Have you been receiving calls on WhatsApp from unknown numbers? Do the calls show IDs that don't even belong to India, or even Asia for that matter?
If you've received such calls in the last few days, don't worry – you're not alone.
We will explain how this is happening, whether there are any risks associated with it – and how to best protect yourself against such scams.
WhatsApp Calls From International Numbers, Fake Job Offers. What's Going On?
1. What Is the Scam All About?
Several WhatsApp users have reported that they received calls from unknown international numbers. These may include numbers from Ethiopia (+251), Malaysia (+60), Vietnam (+84), Indonesia (+62), Kenya (+254) and several other countries.
How is this happening?
Karan Saini, Security Technologist at the Centre for Internet Society, India, spoke to The Quint about the possible modus operandi that these scammers are using, and how they get access to so many numbers on a pan-India basis.
While Saini said that the calls being received appear to be similar to any other "cold-calls" that users may receive, he added that two things stand out about them:
1. The numbers used to place these calls seem to originate from a particular set of countries, which may have comparatively lax regulation (for example, identity verification for registration of new mobile connections.)
2. It is possible that a malicious actor has identified these countries and is acquiring new numbers on an on-going basis – as WhatsApp's spam detection systems are likely to flag and suspend offending numbers if the number of times they happen to be reported/blocked within a certain time window exceeds the threshold set by WhatsApp for detecting spam accounts.
"Alternatively, it is also possible that a malicious actor has gained access to a cache of phone numbers originating from these countries, which they are 'burning', i.e., abusing and thus losing access to WhatsApp quickly, in order to reach as many people in as short a time as possible," Saini said.
Expand2. What Is the Goal of the Scammers? Is There Any Risk Involved?
While the exact goal of the scammers is unclear, it seems that they are attempting to initiate contact with an individual in a bid to offer them fake jobs and thus defraud them.
"A cold call may prompt an individual to message the caller, at which point, it is possible the malicious actor would initiate a 'talking script' (as done in any other email or call scam) and only then attempt to lure the recipient with a false story and defraud them," Saini said.
A practical example of the scam:
Saini actually messaged one of the numbers he got a call from to see what would happen. Here is what he found out:
Once he messaged one such number, he immediately got a response (most probably from a bot) asking whether he would like some "part-time" work. All he has to do is search certain keywords they will provide to him on Google and he will get Rs 2,500 per day.
Sounds too good to be true, right? That's how you know it's fake.
When he agreed to the deal, just to see what happens next, he got an even more detailed structure of the job description:
Expand3. What Can Users Do To Protect Themselves?
First of all, answering a call from the scammers or calling back doesn't seem to be risky, as it might be an automated bot initiating the calls rather than actual people. So, chances of a data or financial breach seem slim.
However, the best thing to do would be to ignore or reject such calls. You can also block and report the numbers, so that you do not keep getting fraudulent calls or messages from them.
What must WhatsApp do immediately to protect users from such scams?
Saini observed that the scammers appear to be using WhatsApp business accounts. This may be because WhatsApp is more lenient to large quantities of messages originating from these numbers as well as spam reports/blocks against such numbers, owing to the nature of business communication.
He said that WhatsApp has made it almost effortless for an individual to acquire a business account. This is what the scammers are taking advantage of. Hence, WhatsApp will have to address this issue quickly, given the "sharp rise in abuse".
Furthermore, the social media platform must immediately ban all such accounts that indulge in fraudulent exchanges.
WhatsApp said in its 'Monthly India Report' that until 1 May this year, it had banned over 47 lakh "malicious" accounts in India. It also stated that it had received 4,720 reports of such accounts in March and had acted on 585 among them.
Expand4. But Why Have Such Scams Become Recurring?
Pavan Duggal, a practicing advocate in the Supreme Court and an expert on cybercrime law, told The Quint that such incidents of fraud keep happening in India because of the absence of a "dedicated" law on cyber security.
"From a legal standpoint, India does not have any dedicated law on cyber security. So most of these calls that are coming on WhatsApp effectively are in a grey area. WhatsApp chats are end-to-end encrypted, so I am not in a position to find out what is happening on the network," he said.
While he did submit that the Information Technology Act, 2000 and subsequent amendments – like the IT Rules 2023 – are put in place to deal with such situations, he said that what is lacking is their effective enforcement.
"The IT Rules 2023 state that service providers will have to take appropriate steps to prevent users from indulging in activities which are in contravention of the law. However, these new amendments are yet to be effectively enforced. I believe that if they are enforced, it could usher the way for more user and consumer protection."
Pavan DuggalHowever, more needs to be done even in terms of the enactment of laws. "Specific parameters of due diligence of preventing the misuse of platforms like WhatsApp is something that the government still has to be stipulate," Duggal asserted.
Expand5. How Have WhatsApp Users Reacted To the Calls?
Several users took to Twitter to share their experiences. A lot of them also wanted to find out whether only they were receiving such fraudulent calls or it was happening to others as well. Here are some posts by people who were at the receiving end of the calls.
(At The Quint, we question everything. Play an active role in shaping our journalism by becoming a member today.)
Expand
What Is the Scam All About?
Several WhatsApp users have reported that they received calls from unknown international numbers. These may include numbers from Ethiopia (+251), Malaysia (+60), Vietnam (+84), Indonesia (+62), Kenya (+254) and several other countries.
How is this happening?
Karan Saini, Security Technologist at the Centre for Internet Society, India, spoke to The Quint about the possible modus operandi that these scammers are using, and how they get access to so many numbers on a pan-India basis.
While Saini said that the calls being received appear to be similar to any other "cold-calls" that users may receive, he added that two things stand out about them:
1. The numbers used to place these calls seem to originate from a particular set of countries, which may have comparatively lax regulation (for example, identity verification for registration of new mobile connections.)
2. It is possible that a malicious actor has identified these countries and is acquiring new numbers on an on-going basis – as WhatsApp's spam detection systems are likely to flag and suspend offending numbers if the number of times they happen to be reported/blocked within a certain time window exceeds the threshold set by WhatsApp for detecting spam accounts.
"Alternatively, it is also possible that a malicious actor has gained access to a cache of phone numbers originating from these countries, which they are 'burning', i.e., abusing and thus losing access to WhatsApp quickly, in order to reach as many people in as short a time as possible," Saini said.
What Is the Goal of the Scammers? Is There Any Risk Involved?
While the exact goal of the scammers is unclear, it seems that they are attempting to initiate contact with an individual in a bid to offer them fake jobs and thus defraud them.
"A cold call may prompt an individual to message the caller, at which point, it is possible the malicious actor would initiate a 'talking script' (as done in any other email or call scam) and only then attempt to lure the recipient with a false story and defraud them," Saini said.
A practical example of the scam:
Saini actually messaged one of the numbers he got a call from to see what would happen. Here is what he found out:
Once he messaged one such number, he immediately got a response (most probably from a bot) asking whether he would like some "part-time" work. All he has to do is search certain keywords they will provide to him on Google and he will get Rs 2,500 per day.
Sounds too good to be true, right? That's how you know it's fake.
When he agreed to the deal, just to see what happens next, he got an even more detailed structure of the job description:
What Can Users Do To Protect Themselves?
First of all, answering a call from the scammers or calling back doesn't seem to be risky, as it might be an automated bot initiating the calls rather than actual people. So, chances of a data or financial breach seem slim.
However, the best thing to do would be to ignore or reject such calls. You can also block and report the numbers, so that you do not keep getting fraudulent calls or messages from them.
What must WhatsApp do immediately to protect users from such scams?
Saini observed that the scammers appear to be using WhatsApp business accounts. This may be because WhatsApp is more lenient to large quantities of messages originating from these numbers as well as spam reports/blocks against such numbers, owing to the nature of business communication.
He said that WhatsApp has made it almost effortless for an individual to acquire a business account. This is what the scammers are taking advantage of. Hence, WhatsApp will have to address this issue quickly, given the "sharp rise in abuse".
Furthermore, the social media platform must immediately ban all such accounts that indulge in fraudulent exchanges.
WhatsApp said in its 'Monthly India Report' that until 1 May this year, it had banned over 47 lakh "malicious" accounts in India. It also stated that it had received 4,720 reports of such accounts in March and had acted on 585 among them.
But Why Have Such Scams Become Recurring?
Pavan Duggal, a practicing advocate in the Supreme Court and an expert on cybercrime law, told The Quint that such incidents of fraud keep happening in India because of the absence of a "dedicated" law on cyber security.
"From a legal standpoint, India does not have any dedicated law on cyber security. So most of these calls that are coming on WhatsApp effectively are in a grey area. WhatsApp chats are end-to-end encrypted, so I am not in a position to find out what is happening on the network," he said.
While he did submit that the Information Technology Act, 2000 and subsequent amendments – like the IT Rules 2023 – are put in place to deal with such situations, he said that what is lacking is their effective enforcement.
"The IT Rules 2023 state that service providers will have to take appropriate steps to prevent users from indulging in activities which are in contravention of the law. However, these new amendments are yet to be effectively enforced. I believe that if they are enforced, it could usher the way for more user and consumer protection."Pavan Duggal
However, more needs to be done even in terms of the enactment of laws. "Specific parameters of due diligence of preventing the misuse of platforms like WhatsApp is something that the government still has to be stipulate," Duggal asserted.
How Have WhatsApp Users Reacted To the Calls?
Several users took to Twitter to share their experiences. A lot of them also wanted to find out whether only they were receiving such fraudulent calls or it was happening to others as well. Here are some posts by people who were at the receiving end of the calls.
(At The Quint, we question everything. Play an active role in shaping our journalism by becoming a member today.)