How crooks take over chat accounts

Cartoon

Dana’s classmate Emily sends her a message. She asks Dana to vote for her sister.

Dana: My phone number and a code… Oh well, it’s for Emily.

It was no contest. Dana typed in the code for signing in to her own chats — and the crook got into her account. Emily’s account was taken over the very same way a little earlier.

Half an hour later, "Dana" writes to Kate, asking for a loan. The crook sent this to everyone in Dana’s chats.

Kate: Just like with Max — I’ll call first. A real phone call.

Dana: Kate, I didn’t write anything! Oh no… It’s because of that vote. Dad, what do I do?

Greg: First we kick the stranger out of your account, then we put on a second lock. And we warn everyone not to send money.

Sign in to your chats only inside the app itself. If a website asks for your number and a code, it’s an attempt to take your account.

Exercise: stolen account or not?

Dana and Kate got six messages. For each one, decide: is it dangerous or not?

• Emily, classmate: «Vote for my sister! You just need to sign in with your chat app, it’s quick!» (vote-for-us.top) — Dangerous. A vote that makes you sign in with your number and a code is a well-known way to take over accounts.
• Telechat app: «You’ve been gifted 3 months of Premium! Claim your gift at this link.» (telechat-gift.top) — Dangerous. Gifts behind links are bait. Real notices come inside the app itself.
• Dana (neighbor): «Kate, could you lend me $120 till tomorrow? Here’s the card.» — Dangerous. A familiar account may have been taken over. Call before you send anything.
• Telechat: «Signed-in devices: this phone. No other devices.» — Safe. This is a check inside the app itself. Looking there now and then is a good habit.
• Emily, classmate: «Oops, I sent you my code by accident, could you forward it to me, please?» — Dangerous. The code came for signing in to your account. Forward it, and you lose your chats.
• A call from Dana: «Kate, if I write to you about money, it’s not me — someone took over my account.» — Safe. A real phone call from a number you know is exactly what you need. You can trust it.

What to remember

• Accounts get taken over through "votes", "gifts" and "photos" behind links that ask for your number and a code.
• Type your phone number and a text code only inside the app itself, never on a website from a link.
• A familiar account asks for money? Call the person.
• If your account was taken over: sign out of all other devices, turn on the second lock, warn your friends.

Questions

A friend asks you to vote, and the website wants your phone number and the code from a text. What do you do?

• Type them in, it’s my friend
• Don’t type them: that’s how accounts get taken over. Call your friend
• Type in only the number

Most likely your friend’s account was already taken, and now they’re after yours.

Someone you know asks in a chat to borrow money and send it to someone else’s card. What do you do?

• Send it, since it’s someone I know
• Call them and ask
• Ask for a photo of their ID

The account may have been taken over. A phone call clears it up.

What do you do first if your account was taken over?

• Delete the app
• Sign out of all other devices in the settings and turn on the second lock
• Nothing, it will sort itself out

That way you kick the stranger out and don’t let him back in.

Where is it safe to type the sign-in code for a chat app?

• Only inside the chat app itself
• On any website that asks for it
• In a chat with friends

Any website that asks for this code wants to take your account.