A chartered accountant in Lucknow allegedly lost Rs 1.70 lakh from his ICICI Bank and IndusInd Bank accounts after responding to a WhatsApp message that falsely claimed Rs 90,000 had been debited from his account. The incident has prompted a probe into a suspected new form of social-engineering fraud, according to a TOI report.
The case is unusual because the victim reportedly did not click on a suspicious link, share an OTP, reveal his banking credentials or install a remote-access application before the money was allegedly withdrawn.
WhatsApp fraud alert: CA receives fake Rs 90,000 debit message
According to police, the victim received a WhatsApp message stating that Rs 90,000 had been withdrawn from his bank account.
A second message reportedly asked him to reply “No” if he had not authorised the transaction. Believing the alert to be genuine, the chartered accountant responded.
Soon after, unauthorised transactions were allegedly carried out from his ICICI Bank and IndusInd Bank accounts. The total loss was reported to be Rs 1.70 lakh.
No OTP, link or remote-access app used in reported fraud
The incident has drawn attention because it does not follow some of the more familiar patterns associated with online banking scams.
The victim reportedly did not click on a suspicious link, provide an OTP, disclose banking credentials or download a remote-access application before the transactions took place, TOI reported.
This has led investigators to examine whether the WhatsApp communication itself played a role in the alleged fraud.
Police probe how Rs 1.70 lakh was siphoned off
Additional DCP (Crime) Kiran Yadav said the case had been reported and was being examined to determine how the fraud was carried out.
Investigators are looking at the sequence of events, the WhatsApp communication received by the victim and the transactions that followed his response.
The incident is being examined as a possible social-engineering tactic in which fraudsters first create panic by telling a customer that money has been debited and then prompt the person to interact with the message.
Did replying ‘No’ trigger a hidden malicious component?
The reported sequence has led to speculation that the message could have contained some form of malicious component that was activated when the victim interacted with it.
However, the exact technical mechanism has not been established. Cybersecurity experts have cautioned against concluding that replying to a WhatsApp message by itself gives an outside sender complete control of a smartphone.
A detailed forensic examination of the victim’s device, WhatsApp activity and banking records would be needed to determine how the unauthorised transactions occurred.
Why this WhatsApp scam tactic is raising concern
The reported case highlights how scammers can use fear and urgency to make people react before checking whether a message is genuine.
Instead of directly asking for an OTP or banking password, the alleged fraud began with a fake debit alert followed by a simple request to respond. Police and cybersecurity experts have therefore stressed the importance of independently verifying any unexpected transaction alert.
What to do if you receive a fake bank debit alert on WhatsApp
People who receive an unexpected message claiming that money has been debited from their account should avoid responding immediately.
Instead, they should:
- Check their account only through the bank's official app or website.
- Avoid calling phone numbers or using contact details provided in an unsolicited message.
- Never share an OTP, PIN, password or banking credentials.
- Do not install an unknown application or give remote access to a device.
- Contact the bank through its official customer-care channel if a transaction appears suspicious.
- Report suspected cyber fraud immediately through the national cybercrime helpline 1930.
Police have also advised people not to respond to unsolicited WhatsApp messages claiming that money has been debited from their accounts.
The Lucknow case remains under investigation, and the precise method through which the alleged fraud was carried out is yet to be established.
Inputs from TOI
