ISLAMABAD (Kashmir English): A dangerous new scam is circulating, and authorities are warning everyone to be on high alert. Cybercriminals are using fake parcel-delivery messages on WhatsApp to gain control of user accounts and then contact their friends and family for money.
In this new operation, scammers are posing as representatives from legitimate courier companies. They’ll call users via WhatsApp, telling them a parcel is waiting for delivery or that they need to confirm an address.
They’ll then state that a verification code will be sent to the user’s phone to complete the delivery. The crucial part is that this code isn’t for the parcel; it’s for verifying the WhatsApp account.
Once the victim gives out the code, the scammers can register the victim’s phone number on a different device and take over their WhatsApp account.
They can then message family, friends, coworkers, and anyone else on the victim’s contact list, pretending to be the victim and asking for immediate funds.
Recently, this scam has been widely reported in Pakistan, with both homemakers and less tech-savvy individuals becoming targets.
Remember, the Pakistan Telecommunication Authority (PTA) has already issued warnings about fake courier communications asking for verification codes. They stress that no real courier company will ask you to provide a verification code to receive a parcel.
Here’s how the scam typically unfolds:
1. The call: The scammer contacts the user, claiming to be from a courier company.
2. The story: The victim is told a parcel is on its way or needs address confirmation.
3. The code: A WhatsApp verification code is sent to the victim’s phone.
4. The deception: The scammer asks the victim to read the code aloud or forward it.
5. Account hijack: The attacker uses the code to register the phone number on another device and access the victim’s WhatsApp.
6. The demand: Messages are sent to the victim’s contacts asking for urgent cash transfers.
WhatsApp itself advises users never to share their six-digit verification code and to enable two-step verification.
Meta has also implemented additional safeguards to detect potentially fraudulent attempts to link devices to accounts.
How to protect yourself:
- Never share WhatsApp verification codes, OTPs, or PINs with anyone. This applies even if they claim to be from a courier company, bank, telecom provider, or government agency.
- If you get a parcel call, independently verify it. Contact the courier company directly using its official website or a known customer service number, not through the number that called you.
- If a friend or relative asks you for money via WhatsApp, verify it through a phone call. Confirm they are who they say they are and that they genuinely need the money before sending anything.
- The simplest rule to remember is: If someone asks for your WhatsApp verification code, don’t give it to them. That one code can open the door to criminal access to your account and put your contacts at risk.
