Thirty Days Offline
It started with a friend asking for a favour: one code. The woman who shared it was 70, retired and living alone in India, and WhatsApp was how she reached her family abroad. Within minutes, her account was gone. Getting it back took a month. By then, she no longer trusted the technology. Here, the cybersecurity professional she called for help recalls how it changed her.
“Because of one incident, she completely lost trust in that technology and became a brand ambassador for not using it.”
“Cybercrime in India has taken off a lot, and it’s not just large enterprises. The vulnerable population gets impacted a lot. The threat actors target those who are very vulnerable, in the time of their vulnerability: late in the evenings, in the afternoons. They time it very well. They put the person under a lot of stress, ask for an immediate response, and get things done.
What happened to her follows this pattern. She is a 70-year-old woman living alone in India, retired peacefully, happy with her life. She used social media largely to keep in touch with her extended circle, including her family outside India. In India, WhatsApp is the means of communication. People don’t call people; they WhatsApp. One of its most popular uses right now is voice notes. You don’t need to learn how to type; you don’t need a language. You just press a button and speak the way you would speak.
One afternoon, she got a message from one of her friends. It said the friend had been locked out of her WhatsApp account, that she would receive an OTP, the one-time verification code WhatsApp sends by text, and that she needed to share it to unlock the account. With good intentions, because this was a friend who had reached out, she gave it. That code actually granted the attacker access to her own account.
She realised immediately, because suddenly her WhatsApp access was gone. She called the friend who had asked for the code. The friend said her account had been hijacked several days earlier, that messages were going out, and that she had no control over it. That led to a sharp discussion between the two. If you don’t let everybody know this is happening, people will trust the messages you send, and it builds up an entire chain.
These days, you have someone in the family who has done something in cybersecurity, and you reach out to them first. Just as you have a family doctor and a family lawyer, it’s necessary to have somebody in cybersecurity on your speed dial. That person happened to be me. Within 30 minutes of discovering it, she reached out. Panic, panic, panic. At first she was angry with her friend: ‘Why did you send me this message?’ I had to tell her: ‘Look here, this is the way these things work.’ At that point she didn’t know, and possibly even I didn’t know, that it would take so much time.
The first step was alerting everybody, specifically in the groups she’s in, that her account had been compromised and that they weren’t to believe any message sent on her behalf, including requests for money. Whoever was close to her was told over the phone: don’t act on any message saying ‘I’m in need of help, I’m in an urgent situation, send me money.’ If you see a message like that, call and verify. Many of the group administrators immediately took action and removed her from the groups, so the threat actor couldn’t read the messages or reach others. We used technology to make the warning go viral. You have to be faster than the attacker.
That part worked. There was no loss of money, and nobody was compromised through her account. The chain stopped there.
Getting the account back was another matter. WhatsApp in India has a grievance mechanism. Unfortunately, it doesn’t work as advertised. We made a formal complaint to the Indian Cyber Crime Coordination Centre, and they said WhatsApp typically takes 48 hours even to respond to a grievance. So we had to wait, and those hours were gruelling. We knew the account wasn’t in our control. What messages were being shared? You have absolutely no idea. For a senior citizen who used WhatsApp to exchange messages with family and friends, suddenly facing a situation like this meant unnecessary anxiety and stress.
After 48 hours, we reached out to the WhatsApp grievance mechanism. Just automated responses. Sadly, it was pretty frustrating. I didn’t expect that a company of this size and magnitude, with so many customers, would have this level of response for something this severe.
We also made a complaint at the police station, just in case a crime, such as fraud or a money transaction, were to happen in her name. At least the victim is protected: she did not do it; it was done by the people masquerading as her.
We raised it with WhatsApp’s grievance officers multiple times. There’s nothing like an escalation mechanism in place. You put in a response and you get a canned response back. There aren’t even humans to talk to; you’re given a faceless bot to work with. No timelines, no accountability, canned messages. That’s about it. And this is happening to many users every day.
It took about 30 days for the account to be restored, and that also happened suddenly. No notification. One day we just said, ‘Let us try account recovery once more,’ and it worked.
Over those days, she went through a lot of stress, a lot of anxiety, the fear of something bad happening in her name. She was out of touch with so many people who were close to her. And people kept asking: ‘How did it happen? What happened?’ She had to explain the story to everybody. She was receiving more phone calls than she would normally receive. It was too overwhelming.
What I didn’t anticipate was the after-effect. Beyond the scar of the attack, it broke the habit. A person who had a habit of communicating on WhatsApp had to switch to the phone, and the phone just works. By the time the account was recovered, she no longer felt comfortable with the messaging platform, and that feeling stuck. Today it’s plain old phone calls. WhatsApp is now like a forbidden port for her.
A person who was active online became like a ghost. You pop in and pop out. She was using technology in a very good way, an efficient way, the way it’s meant to be used. Because of one incident, she completely lost trust in that technology and became a brand ambassador for not using it. It’s more than a year now since it happened. What I’ve seen is that the cost of recovery is so expensive and so difficult. And you can pretty much say that, the way the scams now operate, it’s an epidemic-like situation.
I still feel sorry. She was a good user of tech. Now she’s switched off, and nothing is going to convince her, at this stage of her life, to go back. One thing went wrong horribly, and this is the impact it has.”
Arjun*, India
*Name has been changed to protect the identities of those involved.
