Imagine receiving a WhatsApp message that looks like a bank alert, warning of a debit you did not authorize. Your instinct might be to type ‘NO’ to reject the transaction. In the latest twist used by cybercriminals, that very reply is the trigger that hands over control of your phone and empties your bank account in moments.
Earlier schemes relied on tricking users into replying ‘YES’ to fake transaction messages, which would then install malware on the device. Now they send a fabricated alert about a bank debit and wait for the victim to respond with ‘NO’. The mere act of typing that single word sets off the next stage of the attack.
According to police warnings, replying ‘NO’ to the deceptive message initiates an auto‑execution file attack. This malware does not need the victim to share an OTP, click a link, or install any app manually. Once activated, it gives hackers full control over the mobile phone, allowing them to transfer funds out of the linked bank account almost instantly.
In a video message released that day, he described how the scam operates and urged citizens to stay alert.
On Monday, 12 October 2026, Hyderabad Commissioner of Police VC Sajjanar issued a public warning about this emerging threat. In a video message released that day, he described how the scam operates and urged citizens to stay alert. Sajjanar emphasized that the fraud does not require any interaction beyond the simple reply.
During his warning, Sajjanar noted that he had recently encountered a case where a chartered accountant fell prey to the new method. He said the fraud managed to defraud the professional quickly, illustrating that even financially savvy individuals are vulnerable when the reply is made.
Sajjanar’s guidance is straightforward: do not reply to any unsolicited WhatsApp message that mentions bank transactions, regardless of whether it says ‘YES’ or ‘NO’. Users should block the sender’s number, delete the message, and verify any suspected activity only through their official banking application. He urged people to block unknown numbers and delete such messages.
The commissioner stressed that the first sixty minutes after a fraud is the ‘golden hour’ for attempting recovery. Victims are advised to call the cyber helpline at 1930 or file a complaint via the portal cybercrime.gov.in as soon as they realize their account may have been compromised. Prompt action, he said, increases the chances of stopping further losses.
The warning was issued on Monday, 12 October 2026.