Messaging account takeover often starts with a social engineering message claiming your account is at risk, then asks for a PIN, a one time code or a QR scan. CISA's advice is to treat unexpected security alerts as suspicious, avoid unknown QR codes and invite links, and verify through another channel.
The pattern CISA describes
CISA's mobile communications guidance warns about threat actors who use social engineering to claim an account is compromised and then deceive the victim into taking actions that let the actors take control of it.
Its examples of what to avoid and do:
- Do not scan group invitation links or QR codes from unknown sources
- Verify the authenticity of group invitations by contacting the creator or administrator through a separate channel
- Stay suspicious of unexpected security alert messages, even inside the app itself, especially if the message requests authentication such as PINs or one time codes
- Report suspicious activity using the app's reporting mechanism
- Check the linked devices list and remove any you did not intend
Why this works on smart people
The message looks official and arrives in the same app you trust. It creates fear of loss and offers a quick fix. Attackers know executives are busy and used to approving things quickly.
A QR code adds a twist. Scanning it can link a new device to your account, so the attacker sees your chats. The code does not look dangerous, but it is a credential.
A five step routine
- Stop. A real security alert does not need an answer in the next minute.
- Do not share any code or PIN. No legitimate support person needs your one time code.
- Check from outside the message. Open the app yourself, look at settings and the linked devices list.
- Verify the sender by another route. If a colleague invited you to a group, call or email them.
- Report and delete. Use the app's report tool.
If you think you scanned something
- Open the linked devices list and remove anything unfamiliar.
- Reset your registration lock or PIN where the app has one.
- Tell the people in your important chats that your account may have been exposed.
- Treat any message from you in the next hours as possibly not you, and warn contacts.
- Follow our first hour steps for related accounts.
Add a verification word
Agree a private word with your assistant, spouse and a few close colleagues. If an odd request arrives from "you" on a new number or account, they ask for it. Our post on voice cloning and verification policy goes further.
For the whole team
Many of these attacks use the same script against staff. Tell them the pattern, give them a reporting route and do not punish people who report mistakes. Related: reporting culture.
Quick check
Should I trust a security alert that appears inside the app?
Be suspicious, especially if it asks for a PIN or one time code. CISA says to remain suspicious even inside the application itself.
Sources
Last reviewed: 19 October 2026.
