New fraud method on WhatsApp: They imitate your correspondence and target your relatives

New methods are being used in cyber fraud attempts targeting messaging applications such as WhatsApp and Telegram. Attackers who gain unauthorized access to accounts imitate users' communication style by examining past correspondence. Then, through the seized accounts, a message is sent to the person's relatives under the excuse of "urgent debt" and asks for money.

Lecturer İbrahim Gündüzgil, Head of the Cyber ​​Security Program at Istanbul Commerce University, stated that attackers used fake links, phishing and social engineering methods.

Stating that security vulnerabilities in outdated operating systems and applications can also pave the way for attacks, Gündüzgil said that this risk is not limited to WhatsApp only, but similar methods can also be used in other messaging applications such as Telegram.

UPDATE WARNING TO IPHONE USERS

Gündüzgil stated that they have recently received applications stating that the WhatsApp accounts of devices with the iOS operating system have been compromised, and that they have encountered problems arising from devices that have not been updated in their work.

Recommending users to enable two-step verification for account security, Gündüzgil emphasized that verification codes sent via SMS or application should not be shared with anyone. Pointing out the importance of regularly updating the operating systems and applications of the phones, Gündüzgil asked that the devices connected to the accounts and open sessions be checked.

Stating that services such as WhatsApp Web and Telegram Desktop may also pose a security risk, Gündüzgil said that accounts can be accessed through sessions left open on untrusted computers and fake QR codes. Stating that attackers can access their accounts through another device while users continue to use their phones normally, Gündüzgil stated that unrecognized devices should be disconnected.

WHAT SHOULD THOSE WHO HAVE HAD THEIR ACCOUNTS DO?

Istanbul Commerce University Computer Programming Program Head Lecturer Sabri Erdemir stated that people whose accounts have been compromised should first protect digital evidence. Recommending that screenshots of suspicious messages, links, phone numbers, bank account information requesting money and transfer receipts, if any, be kept, Erdemir said that the date and time of the incident should also be recorded.

Erdemir emphasized that cutting off the internet connection on devices with suspected remote access may limit the attacker's intervention, but this alone may not be sufficient in cases where only the messaging account is compromised. He also stated that, if possible, the device should not be reset and applications should not be deleted in order to prevent digital records from being lost.

Erdemir noted that in case of financial loss, the relevant bank should be contacted immediately, the suspicious transaction should be reported and a request should be made to stop or reverse the transfer, and asked the victims to apply to the Chief Public Prosecutor's Office or the police and gendarmerie units with the evidence they have.

Stating that the person whose account is compromised cannot be automatically held responsible for the fraudulent activities carried out by the attackers, Erdemir stated that account access records, IP addresses, device data and bank transactions are examined together to detect the perpetrators. Emphasizing that an IP address or bank account alone will not definitively reveal the identity of the perpetrator, Erdemir said that correlating digital evidence is decisive in investigations.