Argentina: WhatsApp Account Hijacking and Financial Fraud

1. Date and Time

2. Victims

3. Summary

(1) The victim received a phone call in Spanish from someone claiming to be from the Ministry of Health, asking if they had completed their COVID-19 vaccinations. After the victim confirmed receiving two doses, the caller requested the victim to read out a PIN code that would be sent via SMS for a third dose. Upon providing the code, the victim’s WhatsApp account became inaccessible.
(2) Shortly after, the hijacked WhatsApp account began sending messages in Spanish to numerous acquaintances of the victim, requesting money transfers due to issues with the victim’s bank account and asking for financial assistance. Some acquaintances, believing the messages to be legitimate, transferred money and fell victim to the fraud.

4. Preventive Measures

(1) This incident involves account hijacking and financial fraud using WhatsApp’s phone number change feature. The process allows anyone to attempt changing the phone number linked to another person’s account. The PIN code required for the phone number change is sent via SMS to the old phone number.
(2) In this case, the perpetrators likely knew the victim’s WhatsApp phone number in advance and were preparing to transfer the account to their own number. When the victim received the SMS and provided the PIN code without realizing it was for a phone number change, the account was hijacked. Be extremely cautious not to share PINs or similar information with unknown callers.
(3) Reports indicate that this method of WhatsApp account hijacking and fraud is prevalent in the area. If you believe you may have been a victim or are at risk, please contact the police and the following office:
- Unidad Fiscal Especializada en Ciberdelincuencia (UFECI)
- Phone: 11-5071-0040