WhatsApp hackers exploit QR Codes, OTPs, and call forwarding

Pakistan is facing a cyber threat as the National Computer Emergency Response Team (CERT) has issued an urgent warning about a sharp rise in WhatsApp account hijackings. Experts say this threat is widespread and highly effective.

Unlike traditional hacking, attackers are not exploiting technical flaws. Instead, they trick users into sharing verification codes or enabling call forwarding, giving criminals full access to accounts. Once hacked, these accounts are used for impersonation, financial scams, data theft, and spreading malware.

Everyone is at risk—from everyday users to professionals and businesses. Companies using WhatsApp for official communication could face fraud similar to email scams, but through a trusted messaging app.

How WhatsApp Accounts Are Being Hacked

• OTP Scams: Hackers pose as WhatsApp support, telecom staff, or contacts to steal six-digit verification codes.

• Call Forwarding Exploits: Users are tricked into entering codes that redirect calls to the attacker.

• Phishing Links: Fake alerts or prize messages lead to fraudulent login pages.

• QR Code Scams: Malicious QR codes link victims’ accounts to hackers’ devices.

Signs your account may be under attack include sudden logouts, unknown “Linked Devices,” unexpected verification prompts, or friends receiving suspicious messages from your account. If you get a verification code you didn’t request, act immediately.

Hijacked accounts can lead to financial loss, identity theft, privacy breaches, and reputational damage. Attackers often request money from friends or spread malicious content using stolen accounts.

How to Protect Your Account

• Enable Two-Step Verification with a recovery email.

• Never share verification codes or PINs with anyone.

• Regularly check Linked Devices and call forwarding settings.

• Avoid suspicious links and QR codes.

• Verify unusual requests through other channels before responding.

The agency warned, “Secure your accounts immediately. Be vigilant against unsolicited requests. Educate others—especially vulnerable users. Cybercriminal tactics are evolving, but basic security practices and fast response remain your best defense.”

Read More: E-challan fine rates in Karachi likely to drop by 50% – check details here