One click away from empty bank account: Rewari cops in Haryana warn WhatsApp users of ‘ghost pairing’ cyber fraud
The Police Department has advised WhatsApp users to remain alert as cybercriminals are now employing a ‘ghost-pairing’ technique to take over accounts without requiring a password, OTP or SIM swap.
Rewari Superintendent of Police (SP) Hemendra Kumar Meena has urged residents to stay vigilant against this new and serious cyber fraud targeting WhatsApp users.
“The Indian cyber security agency, the Indian Computer Emergency Response Team (CERT-In), has issued a warning about a dangerous hacking campaign called ‘ghost pairing’, in which cybercriminals can take over WhatsApp accounts without passwords, OTPs or SIM swaps,” he said.
The SP said that in this type of fraud, criminals send a link on WhatsApp posing as a known contact. “The link is usually captioned with messages like ‘Hi, check this photo’ or ‘Look at this photo’. As soon as the user clicks on the link, a fake Facebook or media viewer page opens, asking for the mobile number under the pretext of verification. Once the number is entered, hackers misuse WhatsApp’s ‘linked devices via phone number’ feature to link the account to their own device,” Meena said.
He added that this method allows fraudsters to operate silently in the background read the users’ past messages, view real-time chats and send photos, videos, or messages to their contacts on their behalf. “This not only violates privacy, but also poses a threat of fraud,” he stated.
The SP advised people not to click on unknown or suspicious links and to avoid entering their mobile number, OTP or personal information on any external website.
Users should also regularly check the ‘Linked Devices’ section in WhatsApp settings. If any unknown device is found connected, they should log out immediately. For added security, users are advised to keep ‘two-step verification’ enabled at all times.
If anyone suspects their account has been hacked, they should immediately disconnect their internet and call the National Cyber Crime Helpline at 1930 or file a complaint at cybercrime.gov.in.
Do not allow auto-debit on unknown apps/sites: Police
The Rewari police has also issued an advisory regarding cyber fraud linked to auto-pay, subscriptions and auto-debit facilities. SP Meena urged residents to exercise caution while using such features on mobile apps, websites and online services.
He said that recently, several cases have emerged where cyber fraudsters trick users into signing up for subscriptions through fake apps or websites, leading to automatic deductions from their bank accounts or UPI.
“In many cases, users unknowingly grant permission by entering an OTP or clicking on ‘allow auto-debit’. Once approved, money continues to be deducted from their accounts periodically,” he said.
Residents have been advised to regularly check their bank accounts, UPI apps and net banking platforms for active auto-pay mandates and immediately disable any unknown or suspicious ones.
If money is being deducted without their knowledge, they should promptly inform their bank, cancel the auto-pay mandate, and report the matter to the police to enable timely action.
