The police warned yesterday, that the scammers had came up with a new trick to lure in victims through a new gold bar scheme via compromised WhatsApp accounts. These WhatsApp accounts were said to be hacked via voicemail method.
Voicemail method
So, how did the scammers use voicemail to hack into WhatsApp?
It was shared in the reports that the scammer uses their own devices and try to log in the victim’s WhatsApp account. They would deliberately fail the verification process by keying in wrong codes. When this verification fails, WhatsApp will prompt the victim to perform a voice verification, where a call will be triggered to the victim’s phone to provide the verification code via audio message.
If the victim’s phone is turned off, or the call is missed, this audio message will be directed to the victim’s voicemail account. The scammer will then access the voicemail account of the victim remotely, by using the default PIN used by the telecoms service providers. This will work only if the victims did not change the default PIN for their voicemail account.
The scammer will then use the code provided via voicemail for verification to take over the victim’s WhatsApp account. Once in control, the scammer can enable a two-step verification (2FA) to prevent the victim from regaining control of this WhatsApp account.
Not only will the scammer gain control of all the sensitive information posted via WhatsApp, he can now prey on the victim’s friends and family members, which in this incident, luring them to believe that the victim is the one promoting the idea of the gold bars.
Gold Bar Scheme
Gold bars for auction by Immigration and Checkpoints Authority (Singapore Customs) ?
Get gold bars at 30 percent below market rate, from Immigration and Checkpoints Authority ?
While this may sound ‘too-good-to-be-true’ to some, most would still give it a second thought, especially when it was sent in by a close friend or a relative. To sound more convincing, the scammers explained that these gold bars were sold cheap as they were seized by the Singapore customs (Immigration and Checkpoints Authority) and were on auction. Counterfeit invoices from the Singapore Customs would be provided to lure the victims to do a payment transfer to a list of bank accounts. Some victims were even told to meet the scammers to collect the gold bars.
How to prevent hackers
- Enable two-step verification (2FA) from WhatsApp settings.
- Avoid logging in your WhatsApp account via web on computers that are not well protected.
- Disable voicemail account. Or, change the default PIN if you wish to keep this service enabled.
The police have warned the public to be cautious of such requests over WhatsApp and other messaging services. It is advised to verify these requests with the sender by calling them or speaking with them directly before making any payment transfer. Purchases should also be made from authorised sellers or reputable and reliable sources.
Source: The Straits Times
