Rajasthan Police's R-4-C (Rajasthan Cyber Crime) wing has issued a cybersecurity advisory on 21 October 2026, warning citizens about a surge in WhatsApp account hijacking scams that use fake QR codes, social engineering, and OTP theft to compromise personal accounts. The advisory comes as cybercriminals grow bolder in targeting ordinary users across the state.

How Cybercriminals Take Over WhatsApp Accounts

According to Additional Director General of Police (ADGP), Cyber Crime, V.K. Singh, attackers employ multiple techniques to seize control of victims' WhatsApp accounts. These include tricking users into scanning fraudulent QR codes or clicking malicious links that silently link the account to an unknown device. Criminals also impersonate friends, government officials, or customer support agents to extract OTPs, verification codes, or two-step verification PINs.

In more sophisticated attacks, fraudsters exploit third-party applications to gain unauthorised access to SMS messages, notifications, or device accessibility permissions. Some victims are also deceived into installing remote-access or screen-sharing software, effectively handing complete device control to the attacker.

What Happens After an Account Is Compromised

Once a WhatsApp account is taken over, the attackers immediately weaponise the victim's contact list. They send messages to friends and family, typically fabricating urgent scenarios such as medical emergencies or financial crises to solicit money. Compromised accounts are also used to circulate suspicious links, potentially spreading the scam further within a victim's social network. This exploitation of trust is what makes these attacks particularly damaging.

Warning Signs Citizens Should Watch For

Police officials have urged users to stay alert to indicators of a possible account compromise — including unexpected logouts, unrecognised linked devices, or messages reportedly sent without the account holder's knowledge. Receiving unsolicited QR codes through messaging platforms or email is itself a red flag, the advisory notes.

Precautions Advised by Rajasthan Police

The R-4-C wing has outlined the following protective steps for citizens:

Users should never scan QR codes received from unknown individuals, unsolicited messages, or unverified websites. Enabling two-step verification with a strong, unique PIN is strongly recommended. Under no circumstances should an OTP, registration code, or two-step verification PIN be shared with any person — regardless of who they claim to be.

How to Report Cyber Fraud

Rajasthan Police has urged anyone who suspects their account has been compromised — or who has received a fraudulent approach — to report it immediately to the nearest police station or cyber police station. Complaints can also be filed online at cybercrime.gov.in, the National Cyber Crime Reporting Portal. Victims of financial cyber fraud are advised to call the national cybercrime helpline at 1930 without delay, as prompt reporting can help limit financial losses.

The advisory reflects a broader national trend of rising WhatsApp-based scams. With over 500 million WhatsApp users in India, law enforcement agencies across multiple states have flagged similar threats in recent months, underlining the need for digital literacy at the grassroots level.