WhatsApp customer care scam asking for screen share – what to do?

This insidious scam begins with what appears to be a legitimate interaction, often initiated by the victim themselves. When an individual searches for customer support for an e-commerce platform, bank, or even a utility service, fraudsters are increasingly setting up fake helplines or contact points that appear high in search results. Alternatively, they might proactively reach out via WhatsApp, SMS, or even a phone call, posing as customer service representatives from a well-known company – be it your bank, an e-commerce giant like Flipkart or Amazon, or even a government body. Once they establish contact, they employ a series of social engineering tactics to build trust and urgency. They might claim there's an issue with your order, a pending refund, a blocked account, a recent suspicious transaction, or even a problem with your KYC (Know Your Customer) verification. The "solution" they offer invariably involves either downloading a specific mobile application (APK) or sharing your screen. If they push for an APK download, it’s rarely from a legitimate app store. Instead, they'll send you a link to a third-party website or directly through WhatsApp. This malicious APK, once installed, grants them unauthorized access to your device. It could be sophisticated malware designed to capture your login credentials, intercept OTPs (One Time Passwords), or even remotely control your phone. The screen-sharing variant is equally dangerous. They instruct you to download a seemingly innocuous screen-sharing application – often a remote access tool readily available on app stores, or even a custom-built one. Under the guise of "assisting" you through a complex process (like a refund, resolving an account issue, or even filing a complaint), they ask you to grant them access to view your screen. While viewing your screen, they'll guide you to specific banking apps or UPI payment interfaces. Often, they’ll ask you to pretend to enter a small amount for a "test transaction" or "refund initiation." What victims don't realise is that while their attention is focused on one part of the screen, the fraudster, with remote control or simply by seeing your inputs, swiftly navigates to make large transactions, obtains your UPI PIN, or captures bank login details. In some cases, they might even instruct you to momentarily close your eyes or look away, using that precious second to execute a fraudulent transaction. The moment funds are debited, they often disconnect, leaving the victim in shock. The sophistication lies in their ability to mimic legitimate customer service and manipulate victims into unknowingly compromising their own security.

• Insistence on Third-Party Apps/Links:** Any customer service representative asking you to download an app from outside the official Google Play Store or Apple App Store, or sending you a direct APK link via WhatsApp/SMS, is a massive red flag. Legitimate companies will never do this.
• Request for Screen Sharing or Remote Access:** Be extremely wary if someone claiming to be customer service asks you to install a screen-sharing application (like AnyDesk, TeamViewer, QuickSupport, or even lesser-known ones) and requests access to your device. Legitimate customer support rarely needs this level of access, especially for routine issues.
• Urgent Tone and Pressure Tactics:** Fraudsters often create a sense of urgency, claiming your account will be blocked, money will be lost, or a deadline is approaching if you don't act immediately. This is a tactic to bypass your critical thinking.
• Asking for Sensitive Information:** While they might initially just ask for superficial details, watch out if they start requesting your full bank account number, UPI PIN, ATM PIN, CVV, or the full OTP verbally. A legitimate representative will only ask for specific, non-sensitive details for verification.
• Unusual Contact Methods:** If a company you usually communicate with via email or their official app suddenly contacts you via an unknown WhatsApp number or an unverified phone number, be suspicious. Always cross-verify the contact method.
• Grammatical Errors or Unprofessional Language:** While not always present, watch for poor grammar, spelling mistakes, or unprofessional phrasing in written communications. This can indicate a scammer.

• Always Use Official Channels:** When you need customer support, always go to the company's official website or app to find their legitimate contact numbers, email addresses, or official chat support. Never rely on numbers found through generic search engine results without cross-verification.
• Never Download Unverified Apps (APKs):** Only download applications from trusted sources like the Google Play Store or Apple App Store. Be extremely suspicious of any link sent via WhatsApp or SMS that asks you to install an app directly.
• Refuse Screen Sharing Requests:** Absolutely *never* share your screen or grant remote access to your device to anyone claiming to be customer service. Your banking apps, UPI PINs, and personal data can be exposed in seconds.
• Verify Identity Independently:** If someone calls or messages you claiming to be from a bank or company, politely disconnect and call their official customer service number (found on their website/app) to verify if the contact was legitimate.
• Protect Your OTPs and PINs:** Treat your One Time Passwords (OTPs), UPI PINs, ATM PINs, and internet banking passwords as sacred. No legitimate bank or service provider will ever ask you to share these verbally or through any non-secure channel.
• Enable Two-Factor Authentication (2FA):** Activate 2FA on all your critical accounts (banking, email, social media, payment apps). This adds an extra layer of security, making it harder for fraudsters to gain access even if they have your password.

• Disconnect Immediately:** If you suspect you've been targeted or are currently on a call with a scammer, hang up the phone or block the WhatsApp number immediately. Do not engage further.
• Stop Any Transaction:** If you were in the middle of a transaction or shared your screen, close all banking apps and disconnect your internet immediately to prevent further debits.
• Change Passwords:** Immediately change passwords for your internet banking, UPI apps, and any other critical accounts that might have been compromised (even if you're not sure). Use strong, unique passwords.
• Inform Your Bank and Police:** Contact your bank's fraud department immediately to report the unauthorized transactions and block your cards/accounts if necessary. File a formal complaint with the cybercrime police at www.cybercrime.gov.in or call their helpline 1930.
• Delete Malicious Apps:** If you installed an APK from a suspicious link, immediately uninstall it from your phone. Consider a factory reset if you are deeply concerned about malware.
• Document Everything:** Keep records of all communications (screenshots of WhatsApp chats, phone numbers, transaction details, etc.) as this will be crucial for your complaint.