One call to the wrong number – and access to Whatsapp is gone. An aggressive scam is currently threatening the accounts of Messenger users. Luckily, there is one simple precaution.
Dangerous competitions, supposed grandchildren with money requests or lousy chain letters: the list of scams via Whatsapp is getting longer and longer. Now a new one has been observed, the consequences of which can be even more serious than those previously known. The scammers get their victims to give them the entire Whatsapp account – without them realizing it.
Security expert Rahul Sasi warns of this on Twitter. According to him, to get the account, all you have to do is call a single phone number. And minutes later you get kicked out of whatsapp account. And the attackers have full control over the chats.
Attack over the phone
Behind this is a strategy that is as simple as it is frightening. The attackers convince their victims to dial a phone number. The attack is hidden in the number itself, explains Sasi. Instead of an ordinary phone number, it is one preceded by a special code. So far, he has observed the codes **67* and *405*, each followed by a normal phone number, according to the expert. The effect is the same for both: the code ensures that the victim’s calls are forwarded to the new number from now on. Also the call with which WhatsApp can confirm the authenticity of a new device. And the account is already in the hands of the attackers.
After that it will be very difficult to get the account back. Because the attackers have now logged in legitimately from Whatsapp’s point of view, they can even change the phone number used for the account. However, it is more attractive to keep these for now – and use them to scam the victim’s contacts. On the one hand, they are asked for money by their supposed acquaintance. On the other hand, they are more likely to be persuaded by their trusted chat partners to call the manipulated numbers themselves. And so provide the scammers with additional numbers.
GSM codes as a vulnerability
Although, according to Sasis, the scam has so far been observed primarily in India, it is basically possible around the world, he emphasizes. The basis are the so-called “GSM codes”, which date back to the era before the smartphone. In Germany you would need the code **21* for the trick to redirect all calls.
However, GSM codes are not actually intended as a hacking tool. They allow the connection settings to be changed via the provider with certain code additions to phone numbers. In addition to redirection, the number of dialing tones in front of the mailbox can be set or the mailbox itself can be called up. You can find an overview of the most important codes
WhatsApp in focus
Fraud attempts via Whatsapp have continued to increase in recent years. The reason is obvious: With over two billion users, the app belonging to the Facebook parent company Meta is the most widespread messenger of all. In Germany alone, Whatsapp is used by 60 million people every day. Because more and more people are among them who are very unbiased when it comes to using the technology, the number of potential victims of fraud is very high. Most recently, in March, the LKA Schleswig-Holstein warned of a huge wave of fraud via the messenger. In the northernmost federal state alone, more than 100,000 euros had already been damaged.
What: Twitter
