The Civil Guard in La Rioja has focused on a new type of cyber scam targeting iPhone users via WhatsApp. In recent weeks, the Cybercrime Unit (EDITE) and the Equipo@ unit have confirmed at least four cases in the municipalities of Calahorra, Haro, and Logroño, with one victim losing €2.000. The most striking aspect of this fraud is that it doesn't require the user to click on a link or provide any code, making it particularly difficult to detect.
This type of attack, known as a 'zero-click' attack, exploits vulnerabilities in the operating system to infiltrate a messaging account without leaving a trace. In fact, victims don't see any unusual activity in the 'Linked Devices' section, which further complicates detection. Once inside, cybercriminals impersonate the victim and contact their family and friends to request money transfers, using real conversations to lend credibility to the deception.
This is how scammers operate
The fraud is simple but highly effective. After compromising the account, the attacker reviews recent chats and chooses a contact the victim trusts. They then send an urgent message requesting a transfer, sometimes providing an account number that may belong to a foreign bank. Because the message comes from the victim's usual number and is within the legitimate conversation thread, the recipient doesn't suspect anything and ends up making the payment.
Researchers have discovered that this method differs from other traditional scams like 'GhostPairing,' where the victim is tricked into linking a device. In this case, the attacker maintains an active session without appearing in the list of linked devices, suggesting they exploit security vulnerabilities in older versions of iOS. Therefore, authorities emphasize the importance of keeping the operating system up to date and reviewing iPhone settings for WhatsApp.
The Civil Guard recommends installing at least iOS 18.7.8, as earlier versions have vulnerabilities related to these incidents. They also advise enabling two-step verification on WhatsApp and regularly checking the 'Linked Devices' section to close any unrecognized sessions. It is also crucial to be wary of any money requests received solely via messaging, even if they appear to be from a known contact.
Other types of fraud on WhatsApp
This new alert adds to other scams circulating on WhatsApp that have also been the subject of warnings from law enforcement. One of the most common is the theft of verification codes, where the criminal impersonates a friend or family member to trick the victim into sending them the six-digit code they receive via SMS. With this code, the scammer can register the account on another device and remove the account holder, making it essential to know how to recover your WhatsApp account.
Another widespread scam involves fake banks or courier companies, which use legitimate logos and professional messages to request bank details or one-time codes. There's also the fake family emergency scam, which usually occurs after an account has been compromised, and the too-good-to-be-true job offer scam, which promises high earnings in exchange for performing simple tasks from home.
In all cases, experts agree that prevention is the best defense. Never share verification codes, verify a person's identity through another method before making any payment, and keep your device updated are basic measures that can prevent many unpleasant surprises. The National Police also reminds the public that if you fall victim to a scam, the first step is to warn all your contacts to break the chain of deception and then go to the police station to file a report.
WhatsApp security updates
To combat these types of threats, WhatsApp has announced a series of new security features. The Meta-owned platform will strengthen its two-step verification system, allowing users to use more complex passwords instead of the classic six-digit PIN. This measure makes it harder for attackers to guess the password, even if they manage to intercept the temporary code sent via SMS.
In addition, WhatsApp will allow users to save multiple passkeys or access keys to the same account, which is especially useful for those using Android and iOS devices. This way, access can be granted via fingerprint, facial recognition, or the phone's unlock system, without relying on traditional passwords that can be stolen. More information will also be displayed about calls from unknown numbers, such as the country of origin or whether there are mutual groups.
These improvements complement other recent measures and aim to protect users against impersonation attempts. However, experts remind us that security also depends on user behavior. Being wary of urgent messages, not sharing personal information via chat, and keeping software updated are habits that make a difference. Technology helps, but caution remains the best defense.
In short, the new scam detected in La Rioja highlights the evolution of cybercriminals, who are increasingly using more sophisticated and difficult-to-detect methods. The combination of operating system vulnerabilities and social engineering means that any user can become a victim without even realizing it. For this reason, authorities emphasize the importance of following security recommendations and always being vigilant against any suspicious requests.
