Scammers target WhatsApp users with phishing attempts

Over the past week, WhatsApp users have been inundated with missed video and voice calls on the platform from a variety of country codes. This is the latest in phishing attempts by scammers that have left India's telecom industry scrambling to deal with ever-growing menace.

The problem is that while telcos and the regulator have been working to create artificial intelligence (AI)-based solutions to check spam calls and messages over the regular terrestrial network, scammers have moved to over-the-top (OTT) communication platforms such as, but not limited to, WhatsApp.

“Scammers will evolve. So, even as the telcos and regulators are addressing scam on telecom networks, the scammers have moved to OTT communication platforms,” said Faisal Kawoosa, chief analyst at Techarc.


The Telecom Regulatory Authority of India (Trai) has come down hard on pesky calls and messages over the past few months. Private telcos have been exploring further options to check unsolicited commercial communication (UCC).

So far, Vodafone Idea has demonstrated its anti-phishing solution, developed by Tanla Platforms, to Trai. But this is primarily meant to filter SMS traffic and it can only inform platforms such as WhatsApp if there is a link to it in the message. It can’t check WhatsApp traffic as it runs on a telecom operator’s network.

Bharti Airtel and Reliance Jio are yet to demonstrate their solution to the regulator but even in their case, blocking and filtering of OTT messages and calls is not going to be possible, said company executives.

“Filtering out OTT traffic will be difficult as such apps are not regulated and the platforms themselves have to take measures to stop phishing and spam,” said a telecom firm executive.

Any anti-phishing solution which can’t work on OTT will be less effective as even the traditional commercial SMS traffic is increasingly shifting towards IP or internet protocol messaging, another telecom executive added. For instance, more businesses are shifting to WhatsApp’s platform for enterprises due to cost efficiencies.

“We have been requesting the government and Trai to regulate OTT apps, so that such problems can be addressed,” said another telco executive.

Asked about rising phishing and spam messages, a WhatsApp spokesperson said, “We take immediate action to remove illegal activity as quickly as possible, and strongly encourage users to report any suspicious activity,”

A Trai official said curbing phishing and spam is a top priority for the regulator and it will see what can be done on phishing through apps.

“After Vodafone Idea, Airtel has sought time to demonstrate its solution to us,” the person said. “We will see what they have done. Based on the requirement, we will take a call around phishing and spam.”

Scammers typically create a fake account on Facebook or Instagram. This is used to approach potential victims on the platforms with fake offers and phishing links. They also operate through apparent incentives--such as a job offer--or fake threats such as the closure of bank accounts. In most cases, the numbers sending these messages over WhatsApp are 10-digit ones labelled as business accounts.

These messages often include a link that leads to malware or other malicious entities that can result in data theft or phone cloning.

Industry executives said scammers are trying to keep a step ahead, revising their modus operandi in 24 hours, making it difficult for law-enforcement agencies to catch them.

“Key here would be quick action by the government to reports of such cases, even if it is to pull up and question the platform being used,” Kawoosa said.

The WhatsApp spokesperson said: “Over the years we have made significant product investments and launched user awareness campaigns that empower users to stay safe.”

Additionally, the Meta-owned platform said it has invested in AI and other state of the art technology, data scientists and experts to protect users. In March alone, WhatsApp banned over 4.7 million accounts.

“Unfortunately, online scams are a threat to users all across the internet. Meta uses the most sophisticated security software available, and we continue to make significant investments in advanced detection technology to keep our users safe,” Meta said in response to queries regarding phishing on Facebook and Instagram.

The platform added that it frequently runs scam awareness campaigns and has most recently partnered with the Ministry of Electronics and Information Technology (MeitY) for the G20 Stay Safe online campaign, stressing that it has a zero-tolerance policy.

“Perhaps India could take the lead in initiating a digital standards consortium much like the ITU (International Telecommunication Union) for telecom that addresses standards for usage of OTT communication apps,” Kawoosa said.