Be careful where you scan for WhatsApp Web.
A few of my colleagues had their WhatsApp accounts hacked and taken over by scammers. As a result, all the contacts in their phone books were pulled down by hackers and used for malicious purposes.
The Whatsapp hack works by tricking the victim into scanning a fake WhatsApp Web QR code, which captures all the login credentials of the victim. Usually the url that contains the WhatsApp Web QR code is setup to be almost similar to the actual Whatsapp Web side with differences in some of the characters or permutation in words.
After all the victim's contacts are pulled down, the scammers will create a group with everyone (from the contacts) inside and then will present some sketchy investment plan to all the contacts in hope of fishing someone into investing.
.jpg)
.jpg)
Usually, the admin of the group uses 011 starting numbers, which are notoriously abused by scammers. These scammers often have very attractive Chinese women as their profile picture.
.jpg)
Deep within the group, there are usually a few accomplices of the scammer posing as contacts. They will send positive messages or positive queries to make the scam seem like a genuine investment opportunity.
In the end, make sure you access WhatsApp Web at web.whatsapp.com and not any other URL. For added security, it is best to avoid using WhatsApp Web altogether and instead use the WhatsApp Windows or Mac native app. Although WhatsApp Web is convenient for using WhatsApp on any PC (e.g., airports, cybercafΓ©s), the security risks far outweigh the benefits. I strongly advise against using WhatsApp Web on a public terminal.
Above is the apology SMS from the victim to his friends. Sometimes, it may be too late, as some friends might have already been scammed of their hard earned money.