WhatsApp Account Impersonation Scam: How Fraudsters Pose as Family, Friends and Colleagues to Ask for Money

You receive a WhatsApp message from your father, close friend, colleague or boss.

The message says:

“I am in an emergency. Can you send ₹25,000 right now? I will explain later.”

Or:

“I am in a meeting. Please transfer the vendor payment immediately. I will share the bank details.”

The profile photo looks correct.

The name looks correct.

The WhatsApp account looks familiar.

But the person may not be who you think it is.

A WhatsApp impersonation scam happens when fraudsters take over a real WhatsApp account or create a lookalike account using someone’s photo and name. They then message the victim’s contacts, pretending to be that person, and ask for money, OTPs, verification codes, urgent transfers or sensitive business information.english.punjabkesari

The safest rule: If a familiar contact suddenly asks for money, OTP, a verification code or an urgent bank transfer, call them directly on their known phone number before acting.

Why This Scam Is Going Viral

This scam spreads fast because it uses trust.

You are not talking to a stranger.

You are talking to a name and photo you already trust:

• Your father
• Your mother
• Your spouse
• Your child
• Your close friend
• Your colleague
• Your manager
• Your CEO
• Your vendor
• Your customer
• Your accountant

That is why people act quickly.

They see:

text
Mummy
Rahul Bhai
Vikas Sir
Rohit CEO
Accounts Team

And they assume the message is genuine.

Fraudsters exploit that trust. They create urgency, claim an emergency, say they are in a meeting, or pressure you to act before you can verify. I4C has warned that criminals may compromise a senior executive’s WhatsApp account—or save an attacker-controlled number under the executive’s name—to instruct finance staff to make urgent transfers to mule accounts.indiatoday

How Fraudsters Take Over a WhatsApp Account

1. Fake QR-code linking

A scammer may send a QR code or link and claim it is needed for:

• WhatsApp verification
• Customer support
• Account recovery
• A job application
• A bank statement
• A delivery update

If you scan an unknown QR code, you may unknowingly link the scammer’s device to your WhatsApp account.

Rajasthan Police has warned that criminals use fake QR codes and malicious links to trick users into linking WhatsApp to unknown devices.

2. OTP and verification-code theft

A fraudster may call or message you saying:

“I sent a code to your phone by mistake. Please share it.”

They may claim to be WhatsApp support, a bank employee, a delivery agent, a government official or even a friend.

Never share:

• WhatsApp registration code
• OTP
• Two-step verification PIN
• SIM-swap code
• Bank OTP
• UPI PIN

WhatsApp says two-step verification adds another layer of protection to your account, and its help centre advises users to keep verification codes private.whatsapp

3. Malicious ZIP or EXE files

You may receive a file such as:

text
Statement_of_Account.zip
RBI_Notice.zip
MCA_Update.zip
Invoice.pdf.exe
Payment_Confirmation.zip

If you open it on a Windows computer, malware may compromise the device and hijack an active WhatsApp Web session.

I4C has warned that criminals use malicious files disguised as account statements or regulatory communications to take over WhatsApp accounts and spread the attack to contacts and groups.tribuneindia

4. Malicious apps and screen-sharing apps

Some scammers ask users to install:

• Remote-access apps
• Screen-sharing apps
• Fake customer-support apps
• APK files from WhatsApp or social media

These apps may expose SMS messages, notifications, OTPs or device controls.

Rajasthan Police has warned that malicious applications can gain access to SMS, notifications or accessibility permissions, allowing criminals to take control of accounts.

The WhatsApp “Boss Scam” in India

The most dangerous version targets businesses.

It is often called the Boss Scam, CEO fraud or executive impersonation fraud.

How it works

1. A fraudster contacts a CEO, director or finance professional while impersonating a regulator, bank or government department.
2. The victim receives a malicious ZIP file disguised as an RBI, MCA, Income Tax or account-statement notice.
3. Opening the file on a Windows computer may install malware and hijack WhatsApp Web.
4. The attacker then uses the compromised executive account—or a lookalike account—to message finance staff.
5. The fake “boss” says they are busy in a meeting and asks for an urgent payment to a new bank account.
6. The employee transfers money without verifying by phone or in person.

I4C has specifically warned corporates and finance professionals about this pattern and advised organisations to verify urgent transfer requests through a direct voice call or in-person confirmation.indiatoday

10 Red Flags of WhatsApp Impersonation

Be suspicious if you see any of these signs:

1. A familiar contact suddenly asks for money.
2. The person says it is an emergency and asks you not to call.
3. They say they are in a meeting and cannot talk.
4. The message asks for an OTP, verification code or two-step verification PIN.
5. They ask you to scan a QR code.
6. They send a ZIP, EXE, APK or unknown file.
7. The account has a new phone number but the same photo and name.
8. They ask you to transfer money to a new bank account.
9. A “boss” asks finance staff to make an urgent vendor payment.
10. The message pressures you to act immediately.

What To Do If You Receive a Suspicious WhatsApp Message

Step 1: Do not send money

Stop before you pay.

Even if the message comes from a familiar name, do not transfer money until you verify.

Step 2: Call the person directly

Use the phone number saved in your contacts.

Do not call the number provided in the suspicious WhatsApp message.

Ask a question only the real person would know.

Step 3: Check the profile and number

Tap the contact’s profile and check:

• Phone number
• About section
• Profile photo
• Whether the number has changed
• Whether the account asks for unusual actions

If the number is new, be extra cautious.

Step 4: Do not share OTP or PIN

Never share:

• WhatsApp verification code
• Two-step verification PIN
• Bank OTP
• UPI PIN
• Card CVV
• Passwords

No genuine WhatsApp employee, bank official, government officer or family member needs these details.

Step 5: Report and block the account

In WhatsApp:

text
Open chat → Tap contact name → Report contact → Block contact

If it is a group message, report the suspicious sender and warn other group members.

Step 6: Warn your contacts

If your account has been compromised, immediately tell your contacts:

“My WhatsApp may be compromised. Do not open files or send money based on messages from my account.”

I4C advises users whose accounts are compromised to alert contacts not to open files received from that account.

What To Do If Your WhatsApp Account Is Hacked

Act immediately.

Step 1: Log out of all linked devices

Go to:

text
WhatsApp → Linked Devices

Log out of every device you do not recognise.

WhatsApp allows users to manage linked devices from the Linked Devices section.whatsapp

Step 2: Re-register your WhatsApp account

Install WhatsApp on your phone and verify your number again.

This can log the attacker out of the account.

Step 3: Enable two-step verification

Go to:

text
WhatsApp → Settings → Account → Two-step verification

Create a strong PIN and add a recovery email.

WhatsApp describes two-step verification as an optional feature that adds an extra authentication layer to your account.whatsapp

Step 4: Scan your computer

If you opened a suspicious ZIP or EXE file, disconnect the computer from the internet and scan it with updated antivirus software.

I4C specifically advises scanning affected computers after a suspected WhatsApp account takeover.

Step 5: Inform your bank if money was sent

If you transferred money:

• Call your bank immediately
• Report the transaction
• Request a fraud recall where possible
• Change banking passwords
• Secure UPI access

Step 6: Report cyber fraud

If money was lost or account access was compromised:

text
Call 1930 immediately.

Then file a complaint at:

text
https://cybercrime.gov.in

Save screenshots, chat messages, phone numbers, bank-account details, transaction IDs and call recordings where legally permitted.

How To Protect Your WhatsApp Account

Enable two-step verification

This prevents someone from re-registering your number without the PIN you created.

Never scan unknown QR codes

Do not scan QR codes sent by strangers, unknown websites, WhatsApp messages or social-media ads.

Never share verification codes

A verification code is for you only.

No legitimate support agent will ask for it.

Review linked devices regularly

Check:

text
WhatsApp → Linked Devices

Remove devices you do not recognise.

Do not open unexpected files

Do not open:

• ZIP files
• EXE files
• APK files
• Unknown documents
• “Bank statement” attachments
• “RBI notice” attachments
• “Invoice” files from unknown senders

Verify every payment request

For businesses, create a strict rule:

No bank transfer, vendor-payment change or urgent payment instruction is valid based only on WhatsApp or email.

Always verify by:

• Direct voice call
• Video call
• In-person confirmation
• Known official contact number

Hindi: WhatsApp इम्पर्सनेशन स्कैम से कैसे बचें

text
WhatsApp पर परिचित नाम या फोटो से आया मैसेज
हमेशा असली व्यक्ति का नहीं होता।

हैकर WhatsApp अकाउंट हैक करके या नकली प्रोफाइल बनाकर
परिवार, दोस्त, कर्मचारी या बॉस के नाम से पैसे मांगते हैं।

अगर कोई पैसे, OTP, वेरिफिकेशन कोड या बैंक ट्रांसफर मांगे,
तो पहले उसके असली नंबर पर कॉल करके पुष्टि करें।

कभी भी OTP, WhatsApp कोड या Two-Step Verification PIN शेयर न करें।

अज्ञात QR कोड स्कैन न करें और ZIP, EXE या APK फाइल न खोलें।

अकाउंट हैक हो जाए तो Linked Devices से लॉग आउट करें,
दो-स्तरीय सत्यापन चालू करें और तुरंत 1930 पर कॉल करें।

Gujarati: WhatsApp ઇમ્પર્સનેશન સ્કેમથી કેવી રીતે બચવું

text
WhatsApp પર પરિચિત નામ કે ફોટોથી આવેલો મેસેજ
હંમેશા અસલી વ્યક્તિનો ન હોઈ શકે.

હેકર્સ WhatsApp એકાઉન્ટ હેક કરીને કે નકલી પ્રોફાઇલ બનાવીને
પરિવાર, મિત્ર, કર્મચારી કે બોસના નામે પૈસા માંગે છે.

જો કોઈ પૈસા, OTP, વેરિફિકેશન કોડ કે બેંક ટ્રાન્સફર માંગે,
તો પહેલા તેના અસલી નંબર પર કૉલ કરીને ખાતરી કરો.

ક્યારેય OTP, WhatsApp કોડ કે Two-Step Verification PIN શેર ન કરો.

અજાણ્યા QR કોડ સ્કેન ન કરો અને ZIP, EXE કે APK ફાઇલ ખોલો નહીં.

એકાઉન્ટ હેક થઈ જાય તો Linked Devicesમાંથી લોગ આઉટ કરો,
ટુ-સ્ટેપ વેરિફિકેશન ચાલુ કરો અને તરત 1930 પર કૉલ કરો.

How ScamShield AI Helps

ScamShield AI helps users and businesses review suspicious messages before they click, download, share codes or transfer money.

Use ScamShield AI to assess:

• WhatsApp messages asking for urgent money
• “Boss” payment instructions
• Fake CEO or director messages
• Suspicious vendor bank-detail changes
• QR-code messages
• OTP and verification-code requests
• ZIP, EXE and APK file messages
• Fake customer-support chats
• WhatsApp account-takeover warnings
• Business payment fraud messages

ScamShield AI can help identify warning signals, but it should not replace direct verification with the real person.

If a familiar WhatsApp contact asks for money urgently, stop. Call them on their known number first.

Frequently Asked Questions

What is a WhatsApp impersonation scam?

A WhatsApp impersonation scam is when fraudsters use a hacked account or fake profile to pose as a family member, friend, colleague, CEO or official. They then ask contacts for money, OTPs, verification codes or urgent bank transfers.english.punjabkesari

How do fraudsters hack WhatsApp accounts?

They may trick users into scanning fake QR codes, sharing OTPs or verification codes, installing malicious apps, or opening malicious ZIP or EXE files that compromise WhatsApp Web sessions.english.punjabkesari

Can a hacked WhatsApp account be recovered?

Yes. Log out of unknown linked devices, re-register your number on WhatsApp, enable two-step verification, alert contacts and scan any affected computer for malware.whatsapp

What is the WhatsApp Boss Scam?

The Boss Scam is a business fraud in which criminals impersonate a CEO, director or senior executive through WhatsApp and instruct finance staff to make urgent payments to fraudulent accounts. I4C has warned Indian corporates and finance professionals about this scam.indiatoday

Should I send money if the message comes from my parent’s WhatsApp?

No. First call the person directly on their known phone number. A hacked account can still show the correct name and profile photo.english.punjabkesari

What should I do if I shared a WhatsApp verification code?

Immediately log out of all linked devices, re-register your WhatsApp number, enable two-step verification, warn contacts and report suspicious activity. If money was transferred, call your bank and report to 1930.whatsapp

Final Takeaway

A familiar WhatsApp name is not proof of identity.

A profile photo is not proof of identity.

An urgent message is not proof of identity.

Remember:

Never send money, OTP or verification codes based only on a WhatsApp message.

Call the real person first.

For businesses, verify every payment instruction through a known voice call or in-person confirmation before transferring funds.