WhatsApp Takeover: When Your Number Is Not Yours

Imagine someone changing the locks on your house while you are inside, then starting to invite guests in your name, borrowing money from your neighbors in your name, and whispering personal secrets to your closest friends—all while they are absolutely certain it is you. In the digital space of the 21st century, our WhatsApp account is much more than a messaging app; it is the main corridor of our social, professional, and personal lives. When it is stolen from us, we do not just lose a communication tool; we lose our identity in the eyes of those around us.

This chapter deals with one of the most common and painful scams: WhatsApp account "hijacking." Unlike complex breaches of bank servers, here the main weapon is not sophisticated software code, but a deep understanding of human psychology. This is a story about trust exploited, a single moment of inattention, and the legal and technical battle to turn the tide.

The following scenario is a pedagogical example based on common fraud patterns. The characters and events are for illustrative purposes only.

Eyal's Story: One Code Too Many

Eyal, an esteemed renovation contractor, was sitting in his living room one evening. His phone buzzed. A message from Yossi, a close friend from military reserve duty: "Eyal brother, a WhatsApp verification code meant for me was sent to you by mistake. Can you pass it to me quickly? I'm stuck outside without access to my email." Eyal, without giving it a second thought, saw that at that very moment an SMS message with a six-digit code had been received. "Sure Yossi, here is the code: 482-193," he typed and sent.

Seconds later, Eyal's WhatsApp screen went dark. A white message appeared in the center: "Your phone number is no longer registered on this device." Eyal tried to log in again, but the app required a verification code. He waited for the SMS, but it did not arrive. He tried calling Yossi, but the line was busy. He did not know that at that very moment, the "Yossi" who had sent him the message was actually a hacker who had hijacked Yossi's account a short while earlier, using the exact same method.

In the following hours, Eyal's world began to fall apart. His customers started receiving urgent messages: "Hi, I'm stuck without cash at a hardware store, can you transfer me 2,000 NIS via Bit? I'll pay you back tomorrow morning when I get to the site." Some of the customers, who knew Eyal as a reliable and honest person, rushed to help. One of them, an elderly woman whose house he had recently renovated, transferred the money without hesitation. When Eyal finally managed to understand what was happening, the damage was already done. Not only was his customers' money lost, but also the reputation he had built with great effort over many years. He felt violated, exposed, and above all—helpless against the digital system that had closed its doors on him.

Anatomy of a Scam: How Does It Actually Happen?

A WhatsApp takeover is usually the result of "social engineering." The attacker does not hack into the systems of Meta (the parent company of WhatsApp), but rather convinces the victim, or a third party, to provide them with the "entry key." This key is the six-digit verification code that WhatsApp sends via SMS when attempting to set up the account on a new device.

Another common method is hijacking via voicemail. Many attackers operate in the late-night hours. They enter the victim's phone number on their device and request to receive the verification code via a "voice call." Since the victim is asleep or not answering, the call goes to voicemail. The attacker, using simple voicemail hacking services (which are sometimes protected by default passwords), listens to the recorded message, extracts the code, and takes over the account.

Once the attacker enters the account, their first step is setting up "two-step verification." They set a personal PIN code and a recovery email address that belongs to them. From that moment on, even if the victim tries to re-register with their SMS, the system will require the PIN code the attacker defined. The victim is locked out of their account for at least seven days—an eternity in terms of digital fraud.

The Legal Aspect: Liability, Negligence, and Data Protection

When such a case is examined legally, the first question is always: "Who might bear responsibility for the damage?" The answer is complex and intertwined with the Privacy Protection Law, 1981, and the Computers Law, 1995. In Israel, legal liability in cases of digital fraud is examined under several parameters, the most central of which is the issue of negligence.

The Privacy Protection Law stipulates that a violation of privacy is, among other things, the use of a person's name, image, or voice for profit. In the case of a WhatsApp takeover, the attacker is committing a serious criminal offense and also a civil tort. But since the attacker is usually anonymous or operating from a foreign country, the liability of institutional entities is sometimes examined: the telecommunications company, the credit card issuer, or the apps through which the funds were transferred.

This is where the question of "contributory negligence" comes in. In a general legal analysis of legal options, one can examine whether the account holder acted reasonably. Could providing a verification code to a stranger (or even a friend, without verifying their identity) be considered negligence? The Payment Services Law, 2019, regulates many of these cases. The law states that in the case of "unauthorized use" of a payment instrument, the customer's liability may be limited, unless it is proven that the customer acted with fraudulent intent or provided the verification details under circumstances where they should have been suspicious.

It is important to understand: unlike credit cards, where it is easier to define "unauthorized use," in WhatsApp, the damage is usually indirect—money that friends or customers transferred to the attacker believing they were helping you. In such cases, one can examine the bank's liability if it failed to identify an abnormal transfer pattern, but the burden of proof required is significant. The specific circumstances of each case, the speed of the reporting, and the steps taken by the account holder to protect themselves must be examined.

The Crisis: Beyond Financial Loss

The legal aspect is only part of the picture. The psychological and social damage is often more significant. In a pedagogical scenario based on known cases, a situation may arise where an attacker takes over an account and begins sending personal and sensitive information to contacts while demanding ransom. This is extortion in every sense, and it demonstrates how information that is ostensibly encrypted in our conversations can become a weapon the moment the account is breached.

In such cases, the police (cyber unit) enter the picture. Filing a complaint is critical not only for opening an investigation but may serve as a layer in establishing the legal argument before various bodies that the account was indeed not under your control. Without confirmation of filing a complaint, it will be harder to argue against credit charges or financial transfers made in your name.

Courses of Action: What to Do When the Account Is Hijacked?

If you discover that your account is unavailable, it is recommended to act quickly. Every minute the attacker is inside is a minute in which they might defraud more people or extract sensitive information.

1. Attempting Re-registration

You can try to log into WhatsApp and re-register with the phone number. If the attacker has not yet had time to set up two-step verification, the SMS code you receive might disconnect them from their device. If the attacker has already set a PIN code, the system may require waiting a few days.

2. Notification to Contacts (Social Vaccination)

This is an important step to prevent damage to others. Post on every possible platform—social networks, regular SMS, or phone calls—that your WhatsApp has been breached. Ask people not to answer messages in your name and not to transfer money under any circumstances.

3. Contacting WhatsApp Support

You can send an email to support@whatsapp.com. It is recommended that the email subject line be: "Lost/Stolen: Please deactivate my account." In the body of the email, you must specify the phone number in full international format. Deactivating the account may prevent the attacker from continuing to use it.

4. Disconnecting WhatsApp Web

If you still have partial access, it is recommended to go to Settings -> Linked Devices -> and disconnect all devices you do not recognize.

Prevention: The Digital Shield

Throughout my professional career, I have observed that not enabling two-step verification is a significant security vulnerability. This is a simple step that can prevent the overwhelming majority of takeover cases.

When setting up two-step verification, you create a personal PIN code. Even if the attacker obtained the SMS code (through fraud or otherwise), they will not be able to enter the account without the personal PIN. In addition, it is important to update a recovery email address and ensure that the email itself is well protected.

Warning Signs – When to Be Suspicious?

• Request for a code from a friend: A friend or family member asks you to pass on to them a code that arrived in your SMS "by mistake." Remember: a verification code is personal and should not be passed to anyone else.
• Strange messages: Receiving a message from a known person, but in a writing style that is uncharacteristic of them.
• Urgent demand for money: A request for an urgent transfer of funds based on a claim of an emergency.
• Phone calls at odd hours: Calls from unknown numbers abroad that hang up immediately—sometimes this is an attempt to check the line's availability for a voice call code.

What to Do Immediately Upon Discovering the Breach?

• Report to the police: You can file an online complaint on the Israel Police website. This is an important tool for documenting the incident.
• Update the bank and credit card companies: If there is a concern that payment details were exposed, it is recommended to examine the need to cancel them.
• Email support: Send an email to deactivate the account as explained above.
• Check other accounts: It is recommended to check social network and email accounts to ensure they were not also breached.

Legal Aspect and Conclusion

The legal landscape in the field of cyber in Israel is in constant development. Today, we can see a trend of recognizing the economic and psychological value of "digital assets." A WhatsApp account takeover may be considered a violation of property and privacy. In certain cases, it may be possible to examine grounds for a lawsuit against service providers if it is proven that they were negligent in securing the information.

However, we must remember that the best defense is awareness and preventive caution. In cases of harm, various legal options can be explored, and the chance of achieving an optimal result depends on the specific circumstances of the case. Documentation, prompt reporting, and professional advice are significant tools in dealing with such incidents.

In the next chapter, we will examine the "SIM Swapping" method—a fraud scenario in which control over the phone line itself is taken from its owner.