Someone is selling what they say is a list of 487 million WhatsApp users' phone numbers from 84 countries on a well-known hacking forum, the research site Cybernews reported in mid-November 2022, and among them are about 38 lakh numbers from Bangladesh. The seller claims the numbers belong to active users and that the data is from 2022. The largest slices are Egypt, 4.5 crore, Italy 3.5 crore, the United States 3.2 crore, the United Kingdom 1.15 crore, Russia 1 crore and India 60 lakh; if genuine, it would be the largest such dataset in WhatsApp's history.
Leak or scrape?
The distinction matters. WhatsApp's parent Meta said there was "no evidence of a data leak" from its systems and that the claim rested on "unsubstantiated screenshots". Security researchers who examined samples found real, active numbers, but that is consistent with scraping: WhatsApp will confirm whether any number you enter has an account, and a script that feeds it hundreds of millions of numbers from telephone-number ranges, or from older leaks, gets back a list of valid WhatsApp users. No messages, names or chats are involved; the platform's end-to-end encryption is not touched. Meta's own terms forbid scraping, and it has sued scrapers before, but the technique is hard to prevent entirely.
What a phone number buys a criminal
A verified list of active WhatsApp numbers is a marketing list for fraud. Expect, and in Bangladesh you may already have seen, the consequences: calls from foreign numbers that ring once so you call back at premium rates; messages offering part-time "like and earn" jobs that end in a deposit; fake bKash and bank alerts; and "your parcel is held at customs" links. The number alone does not let anyone into your account. The scams that use it rely on you.
Four settings, five minutes
- Two-step verification. Settings, Account, Two-step verification. A six-digit PIN that stops a SIM-swap or an OTP trick from moving your account to another phone.
- Hide your profile from strangers. Settings, Privacy: set Profile photo, About and Last seen to "My contacts". A scraper that also harvests photos has less to work with.
- Silence unknown callers if your version has the option, and never call back a missed call from a number you do not recognise, especially foreign ones.
- Report and block any message with a link or a job offer from an unknown number. Reporting sends the last messages to WhatsApp and helps it shut the sender down.
If your number is in the list, changing it is not worth the disruption. Changing your behaviour towards unknown numbers is.
