The Cyber Security Authority (CSA) has observed a worrying trend of increased reports of unauthorised access and online scams perpetrated through the takeover of social media accounts particularly, WhatsApp.
According to CSA, compromised social media accounts are used to commit fraudulent activities such as investment fraud, online shopping scams, job recruitment scams, romance scams, and solicitation of funds, among others.
A second trend, the authority observed has to do with a WhatsApp users being lured to expose his/her nudity over a video call with someone they think they know.
The session is recorded by the other party (or an associate) without the knowledge of the victim. The malicious actor then comes back to extort money from the victim in exchange for not releasing the video.
Modus operandi
The CSA said a potential victim would either receive a call from an unknown number or a message from a friend (whose social media account may have been compromised) requesting the victim to share a one-time password (OTP) (usually a 6-digit verification code) sent to the victim’s number as a text message.
The scammers apply social engineering, typically creating a sense of emergency and request for the OTP which was sent to the victim. The victim would thereafter lose access to the account after providing the scammers with the verification code.
The scammers, after gaining access to the victim’s account then target persons and groups on the victim’s contact list as the next potential victims. Through this, the scammers would impersonate the victim’s friends and promote other fraudulent activities or solicit funds.
The scammers’ request would be on the pretext of helping them to join online groups such as work or school groups or sign up and claim prizes for fake lucky draws allegedly conducted or joined.
On sextortion
The authority warned that a potential victim would typically make a new friend on a social media platform such as Facebook. Eventually, the two parties exchange WhatsApp numbers and the chats continue over there, establishing a level of trust and familiarity.
After some time, a video call is initiated over which the victim ends up being persuaded to go nude. Unknown to them, the session is recorded by the other party. Some days afterwards, the other party (or an associate) will contact the victim indicating that they have these videos and will threaten to release them in public unless they receive a specified payment.
In some cases, the criminals will go ahead to share it online, provide a link (URL) to where it is and indicate it would only be taken down when they are paid. The demands typically do not end once the first payment is made.
Mitigation measures
Countering account takeovers, enable ‘two-step verification,’ open WhatsApp settings, tap account, enter a six-digit PIN of your choice and confirm it, provide a valid email address you have access to or tap skip.
Otherwise, if you forget your PIN, you will have to wait seven days before you can reset it. Tap next, confirm the email address and tap save or done.
Avoiding sexual extortion schemes
Avoid initiating or participating in video calls of an intimate nature, that is where nudity is displayed, sexually explicit acts are performed etc. If you receive a ransom demand, do not make a payment. Instead, report it immediately to the CSA’s Cybersecurity/Cybercrime Incident Reporting Points of Contact for guidance.
General recommendations
The following measures are recommended to prevent online scams; never share your social media application account verification codes with anyone, protect all your social media application accounts by enabling the ‘Two-Step Verification’ or ‘Two-Factor authentication (2FA)’ feature and be aware of who has physical access to your phone. If someone has physical access to your phone, they can use your account without your permission.
The rest are do not be impulsive, beware of unusual requests from strangers or even your social media contacts, don’t believe, thus be wary of claims that you have won a prize, especially if you have not participated in any campaign or lucky draw, check official websites to determine whether the lucky draw offers are legitimate, always verify the authenticity of the request by contacting your friend, but do not do so through the social media platform as the account might have been taken over by scammers.
It is also not advisable to transfer money or give out your personal information, bank account or credit/debit card details, and One-Time Password (OTP) to anyone, including family and friends, If you are contacted by anyone claiming to have images and/or videos of you of an intimate nature requesting payment in exchange for not releasing them to the public, report it immediately to the CSA’s Cybersecurity/Cybercrime Incident Reporting Points of Contact (PoC) for guidance and do not make any payments.
The CSA has a 24-hour PoC for reporting cybercrimes and for seeking guidance and assistance on online activities by Calling or texting 292, WhatsApp on 050 160 3111 and email on report@csa.gov.gh
