JAFFNA, Sri Lanka: Fraudsters in Jaffna are taking over WhatsApp accounts by posing as organizers of an old boys' association meeting at Jaffna Hindu College and asking people to send back a six-digit code to confirm they will attend.
The code is a one-time password that WhatsApp sends when someone tries to register a phone number on a new device. Anyone who passes it on gives the sender control of the account.
Two people in Jaffna had their accounts hijacked this way on Tuesday, according to information received by Jaffna Monitor. The scammers appear to be using the association's name because its members regularly receive messages about meetings.
WhatsApp accounts are linked to phone numbers and have no ordinary password. When a user installs the app on a new phone, WhatsApp sends a six-digit code to that number by text message or automated voice call. Whoever enters the code gets the account.
In this scheme, the attacker enters the target's phone number in WhatsApp on the attacker's own phone. WhatsApp sends a real verification code to the target. Meanwhile the attacker messages the target, says a confirmation code for the meeting is on its way, and asks for it to be sent back. Once the target replies with the code, the attacker enters it. The account moves to the attacker's phone and the owner is logged out.
Some attackers choose the voice-call option instead. They then get the target to read out the code or to merge the automated WhatsApp call into a call with them.
After taking an account, attackers often turn on WhatsApp's two-step verification and set their own PIN. According to WhatsApp's guidance, the owner can still log the attacker out by reinstalling the app and entering a new code sent by text message. WhatsApp will then ask for the attacker's PIN, and an owner who does not have it has to wait seven days before getting back in.
A hijacked account gives the attacker the owner's contact list and access to every group the owner belongs to. Sri Lankan officials have said attackers search a victim's contacts and groups for new targets. The attacker usually cannot see older chats, which stay on the owner's phone and in backups linked to the owner's Google or Apple account.
Alumni groups are useful to scammers for this reason. A message from a former classmate's real number, sent in a group of old students, is more likely to be trusted than one from a stranger, and every account taken over can be used to send the same request to more people.
The Sri Lanka Computer Emergency Readiness Team, or SLCERT, the government agency that handles cybersecurity incidents, has said hijackers use stolen accounts to pose as the owners and ask their contacts for money. In some cases they have demanded payment to return the account.
SLCERT has warned about these attacks several times. In late 2024 it recorded 74 WhatsApp hijackings in a few weeks, and the victims included politicians, lawyers and journalists. In July 2025 the Sri Lanka Police Media Division issued a warning after more people complained of unauthorized access to their WhatsApp accounts and related financial fraud. In August this year SLCERT warned about a different attack aimed at iPhones running old versions of iOS. That attack can take over a WhatsApp account without the user doing anything. The scheme reported in Jaffna needs the victim to hand over the code.
What users can do
Do not share a WhatsApp verification code with anyone, including people who appear to be friends, relatives or event organizers.
If someone you know asks for a code, call that person on a normal phone line and check before you reply.
Turn on two-step verification under Settings, Account, Two-step verification, and add an email address so you can reset the PIN.
Keep your phone's software and the WhatsApp app updated.
If an account has already been taken, reinstall WhatsApp and register the number again with the code sent by text message. This logs the attacker out. Tell your contacts and groups through another channel that messages from your account may be fake. Report the case to Sri Lanka CERT on its 101 hotline, which is open from 9 a.m. to 8 p.m., or by email at report@cert.gov.lk, and also report it to the police.
