I was on a WhatsApp call with my friend (Alice) when the call suddenly dropped. I then immediately opened my chats and noticed an alert in a mutual group that said "Your security code with Alice changed, because their account was registered on a new device". At this point Alice was logged out of her account on her phone. She then tried to log back in, with WhatsApp sending the verification SMS, and she was able to log back in (at which point I received another alert about the security code changing). Barely a minute passed when Alice was logged out of her account again. She then tried to log back in but WhatsApp said "Your phone number +xxxxx is banned from using WhatsApp. Contact support for help".
We're genuinely perplexed. Just to be clear this whole story from start to finished happened so quickly, within a span of around 5-10 minutes. Neither of us are high profile / high value targets. We're just regular people. Unfortunately she did not turn on the "Two-step verification" feature that requires a PIN when re-registering the number - as a security enthusiast I'm kicking myself for not checking this with her.
So my questions:
- What the **** happened here??? I read that WhatsApp usually bans numbers reported for spam. She definitely did not spam anyone ever. In fact this was a secondary number she used very rarely with other people. Could it be that someone somehow used her number and sent spam so quickly the number was banned within 5 minutes?
- The only way for someone to use her number on WhatsApp is to have access to the verification SMS. I thought this could have been a SIM swap attack, but her SIM card is still usable as normal. Wouldn't a SIM swap result in her card being dead? (and no, she did not receive any verification SMS before this happened. And she knows enough not to give the code to anyone anyway)
- Or could it be that they've been using her number for a while and been sending spam for a while? Unlikely, as far as I know WhatsApp only allows 1 device to be logged in at any time.
- How worried should we be? What data does this "hacker" have? I'm really concerned about the possibility of #3, if it meant that this adversary could have had access to all our messages for an unknown time span.
- Any mitigation steps we need to take? I've already removed the number from all shared groups and she has emailed WhatsApp support, if that does anything.
Edited to add more information in response to Jackson's answer:
Yes I considered malware on her phone, but it is unlikely, although not impossible. That phone is relatively new, and I have taught her quite well on good security practices - never reuse passwords, never install unknown apps, never open unknown links, never use public wifi, never open unexpected email attachments, etc. As far as I know her phone is not being synced or backed up to any servers. At most it's probably connected to Google Drive, and her account is secured with 2FA. I will try to find out whether the service provider supports MultiSim or not.
She never leaves her phone unattended, and only ever uses WhatsApp Web on her personal computer at home. Although I can't guarantee her computer is secure.
Suppose bob has a trojan on Alice. Then he probably has access to everything on the phone. Suppose bob has a whatsapp web connection of Alice then he has access to all her whatsapp conversation Suppose bob is just spoofing Alice number then really not that much to worry. He just spoofing her no data breach. Hopefully nothing done illegally though
If any of these were the case, why was Alice logged out of her account? It would be in Bob's best interest to remain undetected.