WhatsApp scammers taking advantage of Caymankind

As the pirate captain of the Bloody Bay Buccaneers, Darvin Ebanks often pretends to plunder, but recently an online scammer sought to steal from him and others.

Ebanks fell victim to one of the latest WhatsApp schemes which takes over accounts and then solicits funds from contacts on chats.

“This was the first time something like this has ever happened to me,” Ebanks told the Cayman Compass in a recent interview about his experience.

Random call

He said it all started with a call from an unknown Cayman Islands number.

“These people just called me out of the blue and told me about doing a video link on my WhatsApp and then, of course, they asked me about putting a [code] with a couple numbers, and then I hung up. He called me back, but I didn’t answer the phone,” he said.

By then, however, it was already too late – the scammer had already taken over Ebanks’ WhatsApp account.

Ebanks said it happened so fast he did not realise his Whatsapp had been hacked until he was bombarded with worried calls from friends.

“About probably 10 minutes after that, about five of my friends called me asking if I was [OK and if] I asking them for money, and I say ‘no, no, and it’s not me’. Of course, they say they knew it was not me … they [kept getting] asked for $500, $500 … Of course, nobody sent in the money,” he said.

John Watson, head of the Royal Cayman Islands Police Service’s Cyber Crime Team, says Ebanks’ story is one that is becoming all too familiar.

At least 24 Cayman residents have fallen victim to this WhatsApp scam this year, he said, adding that some of those victims have lost money to scammers.

“One of the things I absolutely love about this island is its CaymanKind. Unfortunately, that can make us a little bit susceptible to these types of things where we tend to be a little bit too trusting of stuff we see online, particularly if it comes from a friend,” he said.

The number of cases could be higher, he added, as some victims may not have reported being scammed.

The scam is not limited to the Cayman Islands. The United Kingdom has reported 622 similar cases.

Like the the RCIPS, several international law enforcement agencies have issued warnings advising the public to be aware of scammers.

Here in the Cayman Islands, Watson said, his team has been seeing an increasing number of reports where scammers, posing as a contact, will send messages to various people who are on WhatsApp groups saying something bad has happened to them and they need money.

“Unfortunately, people on island have been sending money because they really believe it’s the owner of the phone. But the owner of the phone’s lost control of the [WhatsApp account] to the scammer by giving away the six-digit authentication code,” he said.

How the scam works

Watson said the aim of the scam is to take over an individual’s WhatsApp account, giving them access to that person’s chats and contacts which they can then target for money.

“So I could use [a] phone and I could try to set up a WhatsApp account [using a person’s] telephone number, for instance. It will get me to the point where I have to authenticate. That authentication code is going to go to [the person’s phone]. What I need to do now, as the bad actor or the scammer, is … persuade you to give me that six-digit code. Once I have that six-digit code, I basically control your account and I can lock you out of it,” he explained.

Watson said residents should never share their verification code which WhatsApp also advises when the code is triggered on a phone.

“If it’s from WhatsApp, from a text message, from an email, if you’re not expecting that message, you’re not expecting that email, you’re not expecting that type of call, verify it using some [other means] than the platform it came on,” he said, adding the best way to do this is through a direct phone call to the individual the message purported to come from.

He added, “Trust nothing, verify everything and if you receive a request for that code, or you receive a request from a friend asking you for money, then verify that by another means. Phone them up, speak to them on something other than WhatsApp.”

Those who have been swindled out of money, he said, have not been able to have those funds returned.

Watson said though the numbers being used show the Cayman Islands 345 phone code, those numbers have been spoofed, which means that they originate from overseas, but have been programmed to appear as local numbers.

What to do if scammed?

Ebanks said after his account was taken over, he had to go through the hassle to going to his service provider to take back control of his account.

“It just got to be more of a pain. Every time I go into my WhatsApp I have to put my code in, which I did not do before. But you know, that’s the way it is in the world with technology and getting scammed and ripped off,” Ebanks said.

He said he will be more skeptical about calls and messages coming to him, given his experience, and he urged the community to do the same.

Ebanks said after his experience he will be wary of calls from people with foreign accents.

He added that his concern is for the elderly residents in the community who are not tech savvy and would not quickly recognise a scammer or know how to respond if contacted.

“Just be aware of these things because, in the age of technology, of course, all kinds of things happen. Just be careful of people calling you, giving you some big story about being here, getting you to do this or do that. If you don’t recognise their voice, just hang up,” he said.

Watson also urged residents to always back-up their accounts and to set up the two-step verification on their account, which gives an added layer of protection.

He said if an account is compromised, the best step is to delete the app from the device and reinstall it.

“You will go through the process again of putting in your own telephone number, and Google will send you the six-digit authentication. When you’ve got that, you can restore from your back-ups and you have your WhatsApp account back. However, we recommend that you install WhatsApp’s two-step verification,” he added.

He said, every so often, WhatsApp will prompt the device for the verification code, preventing scammers from stealing the account.

“It’s really important you go down the further steps to protect your account and, of course, never give any details online of your bank, your address or any personal details,” Watson warned.

Though these cases are under investigation, no arrests have been made.