Most are not falling for code scam

“Mamash, a code popped up.” 

The warning, posted in a Jewish community group after a suspicious phone call allegedly linked to a pro-Israel organisation, is one of a growing number online describing possible WhatsApp phishing attempts disguised as advocacy or prayer outreach. 

They are anything but. These calls are, in fact, a way for scammers to try hack into WhatsApp so they can get hold of people’s contacts. For what reason is still unclear. 

“WhatsApp takeovers can occur when the scammer impersonates someone you know or an organisation and asks you to share specific information that will ultimately give them access to your WhatsApp account,” says Manie van Schalkwyk, Chief Executive of the Southern African Fraud Prevention Service (SAFPS). “This is a highly advanced process and once they gain access, they will generally start contacting people in your contact list asking for urgent financial assistance.” 

“I usually never answer my phone if I don’t know the number calling. However, over the past year and a half, I have been doing so for work,” says Menucha Odendall, who has been living in Israel for two years but still uses her South African number on WhatsApp. 

She says she received a call at night sometime in April and the caller said they were from the South African Friends of Israel, and were running a prayer meeting for Israel. 

“I just said I wasn’t interested because I usually don’t participate in this kind of thing. Then he randomly said, ‘But there’s a WhatsApp group that if you want to join the prayer meeting later, you need to click on it.’ And I just wasn’t interested,” she says. 

The man on the other end of the phone said that for the WhatsApp group, there was a code he’d sent and that she must read it out. Once the code came through, “that’s the instant I knew that it was a scam. It was like when you try to log into another device, you need a code or something to verify that it is you. I knew immediately that it was a scam because there’s no way anyone needs any codes from you. So I just dropped the call,” she says. 

Sharon Lichtenstein got a similar call from someone claiming to be Pastor Michael, who said he was representing the SA Jewish Report and they were holding a prayer session for Israel that night. 

“They called me on a Tuesday afternoon, then again at night, and both times I cut the call. He then called me on a Friday night, and nobody calls me on Shabbos, so I blocked him. He then called from a different number, and I blocked it. I suspected a scam because I never get phoned for prayers for Israel. It’s usually from a shul if anything” she says. 

Margaret Rawicz received a near-identical call from “Pastor Mike”. He also claimed to represent the SA Jewish Report and knew she was a reader. While claiming to represent the publication, he said, “We are collecting money for Israel because we love Israel.” 

He then sent Rawicz a message with a code to read out in order to continue. 

“I did get a message with a code on it. There was also something in the message that said ‘Do you know this person ‒ be careful’. I immediately put the phone down. I subsequently heard that this is possibly a Nigerian scam group that is contacting lots of people to scam them out of money,” she says. 

Van Schalkwyk says impersonation scams are rife in South Africa. She says this type of scam has many different methods, and criminals adapt their approach to exploit trust and create a sense of urgency and fear. Ultimately, they are trying to find convincing tactics to get you to take action (like transfer money), click on a link to download malware (malicious software) to your device, or share personal information like card details, an ID number, or passwords. 

The techniques used are sophisticated, and common impersonation scams in South Africa include impersonating law enforcement, impersonating the South African Revenue Service, business email compromise, where they pose as colleagues or suppliers to redirect funds, and vishing (phone-based scams), where fraudsters call pretending to be from an organisation, such as has been seen in the Jewish community recently. 

“Vishing in particular is a problem and for that reason, the SAFPS launched the Just Say Goodbye awareness campaign last year,” says Van Schalkwyk. 

According to the SAFPS, the principle is simple: If you didn’t expect a call and the caller offers help with an issue related to your account, don’t press any buttons, don’t share one-time pins, or respond to pop-ups. Just say goodbye and end the call. 

While one may think, “This will never happen to me; I won’t fall for these scams”, Van Schalkwyk warns against complacency. “The method of deception used to scam targets involves a sophisticated blend of impersonation, social engineering, and technology. 

“We urge people always to be vigilant about unexpected calls or messages. Don’t simply click on links, share information, or assume you are speaking to the person they are claiming to be. Always stop, think, and verify,” she says.