Description
What is phishing?
Phishing is a social-engineering attack in which a criminal impersonates a trusted organisation or person (a bank, a courier, a retailer, Meta itself) to trick someone into revealing passwords or one-time codes, paying money or installing malware. Phishing over SMS is often called smishing, and over voice calls vishing. On WhatsApp it usually arrives from a lookalike account with a copied logo and a Display Name close to the real brand's, carrying an urgent story: a parcel on hold, an account about to be blocked, a refund waiting, a prize to claim.
Businesses face two kinds. Customer-facing phishing abuses your brand: scammers message your customers asking them to "verify" by sharing an OTP, to pay a redelivery fee through a link, or to install a screen-sharing app. Admin-targeted phishing goes after your own team: fake "Meta support" or "policy violation" messages and emails push WABA admins to a lookalike login page or ask for codes, aiming at Account Takeover (ATO) of the business portfolio, and with it the WhatsApp number, its templates and its customer conversations.
Phishing attacks people, whereas a replay attack exploits systems by resending captured requests, so the defences are partly human and partly technical. The blue Official Business Account (OBA) badge (formerly the green tick), which a Verified Business can apply for, and a consistent official number help customers tell you apart from impostors; messages that link only to your own domains and never ask for codes leave scammers nothing to imitate; and phishing-resistant sign-in with a Passkey, plus Two-Factor Authentication on every admin account, makes a stolen password far less useful.
Key takeaways
- Phishing is social engineering: a fake message or account impersonates someone trusted to make a person hand over codes, money or logins.
- On WhatsApp it appears as lookalike brand accounts, fake delivery or KYC alerts, and fake Meta-support messages aimed at WABA admins.
- Tell customers what you never ask for (OTPs, card numbers, UPI PINs, remote-access apps) and repeat it in your messages.
- Verified branding, a few published official numbers and links only to your own domain make impersonation easier to spot.
- In India, report fraud to the 1930 cybercrime helpline or cybercrime.gov.in, and suspected fraud messages through Chakshu on Sanchar Saathi.
Mechanics
How does phishing work?
step 1 — The attacker borrows a trusted identity
They copy a brand's logo, name and tone, set up a new number or a lookalike domain, and often use leaked customer details to look credible.
step 2 — The message manufactures urgency
It claims something time-critical: a blocked account, a failed delivery, an unpaid bill, KYC about to expire, or a WABA "policy violation" with hours to appeal.
step 3 — It asks for the one thing that unlocks the account
The victim is pushed to share an OTP, type a password into a fake page, pay through a link or a UPI collect request, or install a remote-access app.
step 4 — The attacker cashes out fast
Codes and sessions are used within minutes: to take over the account, drain a wallet, re-register a WhatsApp number or send more scams from the victim's account. Some crews pair the phished details with SIM Swap Fraud to receive the victim's codes directly.
step 5 — Each stage is a chance to break the chain
Verified branding and official channels work at first contact, never-ask rules at the request, phishing-resistant sign-in at the login, and fast reporting and blocking afterwards.
Caveats
Common mistakes with phishing
Asking customers for codes yourself
If your own support team ever asks customers to read back an OTP, scammers' requests look normal. Never ask for codes, PINs or card numbers in chat, and say so in your templates.
Using many numbers and link shorteners
Messages from ever-changing numbers with shortened links teach customers that anything goes. Use a few published official numbers, a complete business profile and full links on your own domain.
Admins without phishing-resistant sign-in
A WABA admin who signs in with only a password can be phished in one click. Require two-factor authentication, ideally passkeys or security keys, for everyone with access to the business portfolio.
No playbook for reports
When customers report a fake account, slow or inconsistent responses let the scam run for days. Give support a script, a log form and a named owner who escalates to Meta and the authorities.
Example
Example: A fake courier redelivery scam in Delhi
Customers of a Delhi courier start getting WhatsApp messages from a number using the courier's logo: "Your parcel is on hold, pay a small redelivery fee", with a link to a lookalike domain. The genuine business pins a warning to its WhatsApp business profile, adds "We never ask for payments, OTPs or UPI PINs in chat; our links only go to our own domain" to its delivery templates, reports the impersonating account through WhatsApp's report option, and tells affected customers to call 1930. Support agents get a one-line script and a form to log each report with the scammer's number, which the security team passes on through the official fraud-reporting channels.
Why it matters
Why does phishing matter?
Every successful scam in your name costs twice: the victim loses money or their account, and your brand loses the trust that makes customers open your WhatsApp messages at all. Lookalike accounts also teach customers to distrust genuine messages, so read rates and opt-ins suffer, and one phished admin can hand over the business's number and its message history. Clear "we never ask" rules, verified branding and phishing-resistant admin sign-in cost little compared with any of those outcomes.
Properties
Phishing: key facts and limits
- Channels
- WhatsApp, SMS (smishing), calls (vishing), email
- Common lures
- Parcel on hold, KYC expiry, refund, account block
- What scammers want
- OTPs, passwords, card numbers, UPI PIN, remote access
- India cybercrime helpline
- 1930
- India reporting portal
- cybercrime.gov.in
- Suspected fraud messages (India)
- Chakshu on the Sanchar Saathi portal
- Brand signal on WhatsApp
- Blue verified badge (formerly the green tick)
Usage
Phishing in code
// Refuse to send any message whose links point outside your own domains,// so you can truthfully tell customers: "our links only ever go to example.in".const ALLOWED_HOSTS = new Set(["example.in", "www.example.in", "pay.example.in"]);export function assertOfficialLinks(text) {const urls = text.match(/https?:\/\/[^\s)]+/gi) ?? [];for (const raw of urls) {let host;try { host = new URL(raw).hostname.toLowerCase(); } catch { throw new Error(`Malformed link: ${raw}`); }if (!ALLOWED_HOSTS.has(host)) throw new Error(`Blocked link to ${host}: not an official domain`);}}// Run it on template variables and agent replies before calling the messages API.assertOfficialLinks("Track your parcel: https://www.example.in/t/88231"); // passesassertOfficialLinks("Pay fee: https://examp1e-in.help/pay"); // throws
Link shorteners and third-party domains in your own messages make lookalike links harder for customers to spot.
Notes
Best practices for phishing
- Publish your official WhatsApp number on your website and in your app, and link to it from your profile.
- Add a short "we never ask for…" line to OTP, payment and delivery templates.
- Run a phishing drill at least once a year for everyone with access to Business Manager.
- Search regularly for lookalike accounts and domains, and report them early.
- Publish SPF, DKIM and DMARC records with a reject policy, so scammers cannot send email that appears to come from your domain.
Questions
Phishing FAQs
- How can customers tell a real business WhatsApp account from a fake one?
- Compare the number with the one published on the business's official website or app, and look for the blue verified badge where the business has one. Genuine businesses do not ask for OTPs, card numbers or UPI PINs in chat.
- What should a WABA admin do with a message claiming to be from Meta support?
- Do not click its links or share any code. Open Business Manager or WhatsApp Manager directly and look for notifications there: account quality, restrictions and policy issues are shown in Meta's own tools, so a genuine problem will be visible without the message.
- What is smishing?
- Smishing is phishing by SMS: a text impersonating a bank, courier or government service with a link or callback number. In India, commercial SMS with non-whitelisted links has been blocked since 1 October 2024, so scammers often move to WhatsApp or personal numbers.
- Where do I report a phishing scam in India?
- Call the 1930 cybercrime helpline or file a complaint at cybercrime.gov.in, especially if money was lost. Suspected fraud calls and messages can also be reported through Chakshu on Sanchar Saathi, and fake WhatsApp accounts through the in-app report option.