The Police would like to remind members of the public to remain vigilant against scams which compromises WhatsApp accounts through the use of fake “WhatsApp Web” phishing websites. These fake websites deceive users into authorising access to their WhatsApp accounts for scammers, who will then impersonate users to scam their family and friends. This advisory is pursuant to the advisories issued by Police on 27 October 2023 and 13 November 2023.
In these cases, victims who wished to access their WhatsApp accounts through their desktops would search for the official “WhatsApp Web” using online search engines. Thereafter, victims clicked on the first few search results generated by the online search engines without further verifying the Uniform Resource Locators (URLs) addresses due to convenience. However, these URLs do not point to the genuine WhatsApp Web website, but to fake phishing websites embedded with genuine QR codes extracted from official website of WhatsApp.
When victims use the QR code scanning function in WhatsApp on their mobile devices to scan the QR code in these phishing websites, they would notice that the websites would be unresponsive and did not lead the user to the WhatsApp Web’s interface on their desktops. At this time, the scammers would have already remotely gained access to the victims’ WhatsApp accounts. Scammers would then exploit these compromised WhatsApp accounts to impersonate the user and reach out to victims’ family or friends in their contact list and seek financial loans for a variety of reasons. Their family or friends would then receive request to transfer monies to unfamiliar bank accounts or PayNow numbers.
As the victims could still access their compromised WhatsApp accounts while scammers were concurrently using the victims’s accounts to conduct scam activities, the victims would only discover that their WhatsApp accounts were compromised when they were notified by their contacts of unusual requests such as asking for loans or to transfer monies from them.
The Police would like to advise members of the public to refrain from using “WhatsApp Web” and to adopt the following precautionary measures:
- Do not use “WhatsApp Web”. If there is a need to, always ensure that you are using the official WhatsApp Desktop App or visiting the official website from WhatsApp for “WhatsApp Web”. The official URL address is https://web.whatsapp.com;
- Never share your WhatsApp account verification codes, personal information, banking details and OTPs with anyone;
- Beware of unusual requests received over WhatsApp, even if they were sent by your WhatsApp contacts;
- Protect your WhatsApp account by enabling the ‘Two-Step Verification’ feature. This can be done by opening WhatsApp and go to ‘Settings’ > ‘Account’ > ‘Two-step verification’ > ‘Enable’;
- Check your linked devices regularly. Go to WhatsApp Settings > Linked Devices to review all devices linked to your account. To remove a linked device, tap the device > Log Out. For instructions on how to activate additional security features on WhatsApp, visit https://www.whatsapp.com/security; and
- Set a device code and be aware of who has physical access to your phone. Someone who has physical access to your phone might use your WhatsApp account without your permission.
If you have any information relating to such crimes or if you are in doubt, please call the Police Hotline at 1800-255-0000, or submit it online at www.police.gov.sg/iwitness. All information will be kept strictly confidential. If you require urgent Police assistance, please dial ‘999’.
For more information on scams, members of the public can visit www.scamalert.sg or call the Anti-Scam Helpline at 1800-722-6688. For instructions on how to activate additional security features on WhatsApp, visit https://www.whatsapp.com/security. Fighting scams is a community effort. Together, we can ACT Against Scams to safeguard our community!
SINGAPORE POLICE FORCE
05 December 2023 @ 10:27 AM