WhatsApp Web Hijack for Corporate Fraud

How WhatsApp Web Hijack for Corporate Fraud Works

Overview: In this sophisticated scam, attackers compromise office computers or WhatsApp Web sessions to send financial requests from the real executive’s account. Staff believe they’re chatting with their CEO, making them more likely to approve huge payments. This scam leads to multi-crore losses, especially in IT-savvy Indian companies, and is often unnoticed until after the funds are gone. How It Works: Hackers gain access to office computers through phishing, weak passwords, or USB malware. They check if WhatsApp Web is logged in (often left open by executives). The fraudster then messages accounts or finance staff directly from the boss’s WhatsApp, issuing urgent requests. These requests include NEFT/RTGS details for accounts controlled by the scammer. The staff, recognizing the number and profile, treats it as genuine and transfers funds. Sometimes, fraudsters follow up for multiple rounds of theft before suspicions arise. India Angle: This scam is increasing in cities with large corporate offices – Hyderabad, Bengaluru, Gurgaon – where executives use WhatsApp Web. Companies with hybrid or shared desktops and limited IT security are at higher risk. Targeted staff are often junior or mid-level, less likely to question a message from the CEO’s official number. Real Examples: - CEO is traveling; accounts staff receive WhatsApp Web messages asking to transfer Rs 80 lakh to an ‘urgent’ beneficiary. - After the initial fraud, further WhatsApp messages claim technical issues at the vendor and ask to redirect funds elsewhere. - IT discovers an unknown device listed in the CEO’s WhatsApp Web, later found to be controlled by a hacker. Red Flags: 1. Financial requests via WhatsApp during odd hours or holidays. 2. Large transfers demanded solely over WhatsApp. 3. CEO or executive not reachable by usual means, including calls or emails. 4. New beneficiaries or bank accounts not found in records. Protective Measures: - Log out of WhatsApp Web after each use, especially in shared environments. - Use strong, unique passwords and enable two-step verification on all devices. - Train staff to be wary even of requests from official numbers if context is suspicious. - Monitor WhatsApp account security for unknown devices. If Victimised: - Immediately freeze the outgoing accounts at both your and the recipient’s bank. - Call 1930, report at cybercrime.gov.in, and lodge an FIR. - Preserve all message details and device logs for police and IT teams. Related Scams: - Spear-phishing attacks that steal WhatsApp Web QR codes. - Remote desktop malware that exploits corporate systems. - Email phishing to gain social engineering information on staff.

How This Scam Works — Detailed Explanation

In today's digital landscape, scammers have become increasingly sophisticated, especially when targeting corporate entities through platforms like WhatsApp. The initial approach often starts with the exploitation of vulnerabilities within an organization's IT setup. Hackers may use phishing emails that appear official, containing malicious links or attachments, to gain access to office computers. This is further compounded by weak passwords or the use of USB devices that carry malware. Once they gain entry, they can log into WhatsApp Web using the compromised account, thus positioning themselves to manipulate company operations. Given the high penetration of messaging platforms like WhatsApp in Indian corporate communication, this tactic has proven effective for scammers.

Once inside, attackers utilize various psychological tricks to manipulate staff members into compliance. They send messages that appear to come from their CEO or other high-ranking officials, often requesting large payments for urgent business needs. The overwhelming nature of corporate environments, coupled with a 'just do it' culture concerning executive orders, leads to immediate compliance from staff. For example, a request for a ₹10 lakh fund transfer might be issued late in the evening, accompanied by urgency and vague justifications, making it seem pressing and legitimate. As such, even the well-informed staff may find themselves cornered, compelled to act swiftly.

Victims of this scam are often unaware until it is too late. Imagine a finance executive receiving a WhatsApp message from the CEO asking for a payment to an unknown external vendor due to an 'urgent' project. The executive may immediately comply, resulting in significant fund transfers. In cases reported by the Indian banking sector, such as a scam where ₹45 crore was siphoned off from a firm in Bengaluru due to a WhatsApp message, victims realize the miscommunication only after verifying the authenticity through a phone call or official email — which usually leads to bleak realizations, as these scammers often go dark after the transactions have completed.

The financial impact on Indian businesses has been staggering, with recent reports indicating a loss of ₹300 crore across various sectors affected by similar scams in 2022 alone. Guidelines issued by the RBI emphasize the need for secure transactions, yet many companies remain vulnerable to the psychological aspect of such scams. Moreover, CERT-In has constantly pointed out the risks associated with inadequate cybersecurity protocols, especially in organizations that operate without comprehensive awareness or safeguards against social engineering tactics.

To differentiate between legitimate communications and scams, it's crucial to remain vigilant. For instance, a request coming unexpectedly outside of normal hours should raise flags. Also, if an executive is unreachable through established communication channels such as direct calls or official emails, that is a clear red flag. Another crucial indicator is requests for financial transactions that deviate from the recognized vendor list, as legitimate companies usually maintain strict protocols for payment requests. Recognizing these indicators early can help prevent further financial losses and stem the tide of corporate fraud.

Visual Intelligence:

BharatSecure's AI has identified this as a used in scams targeting Indian users.

Who Does WhatsApp Web Hijack for Corporate Fraud Target?

General public across India

Red Flags — How to Identify WhatsApp Web Hijack for Corporate Fraud

• WhatsApp requests for payments from real executive profile
• Large fund transfer requests outside normal protocols
• Messages during odd hours or when executive is unavailable
• Executive unreachable by call or official email
• Requests for new bank accounts not in vendor lists

What To Do If You Encounter WhatsApp Web Hijack for Corporate Fraud

1. Report any suspicious WhatsApp messages to the cybercrime helpline at 1930 or visit cybercrime.gov.in.
2. Verify the identity of the sender by calling the executive directly using a verified number, not through WhatsApp.
3. Contact your bank immediately using helplines (SBI 1800-11-1109, HDFC 1800-202-6161) to freeze any unauthorized transactions.
4. Educate employees about recognizing red flags and implement training sessions for better awareness.
5. Regularly update passwords and use two-factor authentication wherever possible to enhance security.
6. Consult cybersecurity professionals for risk assessments and better defense mechanisms against such scams.

How to Report WhatsApp Web Hijack for Corporate Fraud in India

• Call 1930 — National Cyber Crime Helpline (24x7)
• File a complaint at cybercrime.gov.in
• Contact your bank immediately if money was lost
• Call RBI helpline: 14440 for banking fraud

Frequently Asked Questions

What to do if I shared my OTP in a WhatsApp scam?

Immediately contact your bank's helpline to report the incident and monitor your account for any unauthorized transactions. Additionally, report the scam at cybercrime.gov.in.

How can I identify if a WhatsApp request is a scam?

Look for unusual requests, especially outside of normal hours, large transaction amounts, or requests that ask for new bank account details not on your vendor list.

How to report this type of scam in India?

You can report these scams by calling the cybercrime helpline at 1930 or by filing a report on cybercrime.gov.in. Additionally, notify your bank to prevent losses.

How can I recover money or protect my accounts after falling victim to this scam?

Contact your bank immediately to report unauthorized transactions and initiate a recovery process. Ensure to change all passwords and implement stronger security measures on your accounts.

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.