WhatsApp scams: How hackers hijack accounts via OTP theft

Cybersecurity experts are warning against increasingly sophisticated WhatsApp scams designed to hijack user accounts and exploit contact lists for financial fraud.

One prevalent method involves the theft of One-Time Passwords (OTP). In this scenario, a criminal attempts to register the victim's phone number on a new device, triggering a security code via SMS to the legitimate owner. The attacker then contacts the victim, claiming they sent the code by mistake and requesting that it be forwarded. Once the victim provides the six-digit code, the attacker gains full control of the account.

Another technique mentioned is 'ghost pairing,' which utilizes system vulnerabilities to compromise accounts. These attacks often succeed because criminals leverage the trust established by appearing as a known contact from the victim's address book, significantly lowering the target's natural defenses.