WhatsApp scams are becoming more sophisticated as cybercriminals use fake government messages, malicious files, QR codes and account takeover techniques to target users. Here is how Indian users can secure their WhatsApp accounts and respond if they suspect fraud.
Why WhatsApp Account Security Matters in 2026
WhatsApp is widely used in India for personal conversations, work communication, payments, customer interactions and family groups. That makes a compromised account potentially useful to scammers beyond the original victim.
The Indian Cyber Crime Coordination Centre, or I4C, warned in August 2026 about a WhatsApp account takeover campaign targeting professionals and business users. According to the Ministry of Home Affairs, attackers have been sending malicious compressed files disguised as account statements or communications involving organisations such as the RBI and MCA. Once opened on a Windows computer, the malware can compromise active WhatsApp Web sessions.
This is important because a stolen WhatsApp session can be misused to send convincing messages to the victim’s colleagues, friends or family. In high-value cases, criminals may use the compromised account to impersonate an executive and request money transfers.
The threat is therefore not limited to losing access to WhatsApp. A compromised account can become a starting point for wider financial or identity fraud.
Never Open Unexpected ZIP or APK Files
One of the most important precautions is to avoid opening unexpected files received through WhatsApp, SMS or email.
The recent I4C advisory specifically highlighted malicious ZIP files with names such as Statement of Account, RBI or MCA. These files can be presented as urgent regulatory or financial documents to persuade the recipient to open them.
The problem becomes more serious when the recipient uses WhatsApp Web on a Windows computer. According to I4C, the malware used in the reported campaign can compromise active Web WhatsApp sessions and allow criminals to misuse the account.
Do not open an unexpected executable, archive or application simply because it appears to come from a familiar contact. If the message claims to be from a bank, regulator, employer or government agency, verify it through an independent official channel.
Be Careful With WhatsApp QR Codes
QR codes are another important account takeover risk.
I4C has warned about scams in which victims are promised easy earnings and are instructed to scan a QR code to link their WhatsApp account. The scammer can then exploit WhatsApp’s linked-device functionality to gain access to the account.
This is different from simply scanning a QR code to make a legitimate payment. The key question is what the QR code is asking you to authorise.
Never scan a WhatsApp linking QR code because someone promises a job, commission, cashback, investment return or other financial benefit. If you are not deliberately linking your own WhatsApp account to a device, stop and verify the request.
Regularly checking the devices linked to your WhatsApp account is also a useful security habit. If you find an unfamiliar device, remove it immediately and review your account security.
Turn On Two-Step Verification
WhatsApp’s two-step verification feature adds an additional layer of protection to the account.
Users can enable it from WhatsApp’s account settings and create a PIN that is separate from the SMS verification code used during account registration.
The PIN should not be shared with anyone. Avoid using an easily guessed combination, especially one connected to your birthday, phone number or other publicly available information.
Two-step verification is particularly useful because scammers frequently attempt to convince users to share verification codes or other account information. A genuine contact should not need your WhatsApp verification code to help you with your account.
Users should also ensure that the email address associated with two-step verification, where applicable, is secure and accessible only to them.
Never Share Your WhatsApp Verification Code
A WhatsApp verification code is highly sensitive. If somebody asks you to forward a six-digit code that has arrived on your phone, treat the request as suspicious.
Scammers may pretend to be friends, relatives, delivery agents, customer service representatives or other trusted contacts. They may claim that a code was sent to your number by mistake and ask you to forward it.
Do not do it.
A scammer who obtains account verification information may attempt to register your WhatsApp account on another device. The safest approach is to never share authentication codes, passwords or two-step verification PINs with another person.
If someone you know sends an unusual request, call them directly using a number you already trust rather than continuing the conversation on WhatsApp.
Watch Out for Fake Government and Bank Messages
Government impersonation remains a recurring feature of online fraud in India.
Authorities have repeatedly warned about fake communications claiming to come from government departments or regulators. The Department of Telecommunications, for example, has warned about fraudulent WhatsApp calls and messages impersonating officials and threatening users with mobile-number disconnection.
Similar tactics can involve claims about Aadhaar, bank accounts, SIM cards, police cases, tax notices or regulatory violations.
The pressure is often deliberate. A scammer may tell the victim that immediate action is required or that failure to respond will result in arrest, account suspension or disconnection.
Do not make payments or disclose personal information simply because a WhatsApp message looks official. Verify the claim using the concerned organisation’s official website or customer service channel.
Do Not Trust Investment and Job Offers on WhatsApp
WhatsApp is also frequently used as the communication channel after victims are attracted through social media advertisements or unsolicited messages.
I4C has previously warned about fake stock-market investment schemes that use platforms including WhatsApp and Telegram to direct users into fraudulent investment groups.
Fake job offers can follow a similar pattern. A person may receive a message promising easy work, unusually high income or quick commissions and then be directed to a website or asked to make an initial payment.
The presence of a WhatsApp conversation does not prove that an opportunity is genuine.
Be particularly cautious when someone asks you to install an unfamiliar application, transfer money for registration, share identity documents or move the conversation to another platform before providing verifiable information.
What to Do If Your WhatsApp Account Is Compromised
If you suspect someone has accessed your WhatsApp account, act quickly.
First, review your linked devices and remove anything you do not recognise. Then secure your phone, email account and other accounts connected to the device.
If your WhatsApp account has been taken over, follow WhatsApp’s official account-recovery process and inform close contacts that messages from your account may not be genuine.
If money has already been transferred or you have suffered financial fraud, report the incident immediately. India’s National Cyber Crime Reporting Portal provides a mechanism for reporting cybercrime, while 1930 is the designated helpline for reporting online financial fraud.
Speed matters in financial fraud cases because early reporting can help authorities and financial institutions take action.
Simple WhatsApp Security Habits to Follow
You do not need advanced technical knowledge to reduce your exposure to WhatsApp scams.
Keep WhatsApp and your phone’s operating system updated. Use a strong device lock and avoid installing applications from unknown sources. Do not click suspicious links simply because they were forwarded by someone you know.
Be especially cautious with urgent requests involving money, passwords, verification codes, QR codes or confidential documents.
For families and older users, it can also help to establish a simple rule: if a WhatsApp message creates panic or demands immediate payment, stop and verify it through another communication channel.
The goal is not to distrust every WhatsApp message. It is to avoid making security decisions under pressure.
WhatsApp Scam Protection: Key Takeaways
- Never share WhatsApp verification codes or your two-step verification PIN with anyone.
- Do not open unexpected ZIP, APK or executable files, especially documents claiming to come from banks, regulators or government agencies.
- Check linked devices regularly and remove any device you do not recognise.
- If you lose money to an online scam, report it quickly through India’s cybercrime reporting system and 1930 for financial fraud.
FAQ
Can someone hack my WhatsApp through a QR code?
A malicious or deceptive QR code can be used to trick users into linking their WhatsApp account to another device. I4C has specifically warned about scams that use QR codes to exploit WhatsApp’s linked-device feature.
Should I open a ZIP file sent by a WhatsApp contact?
Do not open an unexpected ZIP file simply because it appears to come from a known contact. I4C has warned about malicious ZIP files being distributed through WhatsApp, SMS and email under the guise of financial or regulatory documents.
What should I do if someone gets access to my WhatsApp account?
Review and remove unfamiliar linked devices, secure your related accounts and follow WhatsApp’s account recovery process. Inform your contacts if your account may be sending fraudulent messages. If financial fraud has occurred, report it immediately through the National Cyber Crime Reporting Portal or 1930.
Is it safe to share a WhatsApp verification code with customer support?
No. Do not share your WhatsApp verification code or two-step verification PIN with another person. If someone claiming to be customer support asks for these credentials, independently verify the request before taking any action.