Rwanda National Police

The general public is called upon to be “conscious and vigilant” against the increasing ‘WhatsApp identity theft’ fraudsters.

With Rwandans, public and private entities finding an opportunity in using this social media platform—WhatsApp—as a tool that ease communication and dissemination of information in particular, criminals have started targeting and stealing people's  WhatsApp accounts.

As an efficient tool that is used on daily basis for communication as well as connecting people, there is need to secure it and ensure that information is not accessed by unwanted persons, more so criminals, who are also taking advantage to dupe unwitting WhatsApp users through identity theft.

WhatsApp Identity Theft

Identity theft is when thieves steal your personal information in order to take over or open new accounts, file fake tax returns, rent or buy property, or do other criminal things in your name.

Criminals have, therefore, found opportunity in using victims’ WhatsApp Identity (Number/contacts) in order to commit fraud (lending money in the name of the unsuspecting victims through money transfer like MTN Mobile Money, Tigo Cash, Airtel Money) or to spread heinous messages or for harassment, etc.

How the fraud is done

Criminals endeavor to know their target’s mobile number (07XXXXXXXX). He/She registers the number on his/her smartphone WhatsApp and wait for the account to be verified.

WhatsApp sends an SMS that contains a verification code, to the authentic SIM card owned by the victim.

In order to get the verification code, the criminal calls the victim or sends an SMS or WhatsApp message or other social media used by the victim; claiming that there is a message mistakenly delivered to you by WhatsApp and, therefore, requires you to forward it or read it to the caller (criminal). And just like that, the criminal acquires the verification code, introduces it in WhatsApp and gains control of your WhatsApp account.

From there, criminals will access all your WhatsApp communications and all groups that you are subscribed to. When using Web WhatsApp (used on computer), the criminal will also access your chat history.

The criminal chooses a contact on victim’s contact list (either in chat history or group members) and write to them requesting to transfer money to a third party number.

The criminal continues by gaining control of other WhatsApp account and committing more frauds.  

Take an example of events like wedding, graduation, burial and other parties where people use WhatsApp groups for communication and financial contribution; through WhatsApp identity theft, criminals may come in the name of the person known to all group members to be receiving these pledges. And pledges will be sent to criminals unknowingly.

Prevention

Enable WhatsApp two step verification: go to settings, Account, Two-step verification, and choose a 6 digits code that will allow you to verify your account.

In any circumstance do not share the content of SMS received from WhatsApp (confirmation code).

Lock WhatsApp: Your device lock screen feature is not enough to secure your Whatsapp. So, you have to lock your WhatsApp for more security.

Always Logout from WhatsApp Web: Log out from all computers that you see in the list under WhatsApp Web. This will stop hackers from reading your chats further.

Do not share your phone with anyone: You should not share your phone with strangers because anyone can steal your WhatsApp account, data, or install spying software.

Do not install Apps from unauthorized or unknown sources: Always install Apps from Google play store.

Please check developer details, ratings, reviews of any App before installing it on your phone.

Do not connect your phone to unknown Wi-Fi connections as hackers can also use the unique MAC address to access all your WhatsApp chats.

In case there is a person requesting that verification/confirmation code, your WhatsApp Account is already stolen and you cannot send or receive messages; always be quick to notify the Rwanda National Police (RNP) Cyber Security Directorate on 0788311087 or 0788311525 and Emergency toll-free line—112.

Also notify WhatsApp group admins to remove your number from the groups and notify group members that your account has been compromised.

Be responsive to send an SMS to all contacts notifying them to ignore any WhatsApp message that originates from the number you were using, as it has been compromised.

Record and share any number sent to you for money transfer, to the RNP Directorate of Cyber Security for prompt follow-up.