Banking customers in the UAE have been alerted to a “zero-day” security flaw in WhatsApp that allows cybercriminals to compromise smartphones through a single voice call, according to Emirates NBD.
The bank explained in an advisory that the attack exploits an unidentified vulnerability, giving hackers unauthorized access to devices. Unlike typical phishing scams, the breach can be triggered simply by answering a call from an unknown number, requiring little to no interaction from the user.
Officials noted that the timing of the attack is strategic, as the holiday season’s high volume of greetings and travel messages provides cover for malicious activity.
A zero-day vulnerability is a security gap unknown to software developers until it is exploited. In this case, hackers are using WhatsApp’s call feature to gain entry, potentially accessing personal photos, private chats, and sensitive account information, the UAE Cybersecurity Council warned.
Emirates NBD outlined six key steps for customers to protect their data:
1. Update software immediately – Keep WhatsApp and your phone’s operating system (iOS or Android) up to date via official app stores.
2. Enable two-step verification – Add a PIN in WhatsApp settings to prevent unauthorized re-registration on other devices.
3. Exercise caution with unknown calls – Silence calls from unknown numbers using WhatsApp privacy settings.
4. Use official banking channels only – Conduct transactions through verified apps or websites; never share OTPs, PINs, or login details.
5. Verify before clicking links – Avoid URLs with unusual spellings or extensions like “.xyz” or “.kom,” often used in malware-laden greeting scams.
6. Report suspicious activity – Contact the bank at 600 54 0000 or inform authorities if you suspect compromise.
The bank emphasized it will never request personal information, passwords, or authentication codes via messages or calls. “If something seems unusual, it possibly is,” the advisory said, urging residents to stay vigilant and remain “United Against Fraud.”
