Whatsapp account hacked

[Android Central Question]

My fiancée is using whatsapp.

She recently received a whatsapp message from one of her old friends.
The whatsapp message was something like this:
“Hi – I have a problem and I am locked out of my whatsapp. I will get them to forward you an SMS of my security code. Please can you send it to me? Thanks!”

Then an SMS comes through, and she copies and pastes the message (which was a Whatsapp activation Code - which happened to be in Italian, not English [her friend is Italian but that does not matter] ) and sent back to the friend.

Within a minute there is a strange sound from her phone. She checks it and all her whatsapp messages have disappeared. She decides to reboot the phone and the situation has not changed. When she tries to reactivate Whatsapp to her phone number using SMS or email, the error message says “ You’ve tried verifying your phone number too many times – try again in 12 hours”

It is then apparent that the message was not from her friend – someone had hacked her friend’s number and sent her a message from what appeared to be her friend. Once they knew she was willing to send the SMS number, they then typed in my Girlfriends phone number and tried to transfer that whatsapp number over to their own phone (thereby stealing all her whatsapp messages and images – at least for 12 hours – enough to cause havoc) . But of course, they needed an SMS verification code – which would be sent to my Girlfriend’s number. Hence the message from them “.. . I will get them to forward you an SMS of my security code. Please can you send it to me? Thanks!”

And there we have it – one stolen Whatsapp account due to a brief moment of not thinking straight.

I checked via my phone minutes later – the guys were online, using what appeared to be my girlfriends’ number – and we suspect that they were not even in the same country. I am sure they were busy sending out the same message to all her friends saying… “Hi – I have a problem and I am locked out of my whatsapp” - which would appear to be a genuine message from my girlfriend.

I then went through my old messages to my girlfriend which contained bank info, credit card staments, ID photos etc – all of which was compromised.

 

[SpookDroid]

Sorry to hear that, and while the SMS IS needed for account verification from her number, it can also be revoked and only if the phone receives the right activation code can the Whatsapp account linked to said number be used.

Now for the 'compromised data' part: there is almost none (at least not on Whatsapp's part). Whatsapp doesn't store your messages, files, or even your chat back ups. AT ALL. Even if an attacker has managed to get the verification code working, all they'd see is the account's phone number and custom name/picture. Group chats would be re-created, but no messages would be included, so all they'd see is the phone numbers included in those group chats. No messages, no pictures, no data.

For contacts, no individual chats will be re-generated and even though they can see the phone number list, unless those numbers are in THEIR contact list, they won't see any further info.

All cloud chat back ups and restores are done through separate accounts (Google account through Drive for Android, Apple account through iCloud for iPhones), so unless the attacker also has access to those credentials, no messages, pictures, or any other data has been accessed.