Messaging apps have become one of the most common routes for online fraud, because a message that looks like it came from a bank, a delivery company or a government office can reach anyone within seconds. The tricks are familiar by now: an urgent prize or refund offer, a parcel stuck in transit, a relative in trouble, or an official demanding immediate payment. WhatsApp cannot stop a user from trusting a convincing message, but it does offer a set of built-in controls that reduce how easily strangers can reach you, and how much damage a stolen account can do.
The first line of defence is controlling who can call and message you at all. The Silence Unknown Callers feature, found under Settings, then Privacy, then Calls, automatically silences calls from numbers that are not saved in your contacts. Those calls still appear in the call log, so a genuine caller can be checked and called back later, but the phone does not ring and the user is not pressured into answering on the spot. That pause matters, because scam calls often rely on urgency and surprise to push people into sharing information before they have time to think.
A second control limits who can add you to groups, which is a frequent route for spam and scam campaigns that add thousands of users at once. Under Settings, then Privacy, then Groups, users can restrict group additions to contacts only, or to selected contacts, so strangers cannot pull them into a prize or investment group without permission. Reviewing this setting takes a minute and prevents one of the most annoying and risky forms of unwanted contact on the platform.
Block, Report and Lock the Account
When a suspicious message does arrive, the right response is to block and report, not to reply, argue or click. Blocking stops the sender from calling or messaging you, and stops them from seeing your last seen status, online status, profile photo and status updates. Reporting sends recent messages from that chat to WhatsApp for review, which helps the platform identify and remove accounts involved in spam or fraud, protecting other users as well. Reporting first and then blocking is the most useful sequence, because blocking alone does not alert the platform in the same way.
Account security also depends on two-step verification, which adds a six-digit PIN that is required whenever the number is registered again on a new device. This is the main defence against account takeover tricks, including SIM-swap attempts and scams that trick users into sharing a registration code. The PIN should be set under Settings, then Account, then Two-step verification, with a recovery email added so the account can be recovered if the PIN is forgotten. No legitimate service will ever ask for this PIN or for a one-time password, and any message asking for either should be treated as a fraud attempt.
Linked devices deserve a regular check as well. Under Linked Devices, users can see every computer, tablet or browser session connected to their account and log out of anything they do not recognise. Fraudsters sometimes try to link a victim's account to their own device through a QR code or a link, so an unfamiliar session is a warning sign that should be acted on immediately. Combined with a privacy checkup, which walks through visibility, group, call and message controls in one guided flow, these settings form a solid baseline for most users.
Privacy Controls and Habits That Close the Gaps
Privacy settings also limit what scammers can learn about you before they make contact. Under Privacy, users can control who sees their profile photo, last seen and online status, About information and status updates, restricting them to contacts rather than everyone. Scammers often build credibility by reusing personal details gathered from a public profile, so reducing that exposure makes impersonation harder. A stricter account setting, available under Privacy and then Advanced on supported versions, applies the most restrictive posture for people facing targeted attacks, blocking media and attachments from non-contacts and limiting interactions from unknown accounts.
End-to-end encryption protects the content of messages and calls so that only the sender and recipient can read or listen to them, and even WhatsApp cannot access that content. Encryption is valuable, but it does not prevent scams, because a fraudster's message is still delivered and read like any other message. The protection against fraud comes from verification habits, not from encryption alone: pause before acting on an unexpected request, verify the sender through a separately obtained official number, and never transfer money or share codes because a message demands urgency.
If money has already been transferred to a fraudster, speed matters more than embarrassment. In India, suspected financial cyber fraud can be reported through the National Cyber Crime Reporting Portal or by calling the national cybercrime helpline at 1930, and the bank involved should be contacted immediately to try to freeze or recall the transaction. No privacy setting can guarantee complete protection, and a scammer may still try another number or another platform, but a phone with silenced unknown calls, restricted groups, two-step verification switched on and unfamiliar devices logged out is a much harder target than one left on default settings.
