ISLAMABAD — As digital banking and mobile wallet adoption reach record highs across the country, national cybersecurity agencies have urged citizens to upgrade their WhatsApp scam protection settings following a wave of call-forwarding hijacks and AI voice-impersonation frauds.

In the most common attack vector reported in Karachi, Lahore and Rawalpindi, scammers pose as courier delivery riders, BISP officials or bank verification officers and trick victims into dialing a USSD code beginning with *21*, *61* or *67* followed by a phone number. That code silently forwards all incoming phone calls—including WhatsApp's automated "Call Me" verification OTP—directly to the attacker's device. Once inside, criminals message the victim's family contacts asking for urgent JazzCash, Easypaisa or Raast transfers.

Security researchers speaking with our Cybersecurity and Pakistan desks emphasize that configuring three built-in security settings takes less than two minutes and blocks 99 percent of account takeovers.

Advertisement

The 5-Minute Checklist for Bulletproof Account Security

To establish complete WhatsApp scam protection on Android and iPhone devices, open Settings → Account and enable the following layers documented on WhatsApp's official security centre:

  • 1. Turn On Two-Step Verification (6-Digit PIN): Set a secret 6-digit registration PIN and link a recovery email address. Even if an attacker steals your SIM card or tricks you into sharing an SMS code, they cannot register your number without this PIN.
  • 2. Activate Biometric Passkeys: Under Account → Passkeys, register your device fingerprint or Face ID so future re-logins use cryptographic hardware keys stored in your phone's secure enclave.
  • 3. Check & Cancel Call Forwarding (Dial ##002#): Dial *#21# to check if your calls are being secretly forwarded. Dialing ##002# immediately erases all active call forwarding rules on Jazz, Zong, Ufone and Telenor SIMs.
  • 4. Audit "Linked Devices" Weekly: Check Settings → Linked Devices and log out any unfamiliar Windows, Mac or web browser sessions.
  • 5. Silence Unknown Callers & Lock SIM Card: Enable Privacy → Calls → Silence Unknown Callers to block overseas scam VoIP calls and zero-click exploit attempts.

"Strong WhatsApp scam protection is no longer just about protecting chat messages—because scammers immediately impersonate you to defraud your family and business partners on Raast and mobile wallets."

Omar Farooq, Principal Cybersecurity Researcher

What to Do If Your Account Is Hijacked

If you lose access to your WhatsApp account, immediately reinstall WhatsApp, enter your phone number to request a fresh SMS code, and enter your 6-digit PIN—this instantly kicks the attacker out. If the attacker enabled their own PIN, wait 7 days or use your verified recovery email to reset it, and notify contacts via SMS or phone calls immediately. Read more digital safety guides in our Mobile section.

Reporting by the WritePures Cybersecurity & Consumer Safety Desk.