Experts warn of rising WhatsApp account hijackings and offer protection tips

Rise in WhatsApp account hijacking attacks

Cybersecurity specialists are warning about a growing number of WhatsApp account hijackings and related fraud attempts, both in Turkey and worldwide. The scheme works like this: after gaining access to someone else's account, attackers imitate the owner's writing style and send messages to their contacts urgently requesting money transfers as loans. Anadolu was told about this by İbrahim Gündüzgil, head of the cybersecurity program at Istanbul Commerce University.

How accounts get hacked

According to Gündüzgil, attackers gain access to accounts through phishing — including fake links — and social engineering methods. Vulnerabilities in outdated applications and operating systems can also be exploited by attackers, and the problem is not limited to WhatsApp: active sessions in Telegram and similar apps are also at risk. The specialist links the problem to a combination of technical vulnerabilities and user behavior. He noted that vulnerabilities are not unique to Android or iOS, but according to recent reports, iOS devices with outdated software have shown such vulnerabilities. WhatsApp Web sessions left on untrusted computers also pose a danger, as do attacks using malware and fake QR codes: a user may not notice that someone has connected to their account from another device.

How to protect your account

Gündüzgil recommended enabling two-factor authentication and other additional security features, but under no circumstances sharing SMS codes with other people. He also advised regularly checking the list of connected devices and active sessions in apps and revoking access for unfamiliar devices. If an account is hacked, he said, the recovery procedure should be started immediately and close contacts should be warned, and when money is requested, the identity of the person should be verified through another communication channel.

What to do if hacked: advice from Sabri Erdemir

Sabri Erdemir, head of the Computer Programming Department at Istanbul Commerce University, drew attention to preserving evidence: screenshots of suspicious messages, links, phone numbers, bank details used to request money, transfer receipts, as well as the date and time of the incident. Contrary to common intuition, disconnecting the internet on a hacked device will not stop the attack — the attacker can connect to the account from another device. The key warning: do not reset the phone to factory settings and do not delete apps, since a reset will destroy the digital traces of the attack that could help identify the perpetrators. If there is financial damage, the bank should be contacted immediately, and a report should be filed with law enforcement even if there are no losses — the preserved evidence will help find those responsible and prevent the compromised account from being used further.