What looked like a delivery update quickly turned into a WhatsApp hijack, Rishika Shah discovered to her horror.
I never thought I would fall for a phone scam.
I'm usually the one telling my parents to be careful about unknown numbers and suspicious links. But, on Tuesday afternoon, while I was at work and distracted, I came dangerously close to losing control of my phone, and my WhatsApp, without even realising it.
It started with a call from someone claiming to be from Blue Dart, the courier service.
The guy sounded normal, professional even. He told me they had tried delivering a parcel but I wasn't reachable and that I should call the delivery agent on the number he was sharing with me.
Since I was waiting for a delivery, I didn't find it suspicious.
However, since I was busy with work, I didn't call the number immediately. A few minutes later, the guy called me again and said, "Madam, the delivery boy is waiting there... we don't get paid for failed deliveries... please just help us and call him once." I felt bad and immediately dialled the number.
That one call was all it took.
The number -- it began with '98' so I thought it was a regular number -- was a Trojan horse. Without my knowledge, it quietly activated call forwarding from my phone to theirs. Which means: Every call made to me started going to them.
Within minutes, I began getting WhatsApp prompts saying someone was trying to log into my account. I hit 'Don't Allow' each time and quickly set up a two-step verification PIN.
A few minutes later, I got logged out of WhatsApp on both my phone and laptop.
That's when panic really set in.
My colleagues tried calling my phone and got the message that my phone was either 'busy' or 'switched off' -- which was strange because my phone was in my hand and I was sitting in front of them.
Another colleague, who tried a bit later, got the message that the call was being 'forwarded'.
The first thing I did was reach out to my dad and asked him to tell everyone not to accept any WhatsApp calls from my number or respond to any WhatsApp messages from me.
Then, I used a colleague's laptop to change my bank password.
A colleague, who also has an iPhone, went through my phone's settings and that's where we discovered my calls were being forwarded. He disabled every type of call forwarding he could find. But WhatsApp still refused to let me log back in. It kept asking for a mysterious 'passkey' linked to another device.
At that point, I genuinely thought my phone had been cloned.
We had filed a complaint through the cybercrime portal as soon as my colleagues could not get through to me but we didn't get a call back (it came five hours later, after everything was solved). So I left from work and decided to go to the cybercrime office myself.
They checked my call logs and settings and explained exactly what had happened: I'd been hit by a call forwarding-based WhatsApp hijack scam. Once I understood the trick, everything made sense.
Here's what I learnt and what everyone needs to know:
These kind of scammers don't want your calls. They are not trying to listen to your conversations. They are simply trying to get into your WhatsApp.
If they succeed, they can message your contacts pretending to be you, ask for money, steal your chats, lock you out permanently and even restore your chat backups on their device.
WhatsApp is where we talk, work, send personal photos and stay connected; now you can even make payments through it. This makes it the perfect target for fraud.
The trick they use is simple:
If calls are forwarded, they can intercept the voice call OTP that WhatsApp sends when someone tries to log in. That single call gives them everything.
Thankfully, my scammer failed.
I had rejected the login requests, added my own PIN and then, as advised by the cybercrime, dialled these special codes that disable and block all sorts of call and message forwarding:
While you can use any of these numbers, the cyberpolice asked me to dial all just to be sure.
After that, I restarted my phone and waited. Eventually, the SMS verification finally came through. I got my WhatsApp back. The relief I felt at that moment is something I'll never forget.
If there is one thing I want everyone to take away from this, it's that scams today are incredibly sophisticated. They sound legitimate, they catch you off-guard and they use real-world triggers (like parcel deliveries) to disarm you.
So here's what you should do to protect yourself:
I was lucky, I caught it in time. But not everyone else may be.
If my account had gone through to the scammer, they would have impersonated me within minutes and the damage would have been irreversible.
This experience scared me enough to write this so someone else doesn't go through the same thing.
Stay alert. These scams don't look like scams anymore. They look like normal calls. And they can happen to anyone, even the person who thinks it'll never happen to them.