Police Advisory On New Scam Variant On Whatsapp Account Compromise

The Police would like to alert members of the public to a new scam variant where scammers would compromise victims' WhatsApp accounts using malware through advertisements promoting fake job listings on Facebook.

In these cases, victims would come across attractive job listings on Facebook and contact the WhatsApp contact number provided. The victims would then be instructed to download an Android Package Kit (APK) file via WhatsApp, claiming that it was for the purpose of obtaining their personal particulars. Unknown to the victims, the APK file contains malware that would allow the scammers to extract data from their mobile phones. After the victims downloaded and installed the malware, they would notice that their phone screen would switch off and / or lose control of their mobile phones.

When the victims eventually regained control of their phones, they would notice that they were unable to access their WhatsApp accounts. In some cases, their WhatsApp application was deleted from their mobile phones. The victims subsequently realised that their WhatsApp accounts were compromised by the scammers when they were alerted by their contacts that they had received messages purportedly from the victim asking for loans.

Members of the public are advised to adopt the following precautionary measures:

1. Protect your WhatsApp account by enabling the 'Two-Step Verification' feature. This can be done by opening WhatsApp and going to 'Settings' > 'Account' > 'Two-step verification' > 'Enable';
   
   
2. Beware of unusual requests received over WhatsApp, even if they were sent by your WhatsApp contacts. Always verify with the sender by calling them via non-WhatsApp calls to ensure that their WhatsApp accounts were not compromised;
   
   
3. Only download and install applications from the official app stores (i.e., Google Plat Store for Android and Apple App Store for iOS). As an added precaution, check the developer information on the application listing and confirm that it is the official developer before proceeding with the download;
   
   
4. Ensure that your mobile phones, computers, and other ICT devices are installed with updated anti-virus software and malware removal tools to detect and remove malware; and
   
   
5. Ensure that your mobile devices' operating systems and applications are updated regularly to be protected by the latest security patches.

In the event that you suspect that you, or someone you know have fallen victim to such similar scams, do take the following steps:

1. Turn your phone to "flight mode". Check that Wi-Fi is switched off and do not switch it on.
2. Run an anti-virus scan on your phone.
3. Check your bank account / Singpass / CPF etc for any unauthorised transactions using other devices.
4. If there are unauthorised transaction(s), report to the bank, relevant authorities, and lodge a Police report.
5. After completing steps a-c, if you believe that your phone has not been infected with malware, you may resume usage of your phone. As a further precaution, you may consider doing a "factory reset" of your phone and changing important passwords.

If you have any information relating to such crimes or if you are in doubt, please call the Police Hotline at 1800-255-0000, or submit it online at www.police.gov.sg/iwitness. All information will be kept strictly confidential. If you require urgent Police assistance, please dial '999'.

For more information on scams, members of the public can visit www.scamalert.sg or call the Anti-Scam Helpline at 1800-722-6688. For instructions on how to activate additional security features on WhatsApp, visit https://www.whatsapp.com/security. Fighting scams is a community effort. Together, we can ACT Against Scams to safeguard our community!

Annex A: Setup of Two-Step Verification

Annex B: Screenshot of Fake Facebook Ad on Job Listings

PUBLIC AFFAIRS DEPARTMENT
SINGAPORE POLICE FORCE
30 April 2024 @ 10:35 PM