Your phone buzzes. It is a WhatsApp message from a number you have never saved, saying a chunk of money has just left your bank account. A second line tells you to reply "NO" if you did not make the transaction.
Most of us would panic first and think later. That, according to Hyderabad's top cop, is exactly the point. Over the last few days the warning has been shared widely, and some versions of it have grown louder than the facts behind them. So here is a straight account of what was said, what holds up, and what does not.
What exactly did Commissioner Sajjanar say?
In a video posted on X on Monday, October 12, VC Sajjanar, the Hyderabad City Police Commissioner, described what he called a new kind of cybercrime. He said he had come across a case in which a chartered accountant was defrauded, and that the victim had not shared an OTP or tapped a suspicious link. According to the warning, the person only replied "NO" to a WhatsApp message.
He labelled the method an "auto-execution file attack" and said criminals could take control of the phone within seconds. His advice was simple. Do not reply to such messages, check your bank app directly to see whether any money was really deducted, and report fraud quickly on the national helpline.
Several outlets, including Business Today, Siasat and Digit, carried the warning within a day or two. One detail worth noting: I could not find a victim's name, an amount or an FIR number attached to the chartered accountant case in the coverage I went through. That does not mean it did not happen. It means the public record is thin.
How the alleged scam works, step by step
- A message arrives from an unknown or international WhatsApp number saying money has been debited from your account.
- A follow-up asks you to reply "NO" right away if you did not authorise it.
- The fear of losing money pushes you to respond before checking anything.
- According to the warning, replying exposes you to malware or further manipulation, and your phone and bank access are then at risk.
Steps one to three are classic social engineering, and anyone who has covered cyber fraud has seen the pattern before: fake account freezes, KYC threats, "police" calls. Step four is where things get shaky.
The claim that hasn't been proved
Technology outlet The420.in, which covers cybercrime, pointed out the gap quite plainly. Rare "zero-click" flaws have indeed hit messaging apps, WhatsApp included, in the past. But those attacks exploit a specific software bug. They do not depend on the victim typing a particular word, and no public technical analysis shows that sending the letters N and O to a normal WhatsApp account runs a malicious file or unlocks a banking app.
| Claim | Where it stands |
|---|---|
| Hyderabad Police issued a warning about fake WhatsApp debit alerts | Confirmed. Sajjanar's video message and multiple news reports. |
| Scammers use panic and urgency to get victims to respond | Consistent with well-documented fraud patterns. |
| A chartered accountant lost money to this method | Stated by the Commissioner. No victim details or amount published in the coverage reviewed. |
| Replying "NO" alone installs malware and drains the account | Not independently verified. No public technical evidence found. |
| Replying can invite follow-up attacks (links, APK files, calls) | Plausible and widely observed in similar scams. |
So why shouldn't you reply anyway?
Because a reply is useful to a scammer even if it does nothing technical. It tells them your number is live and that you react to fear. After that, the usual playbook follows: a "bank officer" calls, a link arrives to "reverse the transaction", or an attachment shows up, often an Android APK file, which is where real damage tends to happen.
Police have also cautioned against calling any number that appears inside such messages, since it may connect you straight to the fraudster.
My take: the warning is right, the headline is louder than the evidence
I have read a fair number of these advisories, and the ones that work best are the ones that tell people what to do, not just what to fear. This one gets the behaviour advice right. Don't reply, don't call back, check the app, report fast. If everyone followed those four lines, this scam, and most like it, would collapse.
Where I am uneasy is the dramatic framing circulating on social media, the idea that one two-letter word can wipe out a life's savings. It travels fast because it is scary and simple. But a half-explained threat can backfire. People who are told "replying NO empties your account" may either panic harder, or, when they find out the technical claim is shaky, dismiss the whole warning. Neither helps. The honest version is less dramatic and more useful: the message is fake, the pressure is the weapon, and the next thing the scammer sends is what you really need to avoid.
I would also like to see more detail from the police side on the chartered accountant case, such as how the phone was actually compromised. That kind of specific finding is what lets security researchers and banks confirm or correct a warning.
What to do right now if you get one of these messages
- Don't reply. No "YES", no "NO", no emoji.
- Don't tap links or open attachments. Never install an APK sent over chat.
- Check your bank yourself. Open the official app or net banking and look at the transaction history.
- Use a trusted number. If you need to call the bank, use the one printed on your card, passbook or official website.
- Block and report the sender inside WhatsApp.
- Never share your OTP, UPI PIN, passwords or net-banking details with anyone who messages you.
If money has already gone
Time matters. Call the national cybercrime helpline 1930 immediately and also file a complaint at cybercrime.gov.in. Sajjanar called the early window the "golden hour", because banks and authorities can sometimes freeze the receiving accounts before the money is moved around. Keep screenshots, the sender's number, chat history and your transaction details. Do not delete the chat.
Frequently asked questions
Is the WhatsApp "NO" scam real?
The police warning is real and fake debit-alert messages are a genuine fraud tactic. The specific claim that typing "NO" alone installs malware and drains an account has not been independently demonstrated.
What should I do if I get a WhatsApp message saying money was debited?
Do not reply and do not call any number in the message. Open your bank's official app or net banking yourself, block the sender, and contact your bank on the number printed on your card or passbook.
I already replied "NO". Am I hacked?
A reply on its own is not proof of a hack, but it tells the sender your number is active. Check your bank app, avoid anything that follows, block the number, and call 1930 if you see a transaction you did not make.
Which number do I call to report cyber fraud in India?
Call 1930, the national cybercrime helpline, as soon as possible, and file a complaint at cybercrime.gov.in.
Do banks send debit alerts on WhatsApp?
Some banks run verified WhatsApp services, but those come from the bank's own verified business account, not from an unknown or international number. A stranger asking you to reply is a red flag.
The bottom line
Treat any WhatsApp "your money has been debited" message from a stranger as bait. Whether or not a single reply can trigger malware, the message is built to rush you, and rushing is what costs people money. Pause, open your bank app, and let the facts come from there. If something has gone wrong, 1930 is the number to call, and the sooner the better.
This story is still developing. I will update this piece if Hyderabad Police release more technical detail on the case.
Sources
- The420.in: Hyderabad Police Warn Against WhatsApp Bank Alerts, But 'NO' Attack Claim Remains Unverified
- Business Today: One WhatsApp 'NO' could cost you your savings
- Siasat: WhatsApp message reply can wipe out savings, warns Sajjanar
- IBTimes India: How replying 'NO' to a fake bank debit message can put your money at risk
- Digit: WhatsApp scam alert: Replying No to a message can cost your entire life savings
Disclaimer: This article is for general information and is not financial or legal advice. If you suspect fraud, contact your bank and the 1930 helpline directly.