Andrés López, a WhatsApp user whose account was hacked by criminals and more than three million pesos were stolen from his contacts. It is already known that armed robberies are a constant in the big cities of Colombia. However, with the advancement of digital transactions, criminals have innovated in their ways to make their own. This is the case of Andrés Lopéz, a financial professional who lives in Medellín and who saw how criminals took control of his WhatsApp account and then stole more than three million pesos from his contacts.
After enjoying a well-deserved vacation, López returned to his work activities at the financial company where he works as a director. The first hours of his day passed without major news, until at 10 in the morning he received an unexpected message through WhatsApp in which he was notified, from “technical support”, that his account was going to be used on another device.
López did not see any problem in answering the message and it gave him confidence that the profile photo of the number from which they wrote to him had the logo of the social messaging network.
“The message said that someone was using my account from another device; that if it was me, I would say yes; and if it wasn’t me, I would say no”, he explains.
Faced with the alert of an alleged hacking of his WhatsApp account, Andrés wanted to heal himself and replied “No”, without thinking that minutes later through his profile they would scam several of his contacts.
The young man did not see any danger considering that his WhatsApp was not linked to any sensitive data that could generate any risk.
“I did not see it as fraudulent and I also thought that my WhatsApp is not connected with my banks, with the banks of the organization where I work. It’s not connected to anything, so I said what a fraud this could be, it doesn’t make any sense for me to be scammed by WhatsApp.”
After responding with the word “No”, he received a code through a text message which he had to provide in the same way. At the time of giving said code, he lost control of his WhatsApp account.
“I was very busy with meetings. I could not lose the connection with WhatsApp and I did it”, he admits.
Scam for more than three million pesos
It should be noted that WhatsApp does not allow the use of an account on several devices, so to use the application on another phone, it is necessary to validate the identity through some codes. The same ones that Andrés offered without being forced.
When he requested his account again, after realizing the hack, the application told him that he would have to wait 12 hours to request another code with which to recover his account.
“I’m going to be 12 hours without WhatsApp, but it’s not going to do anything serious, it’s one of my work tools, but I thought: I’ll do something,” he said at the time.
An hour and a half after the blockade, she received a call from a friend who immediately asked her: “Did it work for you? What happened to you?” He, without understanding, asked for explanations, to which his friend replied that he had transferred 700 thousand pesos at his request through WhatsApp.
“That’s when I realized that I do have sensitive information; My sensitive information is my contacts”, he admits.
The criminals borrowed money from their contacts on the social network, using their name and in supposed emergency scenarios.
Even another of her friends, who was also scammed, was a block away; she was in the office and he was having lunch in the surroundings of the company. She alone was robbed of $3,200,000 in two transactions she made, thinking she was helping her co-worker.
Immediately, he put all his family and friends on notice, through chains of information from one contact to another and through various channels.
“I’m not the type of person who borrows money from anyone, that’s why people started calling me before continuing the conversation when they spoke on my behalf.”
Paradoxically, at night his contacts began to receive the same message on WhatsApp that López received before his account was hacked. The most important data for criminals in this case are contacts.
WhatsApp and justice in sight
Andrés López criticizes that WhatsApp has not acted immediately to block his hacked account, even with evidence of a scam involved.
“This social network is not as secure as it seems, it does not act when the user needs it.”
In addition, it targets digital financial platforms, such as Nequi or Daviplata, which only require an email for registration. The criminals managed to use more than 10 different accounts in a few minutes to avoid having the stolen money blocked.
Although Andrés and his scammed friends filed the respective complaints with the authorities for information theft, identity theft and fraud, he is pessimistic about the favorable responses.
“The justice system in this country is inaccessible because it is very difficult to file these types of virtual complaints and it takes a long time, since a lot of information has to be delivered when the victim needs quick attention.”
Finally, his complaint was classified as “document theft”, because the authorities do not have a special item for cybercrimes.
This type of robbery continues to be a constant, but unfortunately the people affected end up being re-victimized. It is common for criticism to fall on the person who acted in good faith, whether it be responding to a message out of fear or transferring money to a friend in need.
Andrés acknowledges that he was innocent and did not take all the precautions, however, the judicial system and also the digital platforms should be strongly questioned for the omission in these cases.
Information security specialist, currently working as risk infrastructure specialist & investigator.
15 years of experience in risk and control process, security audit support, business continuity design and support, workgroup management and information security standards.