Cybersecurity experts warn that phone software needs to be kept up to date to prevent security breaches amid a rise in WhatsApp account takeovers and fraud attempts.

Increasingly dangerous cyberattack methods are emerging in Türkiye and worldwide, especially targeting the popular messaging app WhatsApp.

Attackers can hijack WhatsApp accounts, mimic the compromised account holders’ chatting styles and send deceptive messages to people in their circles, pretending to be in urgent need of loans via bank transfers.

Ibrahim Gunduzgil, head of the cybersecurity program at Istanbul Commerce University, told Anadolu that attackers can gain access to WhatsApp accounts through phishing attacks, including fake links, and social engineering techniques.

“Security vulnerabilities in outdated apps or operating systems can be exploited by attackers, posing an additional risk through the exploitation of known vulnerabilities,” he said, noting that these attacks are not limited to WhatsApp accounts and can also play a role in hijacking active sessions on Telegram and similar apps. He noted that the problem stems from the combined exploitation of technical security vulnerabilities and user behavior.

Gunduzgil stressed the importance of enabling two-factor authentication and other additional security features to make messaging apps more secure, and he warned against sharing two-factor authentication codes received via SMS or other channels.

He also advised checking connected devices and active sessions in apps and revoking access to unrecognized devices.

“Users who suspect their accounts have been compromised must immediately begin the recovery process and notify their close contacts,” he said, adding that explicit requests for money should prompt users to verify the other person’s identity through different communication methods.

Gunduzgil stated that the security vulnerabilities leading to account hijacking are not exclusive to either Android or iOS, but recent reports indicate that iOS devices running outdated software exhibit these vulnerabilities.

WhatsApp Web sessions left open on untrusted computers, as well as other attacks involving malware and fake QR codes, can allow malicious actors to gain unauthorized access to accounts.

“Users can continue using their messaging apps without realizing it, but the attacker can access their apps from another device, so users must ensure the security of their phones, computers and other devices linked to their accounts,” he said.

Sabri Erdemir, head of the computer programming department at Istanbul Commerce University, told Anadolu that screenshots of suspicious messages, links, phone numbers, bank account details used to request money, transfer receipts and the date and time of the incident must be preserved as evidence.

Erdemir warned that simply turning off internet access on compromised devices is not enough to prevent or stop the attack, as attackers can connect to the account from another device.

“The compromised device should not be reset to factory settings, apps must not be uninstalled, and existing records must be preserved,” he said, noting that resetting the phone could destroy forensic evidence of the attack and fraud attempts, which would be instrumental in identifying perpetrators.

“Relevant banks must be contacted immediately in the event of financial loss,” he added, noting that victims should file a report with law enforcement even if no financial loss occurs, as preserved evidence can help identify the perpetrators and prevent the compromised account from being used in the future.