Can WhatsApp recover Google Drive backups if the phone is not connected to the original Google account?

Question

Last week Brazilian news outlets reported a scam involving WhatsApp where an attacker could get access to an WhatsApp account by activating the target phone number on a different device in control of a scammer. A detailed report is available here (Portuguese link). The scam works as follow:

1. An employer of the carrier where the target phone number belongs would activates this same number on a different device, in possession of the scammer.
2. The scammer then activates the WhatsApp account of the victim on this new phone, since it can now capture the SMS used to validate if a given device is in control of a given number.
3. The scammer contacts the victim's family and friends, pretending to be in need of money, asking for transfer, this sort of thing.

Of course there are many flaws in the plan, since the original owner of the phone would notice his device no longer works, and some scammers have been caught already. It also needs the cooperation of a rogue carrier employee. Also with the new WhatsApp feature of two-step authentication, this attack can be prevented for 7 days.

However, all the news outlets have reported that the scammers had access to the following data:

• Groups
• Contacts
• Chats history

The first two items seem reasonable to me, what seems strange is how scammers could have access to the chat history, since we know WhatsApp only stores undelivered encrypted messages. This must mean that the scammer is getting the history from the Google Drive backup. However, the scammer only has the power to get hold of the phone number, how can he get access to the conversation files on Google just by controlling this?

I think it's really unlikely for this to be true, because my Google Account is protected by a password and extra check via two-step authentication, which the scammer does not have. Is this story not being reported accurately?

Answer 1

Is this story not being reported accurately?

Yes, in some way. I mean, the information you've questioned is accurate (at the first time I doubted too), they just did not explained all the details behind. So I decided to message Ronaldo Prass, the person behind this statement on the article you linked (which on free translation look like this):

He (the scammer) will identify who are the relatives and friends. He has the chat history which he could benefit from and use to make the scam more reliable, making the victim have no questions about it

According to him, there are more deep steps in this scam which the press did not publish as it somehow "could be a recipe for the scam".

There is a major point we are forgetting here: The scammers have someone on their side at a carrier.

With that said, it's easy to deduce that the employee have access to the victims register. Thus the scammer and the "team" behind it have all the information they need, including victim's email address. Also, the victims might have not been chosen randomly but based on their profile instead.

Well, now the attacker has the victim's email and mobile number (cloned on a new phone), all he needs is try to gain access to the account via a recovery fallback as you can see on the image bellow (that fallback actually helps the attack: similar point here). He just asks for recovery and get full access to the desired account.

                             

That is the first and very important part of the scam, which the press seems to avoid explaining. Only after that they configure WhatsApp on the "cloned phone" with all chat history, contacts, groups, everything.

Basically this scam is only possible (i̶n̶ ̶B̶r̶a̶z̶i̶l̶ ̶b̶e̶c̶a̶u̶s̶e̶ ̶o̶f̶ ̶B̶r̶a̶z̶i̶l̶i̶a̶n̶s̶*̶)̶ with help of a carrier employee and the major vulnerability here is how easy is to them to transfer the number to another SIM card for a scammer.

* DISCLAIMER: I'm Brazilian

EDIT: As far as I am concerned, we are all safe with any kind of two-step verification, since both steps needs to be approved. In this case the scammer will fail at one of them. This scam may affect only people without two-step verification and with a recovery phone set.