The WhatsApp screen-sharing scam that could drain your bank account
Which? is warning of a nasty screen-sharing scam where fraudsters pose as banks and the Financial Conduct Authority (FCA) to hack into accounts and steal sensitive information.
This type of scam, also known as screen-mirroring fraud, typically begins with an out-of-the-blue phone call from fraudsters claiming that your account is at risk. They may try to move the conversation to a video call on FaceTime or WhatsApp, where you can share your screen in a few clicks.
If screen-sharing is enabled, scammers can see almost everything displayed on your phone, including notifications of one-time passwords (OTPs) sent by banks to authorise payments. They could even convince you to relinquish control of your device entirely, claiming that they need to use remote-access tools such as AnyDesk, TeamViewer or Zoho Assist to ‘fix’ an issue or ‘secure’ your account.
WhatsApp screen-sharing scams
WhatsApp launched its screen-sharing feature in 2023 so that users can share documents and photos on video calls, as they do on video-conferencing apps such as Google Meet and Zoom. But this feature has also turned the heads of scammers.
Which? has received a steady stream of reports of WhatsApp screen-sharing scams this year. A common approach is for a scam caller to tell you suspicious activity has been detected, hoping to create panic before offering reassurance that they can help. They may even pass you between ‘departments’ to seem more authoritative.
Two men claiming to be FCA inspectors contacted William directly on WhatsApp. They warned him that his phone had been infected with viruses and instructed him to share his screen. The scammers kept him on the phone for 20 hours spread over three days, during which time they stole more than £27,000, including six iPhone and iPad purchases.
‘The screen on my phone said FCA, and they told me to press a button to start recording. These men were very professional and said they were in contact with the police and that they thought someone, a bank employee, was spreading this virus. They told me to speak to no one – not family or friends.'
‘I was on the phone for eight hours on the Friday, eight hours on the Saturday and four hours on the Sunday, at which time my brother and sister-in-law arrived and told me it was a scam. By this time they had been through all my credit cards, Apple Pay, eBay and Argos. I still feel drained and confused.’
- Find out more: Santander launches screen-sharing blur feature.
5 screen-sharing tactics
We looked through scam reports in our scam sharer tool to identify some common screen-sharing scam strategies to watch out for:
- Fake security alerts Scammers may claim that your accounts have been hacked, your phone has a virus, or your card has been used for high-value purchases. They want to frighten you into acting without having time to think clearly.
- Spoofed logos and numbers To build credibility, they may use the Caller IDs and logos of trusted organisations and official bodies, such as the FCA, Financial Services Compensation Scheme (FSCS), banks and building societies.
- Pressure, urgency and secrecy Being told to act immediately is a major warning sign. So is being kept on the phone for extended hours, or being told not to talk to family, friends, or your bank staff because of alleged ‘insider fraud’. Another strategy is to transfer you to a manager, the police or an FCA official to appear more authoritative.
- Any screen-sharing tool will do This isn’t exclusively a WhatsApp problem. Scammers will exploit any tool at their disposal, including built-in functions for Windows and Apple users so it could be through your phone, tablet, laptop or computer.
- Tricks to cash out Once they can see your screen, scammers may try to intercept one-time passcodes sent by your bank. Or, they could guide you through transfers and purchases, perhaps even sending you a payment link (such as PayPal, Stripe or SumUp). For example, you might be told to move money from your savings to your current account or make ‘dummy transactions’ to create an ‘official audit trail’.
What is Meta doing?
Meta has introduced warnings when users attempt to share their screen with an unknown contact during a WhatsApp video call.
If a user who isn’t saved in your contacts tries to get in touch, Meta will ask if you want to block or report them. It also shows context cards, which tell you that this is a new contact, whether you have groups in common, and the country the person is messaging from. Even if you message back, this context will stay around at the top of the chat to keep you informed.
All images sent by unknown contacts are blurred by default, and you can choose to silence all calls from unknown numbers. You can also block or report a contact to WhatsApp at any time.
Because scammers often try to pressure people into sending money or clicking on malicious links, links from unknown senders are disabled until you choose to engage with them.
How to stop screen-sharing scams
- Beware of unexpected phone calls Always be suspicious if you’re called out of the blue by your bank or another firm. Call the organisation back on a trusted number (you can call 159 to be put through to major current account fraud departments) to confirm what you’ve been told.
- Stop scammers in their tracks If a fraudster gets to the stage of convincing you to share your screen, or install remote access software, it’s not too late to stop them. End the call and disconnect all networks (toggle on Airplane Mode on a mobile, turn off your Wi-Fi router or unplug the network cable).
- Secure accounts (from a clean device) Using a different device, reset your passwords for online banking, email and shopping accounts. Where possible, enable two-factor authentication (2FA), as this makes a fraudster’s job far more difficult.
- Call your bank Tell your financial providers what happened so that your accounts can be secured. You can also file a report, either online at reportfraud.police.uk or by calling Report Fraud on 0300 123 2040.
- Remove any suspect software When you switch your compromised device back on, remove any tools or software you were asked to install (under Settings > Apps in Windows) and check for any other recently installed programs or downloads, which could have been added by the scammer.
- Update security software If you have security software, ensure it’s been updated, then run a full security scan. To be extra safe, consider a factory reset or ask an IT expert to confirm it’s safe to reuse.
