The New Threat: WhatsApp and Malware
The latest warnings from cybercrime officials focus on a sophisticated scam delivered through WhatsApp. Fraudsters are sending fake notices, appearing as official 'Office Memorandums' from the Income Tax Department, complete with the government emblem
and a fake official's signature. These messages create a sense of urgency, often threatening penalties for supposed tax discrepancies. The goal isn't just to scare you. The message contains a malicious ZIP file (e.g., 'ITD.zip') or a link to a cloned government website. Opening this file or link can install malware on your phone or computer, designed to steal your banking passwords, SMS messages including OTPs, and other personal data. This tactic is particularly dangerous because it preys on the anxiety around tax compliance and the widespread use of WhatsApp for communication.
Why This Changes Everything
Previous scams often relied on poorly worded emails or suspicious SMS links. However, this new wave is far more convincing. The use of official-looking documents and delivery via a common platform like WhatsApp lowers a person's natural defences. People are accustomed to receiving important updates on the app, making them more likely to trust the message. Furthermore, the malware being used is designed to evade standard anti-virus software by changing file sizes and hiding within seemingly legitimate program files. This isn't just about spotting a typo in an email anymore. The scam has evolved from simple phishing to a direct assault on your device, capable of capturing your credentials in real-time or showing you fake bank login screens. The case for verification has changed from a suggestion to a hard-and-fast rule for survival.
Your Verification Checklist: The Only Safe Method
Given the sophistication of these scams, you cannot trust any unsolicited communication. The Income Tax Department has repeatedly stated it does not use WhatsApp for official notices or ask for sensitive details via calls or messages. If you receive any communication, follow this verification process without exception: 1. Do Not Click: Never click on links or download attachments from unexpected emails, SMS, or WhatsApp messages, no matter how official they look. 2. Go to the Source: Always log in to the official Income Tax e-filing portal (incometax.gov.in) by typing the address directly into your browser. This is the only place to view and respond to genuine notices. 3. Authenticate Notices: The e-filing portal has a dedicated service to verify the authenticity of any communication using the Document Identification Number (DIN) found on the notice. You can do this even without logging in. If a notice is real, it will be verifiable on the portal. If it's not, the portal will show 'No record found'. 4. Reject All UPI 'Receive' Scams: Remember that you never need to enter your UPI PIN to receive money. Fraudsters often use fake refund claims to send a 'Collect' request, and approving it will debit money from your account.
What to Do If You're Targeted
If you receive a suspicious message or, worse, interact with one, quick action is critical. First, do not engage further. Block the sender's number immediately. If you clicked a link or downloaded a file, disconnect your device from the internet to prevent further data theft and run a full security scan with updated antivirus software. Inform your bank immediately to monitor or block your accounts. You must report the incident through the official channels. You can call the National Cyber Crime Helpline at 1930 for financial fraud or file a detailed complaint online at cybercrime.gov.in. You should also report suspicious tax-related messages by forwarding the email or details to webmanager@incometax.gov.in and incident@cert-in.org.in. Reporting helps authorities track these scam networks and protect others.
