Phishing scam gives you full access to your WhatsApp account

There are many scams on the internet. If you are not careful, you can quickly give important passwords to fraudsters and potentially lose a lot of money. In phishing, for example, criminals pretend to be reputable institutions and trick the victim into giving them sensitive information such as credit card details. Not all methods are easy to expose. The more trustworthy they look, the better they work.

On Reddit, a user posted a screenshot from a German-language text message chat history. It shows a phishing attempt that is easily recognisable from the spelling. The tricky thing is that the message is displayed in the same chat history as older genuine text messages for two-factor authentication for WhatsApp. In other words, the message appears to come directly from WhatsApp. This lends the message authenticity: the supposed sender has already proven to be trustworthy through previous messages.

Full access to the WhatsApp account is possible

The text message states that the recipient's WhatsApp account will be blocked. They should check the process on an external site. According to Heise, the website, which is no longer active, gave the impression of being a reputable WhatsApp site.

A German-language chatbot guided the visitor through the "verification process", which was actually used to gain access to the WhatsApp account. The fraudsters took advantage of the regular WhatsApp link between smartphone and browser.

The purpose of the link is actually to allow you to use your WhatsApp account in your browser. Once the link has been established, the criminals have full access to the account: They can read all messages and send some themselves under the victim's name - because WhatsApp considers them to be the owner of the account.

This opens up numerous opportunities for fraudulent tricks. Compromising material could be collected, for example. The fraudsters could also use the account to write to its contacts and thus obtain further data under the highest level of legitimacy.

You can also check the devices linked to your WhatsApp account and delete them if necessary. Open WhatsApp on your smartphone. Tap on the three-dot menu at the top right and select "Linked devices". Here you will find the connected browsers and when WhatsApp was last active in them.

Caution is the be-all and end-all

Many phishing attempts can be recognised by the fact that the messages are not spelled correctly. However, with the help of AI, the texts are getting better and better and a correct spelling does not mean that it is a legitimate message. Take a close look at the sender and their details, a foreign dialling code often indicates a scammer.

Caution is also advised with messages from supposed acquaintances. Does the person write differently than usual? Are they using (different) emojis? Do they need money quickly? If you are unsure, you should contact the person or organisation in question by other means and ask.

If you receive links, you should check very carefully that the URL is correct and does not contain any additional letters.