The Guardia Civil of Cantabria investigates more than twenty complaints for a new hacking method that allows cybercriminals to take control of WhatsApp accounts and use them to ask for money from the owners’ relatives and friends. The Equipo @ of the Guardia Civil has warned about these attacks, which affect iPhone phones with older versions of the iOS operating system.
The procedure is especially striking because it does not require that the victim click on a link, download a file, or answer a call. The attackers use a technique known as zero-click, which makes it possible to access the device without the user having to take any prior action.
Once inside the application, the criminals impersonate the account holder and message the people in their contacts to request bank transfers or payments via Bizum. When the message is received from the usual number of a friend or family member, contacts may trust the request and send the money without suspecting that they are speaking with a third party.
How the scam works and why it can seem real
Unlike other scams in which criminals use unknown numbers or fake profiles, in this method the message arrives from the authentic account of the impersonated person.
Attackers can take advantage of the trust that exists among contacts to insert an urgent message and get the recipient to make a Bizum or a transfer. In some of the cases investigated, the cybercriminals have even managed to activate two-step verification on WhatsApp, which can leave the owner without access to their own account.
The Guardia Civil has identified the detected cases on iOS phones several years old that are not updated to the most recent versions. According to the information provided by the agency, the affected versions increase especially among those prior to iOS 18. For the time being, attacks of this kind have not been detected on Android devices.
What to do if a known person asks you for money on WhatsApp
The main recommendation of the Guardia Civil for those who receive a request for money is not to make the payment without first checking that it really comes from that person.
If a friend or family member requests a Bizum, especially if they use urgency as an argument, it is advisable to:
-
Call the contact directly. The request must be verified through a phone call or by another method different from WhatsApp.
-
Do not respond only to the received message. If the account is compromised, the person replying could be speaking with the scammers themselves.
-
Be wary of urgency. Requests that demand sending money immediately must be checked before carrying out any operation.
-
Do not share verification codes. Under no circumstances should codes received via SMS or access data be provided to recover an account.
The key is not to consider a money request valid merely because it appears in a typical conversation or comes from a known number.
How to protect your WhatsApp account and your iPhone
The Guardia Civil recommends keeping the phone’s operating system updated and adding a second authentication factor to access WhatsApp. This protection can be configured using a PIN, fingerprint, or facial recognition, depending on the options available on the device and in the app.
In the case of iPhones, it is advisable to check whether there is a pending update in the section Settings > General > Software Update. If the device is too old and no longer supports the most recent versions, the body recommends especially strengthening WhatsApp security through additional authentication.
The Guardia Civil warns that uninstalling and reinstalling the application is not enough if vulnerabilities are not corrected or these security measures are not added, since the device could be attacked again.
What to do if you have already sent the money
If the user discovers that they have made a Bizum or a transfer as a result of a fraudulent request, they should contact their bank immediately through their official channels. It is important to explain that it is an operation linked to a scam and request that they try to stop it or recover the amount, although this will not always be possible.
If, on the other hand, it is detected that the user’s own WhatsApp account has been compromised, the police recommendation is to notify contacts through other means so that they do not send money through the requests they receive from that profile.
The Guardia Civil investigation in Cantabria has already added more than two dozen complaints and is focusing on a type of fraud that takes advantage of trust between people known to one another to obtain payments without raising suspicions.