Hyderabad Police Commissioner VC Sajjanar has issued a warning about a sophisticated new cyber scam targeting WhatsApp users. According to reports from NDTV Profit, Sajjanar explained how cybercriminals are using auto-execution file attacks to drain bank accounts in seconds. The commissioner emphasized that a single 'No' reply to a WhatsApp message could completely empty your bank account, with no OTPs requested or suspicious links required for the fraud to occur. As per the latest reports, Sajjanar shared a video message on X on Monday, October 12, stating that this scam results in "a person's bank account being completely drained in mere moments simply for replying 'NO' to a single WhatsApp message!" The Hyderabad Police Commissioner also shared that "a single 'No'—and your bank account is drained! No OTPs requested, no links to click! Money siphoned off in seconds via a WhatsApp message! Fraudsters' latest ploy: an auto-execution file attack."
As reported by NDTV Profit, the scam unfolds in a specific sequence designed to exploit panic responses. First, victims receive a fake message from an unknown number claiming a certain amount has been debited from their account. Immediately following this initial message, a second message instructs users to reply 'No' if they did not initiate the transaction. According to Sajjanar's explanation, when users type and send 'No' out of panic, hidden malware scripts within the message automatically activate, giving hackers full control over the mobile phone and access to all bank accounts. The commissioner explained that "the moment you type and send 'NO'—out of panic that money might be lost from your account—hidden malware scripts within the message automatically activate. Within seconds, hackers gain full control over your mobile phone and drain all the funds from your bank accounts." Sajjanar specifically noted that "I recently came across a new type of cybercrime that completely swindled even a chartered accountant. It is a highly dangerous 'auto-execution file attack' orchestrated by cybercriminals leveraging technology."
A case involving a chartered accountant from Lucknow came to light in September that provides concrete evidence of the scam's effectiveness. According to reports, the victim received fake information on WhatsApp stating that ₹90,000 was debited from his account. After giving the reply 'No', the victim complained that a total of ₹1.70 lakhs was lost from two bank accounts. The victim stated that he did not give OTP and did not open the link, yet money was still transferred from his accounts. The investigation has to reveal the real reason behind the money transfers in this incident, highlighting the complexity of tracking such fraudulent activities.
While Sajjanar described the fraud as an 'auto-execution file attack', there is no independent verification available for the technical claim that simply replying 'No' to a simple WhatsApp text message will enable malware to run on the phone. Earlier attacks detected by central cyber security agencies revealed that devices were hacked by opening or executing malicious files, not through text message replies. As reported by NDTV Profit, while it is important not to respond to suspicious messages, don't assume that your bank account will be emptied with every reply. If you receive a message that money has been debited from an unknown number, do not respond immediately and check the transactions on the bank's official app or net banking to verify the authenticity of the message. The Business Standard report emphasizes that "a reply alone does not normally install malware on an updated smartphone" and that "under normal circumstances, replying to a text message on WhatsApp does not automatically execute a malicious file."
According to Business Standard, users should follow these five critical precautions when facing suspicious WhatsApp messages: 1. Check your bank account independently by opening your bank's official mobile application or internet banking website directly to verify recent transactions and account balance. 2. Do not reply to unknown numbers - avoid responding to messages that ask you to confirm transactions, particularly those that create urgency or threaten further losses. 3. Never download suspicious files or applications - do not open unexpected attachments or install applications at a sender's request. 4. Never share banking credentials or OTPs - banks do not need your ATM PIN, internet banking password, card security code or OTP to send you an ordinary transaction alert. 5. Block and report suspicious senders using WhatsApp's reporting and blocking features, and avoid forwarding suspicious messages to prevent spreading misleading information. The report emphasizes that "the most reliable safeguard is to verify every claimed debit through your bank's official application, website or customer-care service" and that "if a message claims that your money is at risk, check your account first. Do not let the message dictate your next action."
