You may receive a WhatsApp message from an unknown number. No introduction, no explanation. Just an image and a question: “Is this really you?”
You don't recognize the number, but now you're curious. You want to see the picture, so you download it. That curiosity is exactly what the scammer is counting on.
A new wave of scams is using messages like “Is this you?” to trick people into interacting with malicious files and links on WhatsApp. Security researchers have documented campaigns where files disguised as images were used to deliver malware.
The trick is simple: Make you curious before you become cautious.
It Doesn't Look Like a Scam
Most people know to be suspicious when someone sends:
“You've won ₦5 million.” Or: “Your bank account will be blocked today.”
But “Is this really you?” feels different. Maybe someone sent them a picture of you, maybe it's an old photograph, maybe someone posted something about you. You want to know and that curiosity can make you forget the first question you should ask: Who sent this?
The Unknown Number Is the First Red Flag
If someone you don't know suddenly sends you a file, don't need to open it to find out why they sent it.
You don't need to satisfy your curiosity nor even respond to it. Delete the message, block the number and report it if necessary.
Stay Protected: Turn Off WhatsApp Auto-Download
One simple step you can take is to stop WhatsApp from automatically downloading media and files. Go to:
Settings → Storage and Data → Media Auto-Download
Review the options for mobile data, Wi-Fi and roaming. You can select “Never” if you don't want WhatsApp to automatically download incoming media.
This doesn't make you completely safe, but it gives you more control. Instead of files downloading automatically, you have to make a conscious decision about what you want to download. That extra moment can matter.
What If It's Someone You Know?
Don't assume a message is safe just because it comes from a familiar name.
Fraudsters can compromise WhatsApp accounts and use them to contact people in the victim's address book. If someone you know suddenly sends you a strange file or an unexpected link, verify it. Call them or message them through another platform. Ask to be sure they sent you a file and ask what it contains. Verify first. Then open.
What If You Already Downloaded It?
Don't panic. Downloading a suspicious file doesn't automatically mean your device has been compromised. The risk depends on the type of file, your device and what you did after downloading it.
If you haven't opened it, don't.
If you opened or executed something suspicious and notice unusual activity, take it seriously. Update your device, run a security scan using reputable security software, and review your accounts for anything unusual.
If you entered a password or sensitive information after interacting with the file or link, change that password from a trusted device.
Don't Let Curiosity Make the Decision
Fraudsters don't always rely on fear. Sometimes, they rely on curiosity. The goal is to get you to interact before you think. So the next time an unknown number sends you a strange message or file, pause.
Ask yourself: Do I know this person?, Was I expecting this?, Why are they sending me this file?
If the answers don't make sense, you already have your answer. Don't download it. Staying safe online isn't about knowing exactly what fraudsters are trying to do. It's knowing when not to find out.
Move smart before your money moves
