# MA-994.122023: MyCERT Alert - Scammers using Compromised WhatsApp Account for Impersonation and Deceive Victims to Transfer Money

**Date:** 04 Dec 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-994.122023  
**Advisory ID:** MA-994.122023

---

**1.0 Introduction**
The Cyber999 Incident Response Centre has been aware of scammers exploiting WhatsApp applications, often posing as someone you know or a well-known person or entity. The scammers are usually pretty good at creating a sense of urgency, claiming that an immediate response is required to avoid an unpleasant outcome. Common scam techniques include texts saying a loved one is in imminent danger or needs cash urgently to help them out of a crisis. However, scammers constantly design new methods to align with current national or global circumstances.
**2.0 Impact**
Scammers or impersonators may use stolen identities to carry out scam activities, leading to substantial monetary losses for victims. This happens because victims are deceived into trusting the scammers or impersonators as their genuine friends or family members.
**3.0 Brief Description**
The scammer sends a link and asks the victim to click on it. Upon clicking the link, the users unknowingly lose access to their WhatsApp accounts. Once the scammer has control over the hacked WhatsApp account, the genuine owner of the WhatsApp account will be logged out. The scammer will now pretend to be the genuine WhatsApp account owner. The scammer will now request money from the WhatsApp contacts by sending WhatsApp messages asking to transfer money, often under the guise of an emergency with promises of repayment. Sample WhatsApp communications between the scammer and victims are in Figure 1. It is noticeable from Figure 1 that the scammer uses the same script in their attempts to deceive victims to transfer money to them. The bank account that the scammer asks victims to transfer money is a local commercial bank account.
Additionally, the scammer may also use the hacked account to proceed with other criminal activities. In some cases, the criminals even extort their victims, coercing them to invest in cryptocurrency to regain access to their WhatsApp accounts.
*Figure 1: Sample WhatsApp message conversations between the scammer and victims*4.0 Recommendations**
Staying safe on WhatsApp starts by knowing how to recognise the most common types of scams. Below are some additional tips to avoid from becoming a victim.
- **Verify the identity of the sender of the WhatsApp message**
- Any unusual messages from your friends or family members should be treated as precautions. Second-guess any supposed family members or acquaintances reaching out from new numbers. If the person claims they are someone you know, consider whether their writing matches their usual communication style. You can also ask the scammer a question such as only your relative or friend would know the answer. You are required to verify with your friends or family members if they have sent a message asking to transfer money.
- **Avoid clicking on external links**
- Don't click any links, attachments or phone numbers provided in the text sent over the Internet. If you are unsure of whether it’s a legitimate site, search for the company or agency's official contact information online. Contact the supposed person or entity directly to assess the situation.
- **Enable two-factor authentication for your WhatsApp account**
- Set up two-factor authentication. This security measure prevents someone from accessing your WhatsApp account if they try to open it from another mobile device.
- **Report suspicious messages and contacts**
- Report and block any conversations with users that are suspicious and asking to transfer money. It’s better to act swiftly and cut communication once you have identified a potential scam. Please refer to the link on how to report abuse about the scammer onis advised WhatsApp.
- <https://faq.whatsapp.com/573786218075805>
- **Victims are advised to report to WhatsApp Messenger application support immediately if their WhatsApp account has been taken over by a scammer.**
- WhatsApp has created a set of self-serving tools that its users can use.
- Sign in to your WhatsApp account with your phone number and verify your phone number by entering the 6-digit code you receive via SMS. More details can be retrieved from the following article:
- How to recover your account? <https://faq.whatsapp.com/general/account-and-profile/stolen-accounts/>
- To contact Whatsapp Messenger Support, you can fill out this form. <https://www.whatsapp.com/contact/?subject=messenger>
- Or user is advised to email Whatsapp support at: [[email protected]](/cdn-cgi/l/email-protection#3a494f4a4a55484e7a4d525b4e495b4a4a14595557)
- For more information, you can go to Whatsapp’s FAQ:
- Lost and stolen phones: <https://faq.whatsapp.com/general/account-and-profile/lost-and-stolen-phones>
- If you receive a verification code without requesting it, please refer below: <https://faq.whatsapp.com/general/received-verification-code-without-requesting-it>
- **Victims who have already transferred money to the scammer are advised to contact the National Scam Response Centre (NSRC) immediately.**
- Contact the National Scam Response Center (NSRC) via the following channels:
- NSRC Hotline: Dial 997 (8 am - 8 pm, every day, including public holidays)
- Website/Frequently Asked Questions (FAQ) regarding the NSRC: <https://nfcc.jpm.gov.my/index.php/soalan/about-nsrc>
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://us.norton.com/blog/online-scams/whatsapp-scams#:~:text=FAQs%20about%20WhatsApp%20scams&text=WhatsApp%20is%20a%20safe%20way,code%2C%20or%20divulge%20personal%20information>.
- <https://faq.whatsapp.com/573786218075805>