Preventing WhatsApp Hacks: Lessons from a Real Incident

My father’s WhatsApp account got hacked last night. It wasn’t due to any tech vulnerability. He had absent-mindedly clicked on a link sent by a friend while he was on a phone call. Turns out his friend’s account had been compromised, and he had clicked on a malicious link.

He soon found his account hijacked. We worked together to try and contain the damage. Share a few learnings from this incident, which I believe would be useful for the larger online community:

✔️𝘚𝘵𝘢𝘺 𝘤𝘢𝘭𝘮 𝘢𝘯𝘥 𝘨𝘦𝘵 𝘵𝘩𝘦 𝘳𝘪𝘨𝘩𝘵 𝘴𝘶𝘱𝘱𝘰𝘳𝘵: It can be very distressing to learn you are a victim of a cybercrime/attack. Stay calm and check available support and resources, particularly from the app/platform on which the breach occurred.

✔️𝘊𝘰𝘯𝘵𝘢𝘪𝘯 𝘵𝘩𝘦 𝘥𝘢𝘮𝘢𝘨𝘦: While working to recover your account, change your email and other important account passwords, and notify your bank immediately.

✔️𝘕𝘰𝘵𝘪𝘧𝘺 𝘺𝘰𝘶𝘳 𝘤𝘰𝘯𝘵𝘢𝘤𝘵𝘴: Let your contacts and online community know about the incident, so they don’t make the same mistake or make any financial transfers. The good news here is that this doesn’t appear to be the work of a sophisticated hacker, and most recipients would be able to discern that something was not right.

✔️𝘉𝘦𝘵𝘵𝘦𝘳 𝘭𝘢𝘵𝘦 𝘵𝘩𝘢𝘯 𝘯𝘦𝘷𝘦𝘳: Implement good cyber hygiene practices such as 2FA, recovery email, privacy settings, and regular back ups.

✔️𝘋𝘰𝘯’𝘵 𝘣𝘦 𝘵𝘰𝘰 𝘩𝘢𝘳𝘥 𝘰𝘯 𝘺𝘰𝘶𝘳𝘴𝘦𝘭𝘧: Remember, you are not alone. Human error accounts for 80-90% of cyber breaches, including phishing and hacking incidents, like the one my dad experienced. Even the best of us will make mistakes when distracted.

𝗪𝗶𝘁𝗵 𝟴𝟬-𝟵𝟬% 𝗼𝗳 𝗰𝘆𝗯𝗲𝗿 𝗮𝘁𝘁𝗮𝗰𝗸𝘀 𝗯𝗲𝗴𝗶𝗻𝗻𝗶𝗻𝗴 𝘄𝗶𝘁𝗵 𝗽𝗵𝗶𝘀𝗵𝗶𝗻𝗴, 𝗮 𝗹𝗮𝗿𝗴𝗲 𝗽𝗮𝗿𝘁 𝗼𝗳 𝗰𝘆𝗯𝗲𝗿 𝗮𝘄𝗮𝗿𝗲𝗻𝗲𝘀𝘀 𝗶𝗻𝘁𝗲𝗿𝘃𝗲𝗻𝘁𝗶𝗼𝗻𝘀 𝘀𝗵𝗼𝘂𝗹𝗱 𝗳𝗼𝗰𝘂𝘀 𝗼𝗻 𝘁𝗵𝗲 𝗵𝘂𝗺𝗮𝗻 𝗿𝗶𝘀𝗸 𝗳𝗮𝗰𝘁𝗼𝗿𝘀.

This involves 𝗰𝘆𝗯𝗲𝗿 𝗮𝗻𝗱 𝗯𝗲𝗵𝗮𝘃𝗶𝗼𝗿𝗮𝗹 𝗲𝗹𝗲𝗺𝗲𝗻𝘁𝘀 such as 𝗰𝗼𝗴𝗻𝗶𝘁𝗶𝘃𝗲 𝗼𝘃𝗲𝗿𝗹𝗼𝗮𝗱, 𝗮𝘂𝘁𝗵𝗼𝗿𝗶𝘁𝘆 𝗯𝗶𝗮𝘀, 𝗺𝘂𝗹𝘁𝗶𝘁𝗮𝘀𝗸𝗶𝗻𝗴 𝗮𝗻𝗱 𝗼𝘁𝗵𝗲𝗿 𝗱𝗶𝗴𝗶𝘁𝗮𝗹 𝗱𝗶𝘀𝘁𝗿𝗮𝗰𝘁𝗶𝗼𝗻𝘀, 𝗮𝗻𝗱 𝗽𝘀𝘆𝗰𝗵𝗼𝗹𝗼𝗴𝗶𝗰𝗮𝗹 𝗺𝗮𝗻𝗶𝗽𝘂𝗹𝗮𝘁𝗶𝗼𝗻, among others.