Fraudsters hijacked an employee’s WhatsApp account and used a convincing copy of a work group to arrange a cryptocurrency transfer. The company, which handles virtual-currency exchanges, lost more than HK$4 million.
The employee’s work group included colleagues and several customers. After taking over the account, the fraudsters blocked the employee from the real group and blacklisted its members, preventing contact with them through WhatsApp. They then created a replacement, copying the original group’s image, name, members and avatars.
One of the fraudsters posed as a customer representative and requested a cryptocurrency exchange in the usual way. The employee sent cryptocurrency to a wallet specified by the fraudster, then tried to deduct the corresponding amount from the customer representative’s virtual-currency account. When the employee noticed the customer’s wallet did not have enough funds for the deduction, they called the customer, who said no request had been made. The employee then realised the group members were impostors and the WhatsApp account was linked to an unfamiliar device.
A post on the police’s CyberDefender Facebook page advised people to enable two-step verification and call the other party to confirm before completing a transfer arranged through WhatsApp.