Rajasthan Police has warned that cybercriminals are using fake QR codes, malicious links and social engineering techniques to gain unauthorised access to WhatsApp accounts and mobile phones. The advisory urges people to remain cautious while scanning QR codes or responding to unfamiliar messages.
How Are Hackers Using Fake QR Codes?
Cybercriminals are increasingly using fraudulent QR codes to trick people into connecting their WhatsApp accounts to unknown devices. These codes may be shared through messages, websites or other unfamiliar sources, making them appear to be part of a normal verification or account-related process.
When a person scans such a code and follows the instructions, they may unknowingly authorise access to their account. Criminals can then use the linked device to access the compromised WhatsApp account without the account holder immediately realising what has happened.
However, scanning a QR code does not automatically mean that a phone has been hacked. The danger arises when the code directs users to malicious content, tricks them into linking an account or persuades them to grant access permissions.
The advisory also warns about malicious links and applications that may be used to obtain unauthorised access to messages, notifications and other information on a device.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Can Hackers Take Control of Your Phone?
The police have warned that cybercriminals may persuade victims to install remote-access or screen-sharing applications. Once users grant the requested permissions, criminals may gain control over parts of the device or observe sensitive activity.
Some malicious applications may also request access to SMS messages, notifications or accessibility services. These permissions can expose sensitive information and create opportunities for further account misuse.
The threat is therefore not limited to WhatsApp. Depending on the permissions granted, a compromised device may expose additional personal information and communications.
What Happens After WhatsApp Is Hacked?
Once criminals gain access to a WhatsApp account, they may contact people saved in the victim’s contact list and impersonate the account holder.
The advisory states that fraudsters frequently request money by claiming there is a medical emergency or another urgent situation. Because the message appears to come from a familiar contact, recipients may believe the request is genuine.
Criminals may also circulate suspicious links to other users, allowing the fraud attempt to spread beyond the original victim.
How Can You Avoid Fake QR Code Scams?
People should avoid scanning QR codes received from unknown individuals, suspicious websites or unsolicited messages. Any QR code requesting account verification, device linking or additional permissions should be treated cautiously.
Users should never approve an unfamiliar WhatsApp device-linking request. They should also avoid opening suspicious links or installing applications sent by strangers.
Two-step verification should be enabled on WhatsApp, along with a strong PIN. Registration codes, OTPs and two-step verification PINs must never be shared with anyone, even if the request appears to come from customer support.
The police have also advised against granting unnecessary SMS, notification or accessibility permissions to unfamiliar applications.
What Are the Signs of Account Hacking?
Unusual account activity, unfamiliar linked devices and messages sent without the user’s knowledge may indicate unauthorised access.
Users should regularly review their WhatsApp linked devices and remove any sessions they do not recognise. They should also remain cautious if contacts report receiving unexpected messages or requests for money from their account.
Any suspicious activity should be investigated promptly to prevent further misuse.
The420 Insight: Where Should Victims Report Cyber Fraud?
Rajasthan Police has urged victims to report suspected cybercrime immediately to their nearest police station or cyber police station. Complaints can also be submitted through the National Cyber Crime Reporting Portal at cybercrime.gov.in.
Anyone who has suffered financial fraud should call the national cybercrime helpline 1930 without delay. Early reporting can help authorities respond to fraudulent transactions, while careful QR code scanning, secure account settings and regular device checks can reduce the risk of account compromise.
About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
