Hyderabad Police Commissioner V.C. Sajjanar has warned citizens against responding to suspicious WhatsApp messages claiming that money has been debited from their bank accounts, saying fraudsters are using panic around unauthorised transactions to target users.
Sajjanar advised people not to reply “YES” or “NO” to banking messages received from unknown numbers. Instead, users should independently check their account through their bank’s official application or verified customer-care channels.
The warning is genuine. However, a more dramatic claim circulating with the advisory — that merely replying “NO” can automatically install malware and empty a bank account — has not been independently demonstrated through technical evidence.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Fake Debit Alert Is Designed to Trigger Panic
According to the sequence described by Sajjanar, a victim first receives a WhatsApp message claiming that money has been debited from a bank account.
A follow-up message may then tell the recipient to reply “NO” immediately if they did not authorise the transaction.
That instruction creates urgency.
Someone who believes thousands of rupees have suddenly disappeared may respond before checking whether the transaction actually occurred.
Sajjanar said he had come across a case involving a chartered accountant and described the alleged technique as an “auto-execution file attack”. He warned that criminals could target users without first asking them for an OTP or directing them to an obvious phishing link.
Police have advised users to block suspicious senders and verify any claimed debit directly through their banking application.
They also cautioned people against calling numbers contained in such messages because those numbers may connect victims directly to the fraudsters.
Can Replying ‘NO’ Really Execute Malware?
This is where the warning requires technical caution.
Modern messaging platforms can suffer from so-called zero-click vulnerabilities. These are rare but serious software flaws that can allow highly sophisticated attackers to compromise a device without requiring the victim to open a link or even interact with a malicious message.
Such attacks have previously been documented against platforms including WhatsApp.
But they work by exploiting a specific vulnerability in the application or operating system. They do not normally depend on whether the victim types a particular word such as “NO”.
No public technical analysis currently establishes that sending the letters “N” and “O” to an ordinary WhatsApp account automatically executes a malicious file or grants access to banking applications.
That does not mean the wider fraud warning should be ignored.
Responding to an unknown sender confirms that the phone number is active and may encourage further social-engineering attempts. Criminals can then send malicious attachments, fake banking links, APK files or make follow-up calls designed to obtain credentials.
The safest interpretation is therefore simple: do not engage with suspicious banking messages, but do not assume that typing “NO” alone has been proved to drain an account.
Police Advise Users to Verify Through Their Bank
Sajjanar urged users who receive suspicious debit messages to remain calm and check their account through official channels.
A genuine debit should normally appear in the bank’s official mobile application, internet banking service or transaction history.
Customers should use phone numbers printed on their bank card, passbook or official website when contacting the bank.
Passwords, UPI PINs, OTPs and internet banking credentials should never be shared in response to unsolicited calls or messages.
Unexpected APK files and attachments should also be avoided. Android installation files can contain malicious software if they come from an untrusted source.
The wider scam follows a familiar cybercrime pattern: create fear first, then push the victim towards an unsafe action before there is time to verify what happened.
Fraudsters routinely use fake account freezes, unauthorised debit alerts, police threats and KYC warnings for the same reason.
The trigger changes, but the pressure tactic remains similar.
Immediate Reporting Can Improve Recovery Chances
Police have again advised victims of financial cyber fraud to contact the national cybercrime helpline at 1930 without delay.
Fast reporting can matter because banks and cybercrime authorities may be able to flag or freeze beneficiary accounts before stolen funds are transferred through multiple layers.
Victims should preserve screenshots, phone numbers, chat records and bank transaction details.
Deleting evidence immediately can make later investigation more difficult.
The advisory is therefore useful, even though the technical explanation attached to it remains unclear.
Users should treat unexpected WhatsApp banking messages as suspicious, independently verify transactions and avoid allowing urgency to dictate their next step.
What this means for you:
If WhatsApp says money has been debited, do not reply or follow instructions in the message. Open your bank’s official app yourself, verify the transaction and call 1930 immediately if money has actually been taken.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
