WhatsApp ‘NO’ scam: Hyderabad police warn of new cyber fraud

Cyber fraudsters are allegedly using a new WhatsApp scam in which victims are tricked into replying “NO” to a fake bank transaction alert, Hyderabad Police Commissioner V.C. Sajjanar has warned.

In a post on X, Sajjanar said the scam does not necessarily involve the victim sharing an OTP or clicking on a suspicious link. Instead, fraudsters first send a WhatsApp message claiming that money has been debited from the recipient’s bank account, followed by another message asking them to reply “NO” if they did not make the transaction.

“‘NO’ means… bank account empty!” Sajjanar said in his warning, describing the alleged method as an “Auto Execution File Attack”. According to Sajjanar, the scam is designed to create panic and prompt the recipient to respond immediately. He said that in a case that came to his notice, a victim’s bank account was allegedly emptied after the person replied “NO”. The victim, he said, had neither shared an OTP nor clicked on a suspicious link.

How the alleged WhatsApp scam works

Sajjanar said fraudsters begin by sending a message from an unknown number claiming that a particular amount has been debited from the recipient’s bank account. They then follow it with an instruction such as “If you did not make this transaction, immediately reply NO.”

The police commissioner alleged that once the victim sends the reply, “the malware scripts hidden in that message get automatically activated”. He further claimed that the attackers can then gain control of the victim’s mobile phone and access funds in linked bank accounts.

Sajjanar said the same method had recently been used against a chartered accountant, whose account was allegedly drained. “Out of the fear that money has gone from the account, the moment you type and send ‘NO’… the malware scripts hidden in that message get automatically activated,” he said.

He advised people not to respond to WhatsApp messages from unknown numbers claiming that money has been debited from their bank accounts. “Under no circumstances should you reply ‘YES’ or ‘NO’ to messages about bank transactions coming from unknown numbers!” Sajjanar said.

Instead, he advised users to block the number and delete the chat. People who receive such messages should verify their account directly through their bank’s official mobile application rather than relying on information received through WhatsApp. “No official bank ever asks for such replies on WhatsApp,” Sajjanar said.

He also urged victims of cyber fraud to immediately call the national cybercrime helpline 1930 or file a complaint through the government’s cybercrime reporting portal.