Experts say that phone operating systems and applications should be updated regularly to protect against WhatsApp account takeover attempts. Fraud complaints, especially through messaging applications, are increasing.
WhatsApp account takeover: How do attackers act?
There are cyber attacks targeting iPhone users and WhatsApp around the world and in Türkiye. Additionally, personal accounts are infiltrated and past correspondence is analyzed.
Thanks to the spy software, the victim's speaking style is followed exactly. Then, a message is sent to the victim's relatives under the pretext of "urgent debt". Moreover, the money is requested via IBAN.
According to Lecturer İbrahim Gündüzgil, Head of the Cyber Security Program at Istanbul Commerce University Vocational School, attackers generally use fake links, phishing and social engineering methods. Additionally, security vulnerabilities in systems that are not updated can also be exploited.
However, the problem is not limited to WhatsApp only. For example, accounts or active sessions in Telegram and similar applications can be compromised. According to Gündüzgil, the problem arises from the combination of technical vulnerabilities and user behavior.
What Precautions Should Users Take?
Gündüzgil recommends turning on two-step verification first. Additionally, verification codes received via SMS or the application should not be shared with anyone to avoid the risk of WhatsApp account takeover. Because updates not only bring new features but also close detected vulnerabilities.
Connected devices and active sessions should be checked.
Access of unrecognized devices should be terminated.
For money requests from acquaintances, identity must be verified through another communication method.
The user who suspects his account should immediately initiate account recovery steps and inform his relatives.
Gündüzgil states that both Android and iOS users can be targets. Still, most of the recent submissions come from people using iOS. According to studies, the problem is caused by devices that have not updated iOS.
WhatsApp Web and Telegram Desktop also pose risks. Because sessions left open on untrusted computers, malicious software and fake QR codes can lead to unauthorized access. Therefore, while the user is using his phone normally, the attacker can log into the account from another device.
What to do after WhatsApp account takeover?
Lecturer Sabri Erdemir, Head of the Computer Programming Program at the same university, recommends protecting digital evidence. For example, screenshots of suspicious messages, links, phone numbers, bank account information, receipts, and the date and time of the incident should be stored.
If remote access is suspected, disconnecting the internet may limit the attacker's ability to intervene. However, if only the messaging account is compromised, this step may not prevent the attacker from logging in from another device. That's why Erdemir wants device and account security to be evaluated separately.
If possible, the device should not be reset and applications should not be deleted. If there is a financial loss, the bank should be called without wasting time. In addition, even if there is no loss, you should apply to the Chief Public Prosecutor's Office, police or gendarmerie. Because the compromised account can later be used in other frauds.
According to Erdemir, the victim of WhatsApp account takeover does not automatically become responsible for the fraud. Because access and session records, IP addresses, device data and bank transactions can be examined. However, a single IP address or account does not necessarily indicate the identity of the perpetrator. However, when the evidence is linked together, it is possible to identify the perpetrators.
