India has 500 million WhatsApp users — the largest user base of any country in the world. We use it for everything: talking to family, running small businesses, receiving government notifications, watching news, making UPI payments, joining communities.
We also lose crores of rupees to WhatsApp scams every year. We share health misinformation that causes people to refuse proven treatments. We forward political deepfakes that influence elections. We leave privacy settings at default that expose our phone number, photo, and location to strangers.
None of this is inevitable. A few settings changes and a few habits dramatically reduce your risk. This guide covers all of it, step by step.
Part 1: Privacy Settings — Change These Now
Open WhatsApp → Settings (three dots, top right) → Privacy. Go through each setting:
Last Seen and Online
Default: Everyone can see when you were last active and when you are currently online.
Risk: This reveals your daily activity pattern to everyone who has your number — including people you do not know who obtained your number from a group.
Recommended setting:
- Last Seen: My Contacts or Nobody
- Online: Same as Last Seen
How to change: Settings → Privacy → Last Seen and Online → select "My Contacts" or "Nobody"
Profile Photo
Default: Everyone with your number can see your profile photo.
Risk: Your photo can be downloaded and used to create fake accounts, deepfakes, or social engineering ("Hello, I'm from [company]. I recognised your photo from our meeting.").
Recommended: My Contacts Only
About (Status text)
Default: Everyone sees your "About" text.
Recommended: My Contacts Only
Status (Stories)
Default: All contacts see your status updates.
Recommended: My Contacts (or specific contacts you choose, under "My contacts except…")
Read Receipts (Blue Ticks)
Default: On — senders see when you have read their message.
You can turn this off under Settings → Privacy → Read Receipts. Note: if you turn off read receipts, you also cannot see when others have read your messages.
This does not affect group chats — read receipts in groups remain visible regardless.
Groups — Who Can Add You to Groups
Default: Everyone (anyone with your number can add you to any WhatsApp group)
Risk: You get added to spam groups, investment scheme groups, political propaganda groups, and groups designed to harvest your details.
Recommended: My Contacts — Only people already in your contacts can add you to groups. Others must send an invite link that you choose to accept.
How to change: Settings → Privacy → Groups → My Contacts
Who Can See My Phone Number
This controls who sees your number in community groups. Set to My Contacts.
---
Part 2: Security — Enable These Now
Two-Step Verification (Most Important)
This is the single most important thing you can do. Without it, if someone gets your SIM OTP, they can steal your WhatsApp account in minutes.
With two-step verification, they also need a 6-digit PIN that only you know — making account theft nearly impossible.
How to enable:
Settings → Account → Two-Step Verification → Enable → Set a 6-digit PIN (not your birthday or 123456) → Add your email for recovery
Do this immediately if you have not already done it.
Linked Devices — Check What Is Connected
Someone who had brief access to your unlocked phone may have linked your WhatsApp to their computer using WhatsApp Web.
Check: Settings → Linked Devices → review the list. If you see any device you don't recognise, tap it and click "Log Out."
Log out of all linked devices periodically, especially if you recently used WhatsApp Web at someone else's computer.
Disappearing Messages
For sensitive conversations, enable disappearing messages — messages automatically delete after 24 hours, 7 days, or 90 days.
Settings → Privacy → Default Message Timer → select duration
This does not prevent screenshots, but it reduces the risk of old sensitive conversations being accessed if your phone is lost or stolen.
Chat Lock
For conversations you want extra protection on, you can lock individual chats with biometrics (fingerprint or face ID).
Open any chat → contact name at top → Chat Lock → Lock
Locked chats move to a separate "Locked Chats" folder visible only with biometric authentication.
---
Part 3: Identifying Scams on WhatsApp
The "Part-Time Job" or "Work From Home" Scam
How it works: You receive a message (often from an unknown number): "Hi! I'm [name] from [company]. We have a simple task-based work-from-home opportunity. Earn ₹500–₹2,000 per day by liking YouTube videos/reviewing products. Can I add you to our group?"
If you agree, you are added to a WhatsApp group full of fake testimonials ("I earned ₹8,000 today!"). You are asked to do simple tasks and given small "payments" (₹100–₹500) to build trust. Then you are asked to invest money to "unlock higher-paying tasks." Once you invest, the group disappears and your money is gone.
Rule: Any "job" that asks you to invest money is a scam. Legitimate employers pay you; they do not ask you to pay them.
The Investment / "Pig Butchering" Scam
How it works: A friendly stranger messages you — sometimes pretending to be a wrong number or an old acquaintance. They build a relationship over days or weeks. They mention how much money they are making through a "special investment platform." They send screenshots of returns. They offer to help you invest. Once you put money in, you see "profits" — but you cannot withdraw them without paying a "tax" or "unlock fee." This continues until you stop paying or the scammers disappear.
Rule: If someone you do not know in real life contacts you about an investment opportunity — regardless of how friendly or legitimate they seem — it is a scam. The profits you see in the app are fake numbers; the money does not exist.
The Impersonation Scam (Family Emergency)
How it works: You receive a message from an unfamiliar number: "Hi [your name], it's me [son/daughter/sibling]. My phone broke/I lost my phone, this is my new number. I'm in trouble and need ₹[amount] urgently — please send on this UPI ID. I'll explain later."
The scammer researched your family from social media or bought data from a data breach.
Rule: Establish a family code word that only real family members know. If you receive an emergency message from an unfamiliar number, ask for the code word before doing anything. Call the original number even if you think it is off.
The KYC / Bank Verification Scam
How it works: A message arrives claiming to be from your bank, TRAI, or a government agency: "Your [bank/SIM card/Aadhaar] will be blocked today unless you update your KYC. Click here or call this number." You call; someone asks for your OTP, Aadhaar number, or card details.
Rule: Banks and government agencies never ask for your OTP, PIN, or full card number. An OTP is a one-time password — it is only ever entered into the official app or website. Never share it verbally with anyone.
The Prize / Lottery Scam
"Congratulations! Your number was selected in the WhatsApp lottery. You have won ₹25 lakh. To claim your prize, pay ₹5,000 processing fee." There is no lottery. No legitimate prize requires payment to claim.
---
Part 4: Identifying Fake News and Deepfakes
India's WhatsApp groups are one of the world's most efficient misinformation distribution systems. Health cures, political claims, religious provocations, investment frauds — they all travel as forwarded messages with the word "VIRAL" or "Must share!!"
Warning Signs of Fake News
Emotional manipulation: Messages designed to make you angry, scared, or deeply proud are more likely to be fake or misleading. Misinformation spreads by triggering emotions, not informing.
"Forward to 10 people immediately": Urgency that prevents you from verifying. Legitimate information does not expire if you take 2 minutes to check it.
No source: "Doctors say..." "Experts say..." "According to research..." without naming who, where, or when. Real health or government information can be traced to an official source.
Old images used in new context: A photo from a flood in 2018 is shared as if it happened yesterday. A photo from one country is shared as if it happened in India.
"The government doesn't want you to know this": Consistently a red flag for health misinformation (miracle cures) and conspiracy content.
How to Fact-Check in 2 Minutes
Step 1 — Reverse image search (for photos/videos):
- Screenshot the photo
- Go to Google Images → search by image → upload the screenshot
- You will see where and when the image was actually first used
Step 2 — Check fact-checking sites:
- PIB Fact Check: factcheck.pib.gov.in (government fact checker) — specifically for government-related claims
- India Today Fact Check: indiatodayne.in/fact-check
- The Quint WebQoof: thequint.com/webqoof
- AFP Fact Check India: factcheck.afp.com/lang/en
Step 3 — Search the claim:
Type the key claim into Google with "fact check" at the end. If it has been debunked, a fact-check article will usually appear on the first page.
Step 4 — Apply the SIFT method:
- Stop before you share
- Investigate the source
- Find better coverage
- Trace claims and media to original context
What to Do When You Receive Something Suspicious
Do not forward it. Even if it turns out to be true, forwarding without checking makes you part of the misinformation chain.
Report it: Tap and hold the message → Report. This sends it to WhatsApp for review. For messages in groups, you can also report the entire group.
Educate politely: If someone in your family or group shares fake news, do not mock them — this creates defensiveness. Share the fact-check link with a neutral message: "I checked this and found this article that says something different — thought you'd like to know."
---
Part 5: WhatsApp Payments — Stay Safe
WhatsApp Pay uses UPI. The same UPI safety rules apply:
Never share your UPI PIN with anyone. Your PIN is for paying, not receiving. If someone asks for your PIN to send you money, they are trying to steal from you.
A UPI request for ₹1 means they are checking if your account is live. A ₹1 payment request from an unknown contact is often a precursor to fraud — they confirm the account is active, then send a larger fraud attempt.
Receiving money never requires your PIN. You only enter your PIN when you are sending. If you are being asked to enter your PIN to receive a payment, you are about to send money, not receive it.
---
What You Can Do Today
- Enable two-step verification right now — Settings → Account → Two-Step Verification → Enable
- Check linked devices — Settings → Linked Devices → log out anything unfamiliar
- Change Groups privacy to "My Contacts" — Settings → Privacy → Groups → My Contacts
- Change Profile Photo to "My Contacts" — Settings → Privacy → Profile Photo → My Contacts
- Establish a family code word for emergency situations — share it only with your immediate family in person
- Bookmark factcheck.pib.gov.in on your phone browser for quick fact-checking
- Do not forward anything until you have spent 60 seconds checking it
Sources
- WhatsApp Privacy and Security documentation (WhatsApp.com/privacy)
- Indian Cyber Crime Coordination Centre (I4C) — Annual Cyber Crime Report 2024
- Ministry of Home Affairs — Cyber Dost advisories, 2024-25
- Reuters Institute Digital News Report — India section, 2024
- Press Information Bureau (PIB) Fact Check — factcheck.pib.gov.in
- National Cyber Crime Reporting Portal — cybercrime.gov.in
