6

A friend of mine (Bob) received a suspicious Whatsapp message today, seemingly from a former colleague (Alice), who claimed to have "forwarded [to Bob] an SMS with a code in it by mistake", and who was asking to send it back.

Bob unfortunately sent the (6 digit) code (received over SMS, in a message written in Spanish, although Bob's account uses a UK number, and his Whatsapp is normally in English) back to Alice over Whatsapp, after which Bob's Whatsapp app seemed to go through the number verification process again.

I received the usual "XXX's security code changed. Tap for more info" notification twice within a few minutes in my Whatsapp conversation with Bob. We have verified that the codes match (only after the second notification).

While it is clear that my friend should not have replied with this code, I do not understand exactly what happened here:

  • Did someone try to login to Bob's Whatsapp account? Is it possible to "move" a Whatsapp account to a new phone simply by inputing the target phone number at the verification stage?

  • What phone number do Whatsapp number verification SMSes normally come from?

  • What is the possible damage resulting from this? Would the attacker (Alice) be able to send messages "from Bob's account"?

  • What cleanup measure should Bob take to limit the damage/recover his account/kick out Alice?

Improve this question

1 Answer 1

Reset to default
6

Did someone try to login to Bob's Whatsapp account?

Yes they tried to access his WhatsApp account and they succeed.

According to WhatsApp FAQ, the message "XXX's security code changed. Tap for more info" is displayed only when you or your contact reinstalled WhatsApp or changed phones. For more details see here.

Is it possible to "move" a Whatsapp account to a new phone simply by inputing the target phone number at the verification stage?

It is possible if the two factor authentication is not enabled. If 2FA is enabled it will ask for a PIN in addition to the OTP in SMS. Learn more about it here. Based on your notification I assume that 2FA is not enabled and the attacker logged into his account successfully.

What phone number do Whatsapp number verification SMSs normally come from?

It varies from country to country.

What is the possible damage resulting from this? Would the attacker (Alice) be able to send messages "from Bob's account"?

Once logged in the attacker will be able to send messages from his account and read any incoming messages. However they cannot access any old messages. They also cannot restore old messages from backup as it would require access to Google account.

What cleanup measure should Bob take to limit the damage/recover his account/kick out Alice?

As soon you login into a new device, WhatsApp will logout of the old device. So as soon as Bob re-login into his device his account will be automatically logged out on the attackers device.

Also as pointed out in the comments log out of any WhatsApp web logins.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .