The Digital Rights Foundation (DRF) issued an alert this week, warning against an ongoing scam aiming to compromise WhatsApp accounts via fake calls requesting a code.

WhatsApp is an especially widely used messaging service across Pakistan, with the World Population Review reporting about 52 million Pakistani users of the platform in 2024 — the seventh-largest number in the world by population. Its use has even been advocated in the legal sector for greater efficiency. However, rising digital scams threaten users’ data security and can cause accounts to be compromised.

According to the alert, DRF — a not-for-profit organisation based in Pakistan that has been working on digital rights freedoms since 2013 — received “multiple reports of an ongoing scam to hack WhatsApp accounts”.

“Victims receive calls from delivery riders, or from individuals pretending to be from the HEC (Higher Education Commission), and are prompted to share a code that compromises their WhatsApp,” the alert said.

“Victims receive calls from individuals pretending to be representatives of the HEC. They claim the victim’s educational degrees need urgent verification and ask for a verification code,” DRF told Dawn.com. “Sharing the code results in the victim’s WhatsApp account being compromised.”

The foundation emphasised that while some courier companies used codes for deliveries, these codes were always sent from the company’s official number.

“Always check the sender’s name and consult the courier company’s official helpline before you share,” it said. “Remember: never share any other codes with anyone, no matter how much they insist.”

It also advised citizens to report scam calls to the Pakistan Telecommunication Authority’s official complaint cell at 0800-55055.

In infographics also shared by the foundation, it recommended turning on two-factor authentication for all social media apps as well as checking the ‘linked devices’ function of WhatsApp to monitor who had access to an account, and removing unfamiliar devices.

It advised affected parties to reach out to its Digital Security Helpline team for guidance via the number 0800-39393 — open every day from 9am-5pm — or via social media.

According to data shared with Dawn.com by the helpline team, 233 cases of scam calls have been reported to the DRF since January 2025.

Other types of scams reported include JazzCash helpline impersonation to gain access to an account, kidnapping scam calls demanding large sums for the “release” of a victim’s family member, and phishing links, where scammers hack the victim’s social media account and then impersonate them to ask for “urgent financial help”.

The DRF Digital Security Helpline guides victims of hacking through steps to raise an awareness message on social media, recover their hacked account, and report their hacked account for legal action. It also provides digital security tips and escalates cases to relevant platforms for high-risk individuals.

“Unfortunately, despite awareness messages, people still regularly fall into the trap of these scams and end up sharing their OTP (One-Time Password),” said DRF’s Digital Security Helpline Lead Hyra Basit.

“Yes, these scams have also evolved and are becoming increasingly difficult to verify, particularly those that use AI systems to conduct the scams on a scale,” she added.

“But there is also a need to enforce a human rights–compliant data protection law to ensure that people’s private information is made secure and people are not left vulnerable at the hands of data leaks.”

She also stressed the need for accessible mechanisms for the public to report such scams.

Last month, the National Cyber Crime Investigation Agency conducted a successful raid on an illegal call centre in Islamabad and arrested five foreign nationals, according to a press release.

Meanwhile, in May, the national Cyber Emergency Response Team issued an advisory warning that the login credentials and passwords of more than 180 million internet users in Pakistan had been stolen in a global data breach, urging people to take immediate protective measures.