New fraud alert: Downloading photo from unknown WhatsApp number can drain bank account
Updated: Jun 23rd, 2025
In the age of digital banking, e-frauds are mushrooming daily. Fraudsters now use several tactics through mobile phones, laptops, computers, online banking, ATMs, and OTP to cheat people.
Despite growing awareness among authorities and citizens, a shocking new method has now emerged—hackers are now able to wipe out your bank account just by sending a photo via WhatsApp.
Steganography: A new cyber fraud tactic
According to cybersecurity experts, when a photo is sent via WhatsApp from an unknown number, it often contains a hidden code embedded within it—something common users can’t detect. Once the photo is downloaded, and if the mobile device is used for net banking, the embedded code enables the hacker to access the account and steal money. This technique is known as steganography.
How does this fraud work?
This innovative cyber fraud operates solely through WhatsApp. As sources warn, a photo is sent from an unknown number along with a message like, “Do you recognise this person?” Out of curiosity, users often download the photo to identify the person. The moment the image is downloaded, the phone gets compromised. If that device is used for online banking, the account can be emptied in minutes.
Until now, scammers primarily used links or OTPs to steal data. Now, they send a simple photo that, once downloaded, grants access to your phone’s data—banking details, passwords, OTPs, and even personal files.
To stay safe:
- Turn off auto-download of images in WhatsApp.
- Never download suspicious images sent from unknown numbers.
- Block any unknown numbers that send unsolicited media.
These cybercriminal groups, mainly operating from foreign countries,
constantly develop new ways to scam people via mobile. Joint police operations have begun across India to catch domestic collaborators working for these international networks.
In the last six months, the National Cyber Portal received over 2,500 cybercrime complaints, with 265 from Gujarat alone. Gujarat Police investigations revealed that ₹1,455 crore was siphoned from 89 Indian bank accounts over this period.
Surat Police recently busted a major racket involving three local individuals who had opened 165 fake bank accounts and were laundering crores of rupees through them. These funds came from digital arrests, hawala operations, illegal betting, stock market scams, and OTP frauds.
The arrested suspects were in contact with syndicate leaders operating from Cuba, Thailand, and Malaysia via Telegram and supplied rented bank accounts in exchange for commission.
The Gujarat State Cyber Crime Cell, in coordination with teams from Ahmedabad, Surat, Rajkot, and Vadodara, has solved 12 major cybercrime cases. The Ahmedabad Cyber Crime Branch also uncovered a Chinese-run syndicate operating out of Cambodia and Nepal, arresting six individuals. A gang operating from a hotel in Nepal used Telegram to carry out a ₹49 lakh scam, and had 200 complaints lodged against them on the National Cyber Crime Portal.
Many of these syndicates are also being investigated by ED (Enforcement Directorate) and CBI (Central Bureau of Investigation) for financial fraud. However, most of this action occurs after the citizens have already been scammed. Hence, it's vital for mobile users to remain alert to prevent becoming victims.
From January 2024 to April 2025, Indian citizens lost a staggering ₹1,761 crore to cybercrime. Only ₹672 crore has been traced or frozen so far. In 2024, ₹295 crore was returned to victims, while ₹97 crore has been refunded this year so far. Since 2020, the total amount lost to cyber fraud in India stands at ₹2,941 crore. Gujarat recently launched a cybercrime refund portal called ‘Tera Tujhko Arpan’. Between January 2024 and April 2025, Gujarat Police recovered ₹147 crore of the lost amount.
Gujarat Cyber Cell SP Dharmendra Sharma said, “If a complaint is filed within 8 hours of the fraud, there’s an 80% chance of recovering the lost money”.
Digital arrest scams are rising in Gujarat. The Cyber Crime Cell is coordinating with police forces in Rajasthan, Uttar Pradesh, West Bengal, Haryana, and Odisha to trace such criminal networks. This has led to a steady increase in the recovery rate:
2020: 11.5%
2021: 13%
2025: 23%
Operation Chakra-V: Nationwide raids in 8 states of CBI
An international gang based in Rajasthan conducting virtual arrests via phone calls was busted. Authorities seized ₹2.80 crore in digital cash and ₹22 lakh in physical cash. The CBI took over investigations from Rajasthan Police into ₹7.67 crore worth of frauds between October 2023 and January 2024.
As part of this operation, the CBI raided 42 locations across Assam, West Bengal, Bihar, Uttar Pradesh, Maharashtra, Telangana, Karnataka, and Tamil Nadu, uncovering illegal SIM card use and fake bank accounts. Additionally, raids at 19 locations in Delhi, Haryana, and Uttar Pradesh led to the bust of two illegal call centers and the exposure of a vast cybercrime syndicate.
Also read:
