WhatsApp ‘No’ fraud alert: 5 ways to protect your money from scammers | Personal Finance

A WhatsApp message claiming that money has been debited from your bank account can prompt you to act immediately, particularly if it asks you to reply “NO” to report an unauthorised transaction. However, responding without verifying the claim could expose you to further fraud attempts.

 

Hyderabad Police Commissioner V C Sajjanar has warned people about suspicious WhatsApp messages that allegedly trick recipients into responding to fake banking alerts. He said that a person lost money after replying “NO”, without sharing a one-time password (OTP) or clicking on a suspicious link.

 

The police warning has raised concerns about how fraudsters exploit people’s fear of losing money. However, the specific claim that replying to a simple WhatsApp message can automatically activate malicious software has not been independently verified. A reply alone does not normally install malware on an updated smartphone.

  

For users, the practical lesson is to verify banking alerts independently rather than follow instructions from unknown numbers.

 

How does the WhatsApp ‘No’ scam allegedly work?

According to Sajjanar, the suspected fraud begins with a message from an unknown number, sometimes an international number, claiming that money has been debited from the recipient’s bank account.

 

A follow-up message asks the recipient to reply “NO” if they did not authorise the transaction. The apparent objective is to create panic and encourage an immediate response before the recipient checks their account.

 

Sajjanar described the alleged incident as an “auto-execution file attack” and said even professionals, including a chartered accountant, had reportedly been targeted.

 

The technical explanation, however, requires independent verification. Under normal circumstances, replying to a text message on WhatsApp does not automatically execute a malicious file. Cybercriminals typically exploit other vulnerabilities, such as deceptive links, malicious attachments, unsafe application downloads or security flaws in a device.

 

Users should, therefore, distinguish between the unverified claim about an automatic attack triggered by replying “NO” and the established risks associated with malicious files, fraudulent applications and phishing attempts.

 

What should you do if you receive such a message?

The safest approach is to avoid interacting with a suspicious message until you have independently established whether the claimed transaction is genuine.

 

Here are five precautions to follow.

 

1. Check your bank account independently

 

Open your bank’s official mobile application or internet banking website directly. Check your recent transactions and account balance to establish whether any money has actually been debited.

 

Do not use a link or telephone number supplied in the suspicious message. If you need assistance, contact your bank through its official customer-care channels.

 

2. Do not reply to unknown numbers

 

Avoid responding to messages that ask you to confirm transactions, particularly when they create urgency or threaten further losses.

 

Even if replying “NO” does not ordinarily install malware, engaging with suspicious senders can expose you to additional social-engineering attempts. Fraudsters may use subsequent conversations to obtain personal information or persuade you to take unsafe actions.

 

3. Never download suspicious files or applications

 

Do not open unexpected attachments, install applications at a sender’s request or grant unfamiliar apps access to sensitive information.

 

Be particularly cautious if someone asks you to install an application outside an official app store or enable accessibility permissions on your phone. Such permissions can give malicious applications extensive control over certain device functions.

 

4. Never share banking credentials or OTPs

 

Banks do not need your ATM PIN, internet banking password, card security code or OTP to send you an ordinary transaction alert.

 

Do not disclose these details to anyone claiming to represent your bank. Also, avoid sharing screen access or remote-control permissions with unknown callers.

 

5. Block and report suspicious senders

 

If a message appears fraudulent, use WhatsApp’s reporting and blocking features. Avoid forwarding suspicious messages to other people, as this could spread misleading information or malicious content.

 

Keep your phone’s operating system and applications updated to reduce exposure to known security vulnerabilities.

 

What if money has already been debited from your account?

If you notice an unauthorised transaction, act immediately. Do not wait to establish exactly how the fraud occurred.

 

Call 1930: Report the incident through India’s national cybercrime helpline for financial fraud as soon as possible.

 

File an online complaint: Submit the details through the National Cyber Crime Reporting Portal at cybercrime.gov.in .

 

Inform your bank: Contact the bank through its official channels and request that it take appropriate steps to secure your account and investigate the transaction.

 

Secure your device: If you downloaded an attachment, installed an unfamiliar application or granted remote access, disconnect the device from the internet if necessary and seek technical assistance. Change compromised banking credentials using a trusted device.

 

Preserve evidence: Keep screenshots of the messages, the sender’s number, transaction references and complaint acknowledgement details.

 

Quick reporting may help banks and authorities trace or hold the transferred funds, but recovery is not guaranteed.

 

Customers should also ask their bank about the procedure for reporting unauthorised electronic transactions. Under Reserve Bank of India rules, a customer’s liability can depend on the circumstances of the transaction, including whether the loss resulted from a bank deficiency, a third-party breach or the customer’s own negligence, and how quickly the incident was reported.

 

Can a WhatsApp message alone empty your bank account?

A suspicious message should not automatically be treated as proof that a phone has been compromised. The claim that a simple “NO” response can, by itself, trigger malware and drain a bank account remains unverified.

 

Nevertheless, the incident highlights a broader risk. Fraudsters exploit fear and urgency to persuade people to act before checking whether a message is genuine.

 

The most reliable safeguard is to verify every claimed debit through your bank’s official application, website or customer-care service. Do not click unfamiliar links, install unexpected files or share confidential banking information.

If a message claims that your money is at risk, check your account first. Do not let the message dictate your next action.