on one of the first few search results generated by online search engines without verifying the URL addresses due to convenience, according to the Singapore Police.
Unfortunately, some of these are phishing websites embedded with a genuine QR code taken from the official website. When victims scan the QR codes, the websites become unresponsive and they are not taken to the official WhatsApp Web page.
These scammers who run the phishing websites will then have the opportunity to gain remote access to the victims’ WhatsApp accounts.
They will then attempt to communicate with the victim’s contacts, asking for personal details so that they may gain access to the victim’s online banking accounts. In some cases, they ask for money to be transferred to a bank account.
According to the Singapore Police Force, victims can still access their WhatsApp accounts while the scammers are using it concurrently. This means that the victims will only be aware that their accounts have been compromised when their contacts tell them about the unusual requests.
In order to prevent such a situation, the police urged members of the public to take precautionary measures, such as:
- Ensuring that they are using the official WhatsApp desktop app or visiting the official website
- Never sharing their account verification codes, personal information, banking details and one-time passwords (OTPs) with anyone
- Beware of unusual requests received over WhatsApp, even if they were sent by their contacts
- Enabling two-step verification
- Checking their linked devices regularly
- Setting a device code and being aware of who has physical access to their phone
Read More: I Have Been Scammed! Now What?
