WhatsApp Safety Guide: Privacy, Scams and Settings

Why WhatsApp is a favourite tool for fraudsters

With over 500 million users in India, WhatsApp is where most people already trust messages that arrive. Fraudsters exploit this trust: a message from a known contact’s number feels more credible than a cold call. The ease of forwarding means that scam messages reach millions in hours. And because WhatsApp accounts are tied to phone numbers, gaining control of your number means gaining control of your account.

The good news is that WhatsApp provides strong security features — most users simply have not enabled them. This guide covers everything from basic setup to recognising the most sophisticated attacks.

Enabling two-step verification: the most important step

Two-step verification (2SV) adds a six-digit PIN that must be entered whenever you register your WhatsApp account on any new device. Without it, someone who performs a SIM swap or obtains your SMS OTP can take over your account instantly.

Essential privacy settings to configure now

In WhatsApp, go to Settings → Privacy and review each of the following:

• Last seen and online: Set to ‘My contacts’ or ‘My contacts except…’. Showing your online status to everyone tells strangers when you are active — useful information for impersonation and social engineering.
• Profile photo: Set to ‘My contacts’. Your profile photo visible to all is used by scammers who create fake accounts impersonating your face.
• About: Set to ‘My contacts’ or ‘Nobody’.
• Read receipts: Optional to disable, but note that disabling them also means you cannot see others’ read receipts.
• Groups: Set to ‘My contacts’ or ‘My contacts except…’. This prevents unknown people from adding you to scam or spam groups without any permission from you.
• Live location and status: Review who can see your status updates. Set to ‘My contacts only’.

Recognising forwarded fraud and fake news

WhatsApp labels messages that have been forwarded multiple times with a double-arrow ‘Forwarded many times’ tag. This is your first indicator to be sceptical.

• Health misinformation: Fake cures, false vaccine claims, unverified medical advice. Check any health advice against official sources such as the Ministry of Health and Family Welfare or Karnataka’s Health and Family Welfare department.
• Fake government schemes: Messages claiming free LPG, cash transfers, or PMJAY extensions, with a link to ‘register’. The links lead to phishing pages that harvest your Aadhaar and bank details. Real government scheme information is available at india.gov.in.
• Lottery and prize fraud: ‘You have won ₹50 lakh in the KBC lottery. Click here.’ KBC and similar shows do not conduct draws via WhatsApp.
• Charity fraud after disasters: After any flood or earthquake, fake donation appeals appear within hours. Donate only through verified organisations listed on pmindia.gov.in (PMNRF) or well-known NGOs with confirmed registration.

The account-takeover scam: how it works

This is one of the most common WhatsApp attacks in India. Here is the exact pattern:

• You receive a message from a known contact (or someone claiming to be a contact) saying they accidentally sent a WhatsApp verification code to your number and asking you to forward it.
• The code is in fact WhatsApp’s six-digit SMS registration OTP for the attacker’s phone.
• If you share it, the attacker registers your WhatsApp account on their device and locks you out.
• They then impersonate you to all your contacts, typically asking for urgent money transfers.

The rule: Never share any WhatsApp verification code with anyone, regardless of who asks or what reason they give. The code is equivalent to a door key to your account.

Signs your WhatsApp account has been taken over

• You are suddenly logged out of WhatsApp.
• You receive a verification code SMS you did not request.
• Contacts tell you they received strange or suspicious messages from your number.
• Your account shows a different device in Linked Devices settings.

How to recover a hijacked WhatsApp account

Group safety and stranger contact

• Unknown groups: If you are added to a group you did not join, leave immediately and report the group through WhatsApp’s Report option.
• Investment/stock-tip groups: Groups that promise trading signals, arbitrage opportunities, or guaranteed returns are almost always scams. Leave immediately.
• Group admin spoofing: A fake ‘group admin’ may message you privately from a number claiming to be your company or family group admin, asking for OTPs or money. Verify by calling the real person directly.
• Unknown contacts impersonating family: ‘Hi, this is your son/daughter, I lost my phone and need money urgently’ from an unknown number. Always call the family member directly on their known number before taking any action.

Linked devices and session management

WhatsApp Web and Desktop maintain an active session on your device. If you used WhatsApp Web on a shared computer, someone else may still have access.

• Go to Settings → Linked Devices and review the list regularly.
• Tap on any device you do not recognise and select ‘Log out’.
• After using WhatsApp Web on any shared device, always log out from the computer browser as well.

Your action plan

• ✓ Enable two-step verification now (Settings → Account → Two-step verification).
• ✓ Set profile photo, last seen, and About to ‘My contacts’.
• ✓ Set group-add permission to ‘My contacts’ or ‘My contacts except…’.
• ✓ Never share a WhatsApp OTP with anyone, for any reason.
• ✓ Check Linked Devices and remove any sessions you do not recognise.
• ✓ Before forwarding any forwarded message, verify the claim from an official source.
• ✓ If a ‘family member’ on an unknown number asks for urgent money, call their known number directly first.
• ✓ If your account is hijacked: reinstall WhatsApp, re-verify your number, alert your contacts, and report at cybercrime.gov.in if fraud occurred.