Can replying “NO” to a WhatsApp bank alert trigger malware and empty your account? Here’s what the reported cases show, how banking malware works and what remains unproven.
You may have seen posts and reels warning that replying “NO” to a WhatsApp message can hack your phone and wipe out your bank account.
Hyderabad Police Commissioner V. C. Sajjanar shared a similar warning at a press conference and on Facebook.
The message described in the warning looks like a bank alert. It claims money has been debited from your account and asks you to reply “NO” if you did not make the transaction. According to media reports, a chartered accountant lost money after replying ‘no’, despite apparently not sharing an OTP or clicking a link.
The explanation circulating online is that the reply activates hidden malware, allowing hackers to take control of the phone and steal money. But an ordinary WhatsApp text reply does not normally install an app or execute a hidden file.
The reported loss deserves investigation, but it does not establish that typing “NO” caused the fraud.
What happens when you reply “NO”?
When you send “NO” on WhatsApp, you send a text message to another account. There is no known, established mechanism by which those two letters alone automatically install malware on an Android phone.
We found no security advisory or technical report demonstrating that this particular reply triggers the kind of attack described in the viral warning.
A reply can still help a scammer. It confirms that someone is using the number and is willing to engage. The scammer may follow up with more messages or a phone call, pretend to represent the bank and try to persuade the person to reveal sensitive information or install an app.
This is similar to wrong-number text scams, where scammers use a response to start a conversation with a potential target.
Banking malware scams often involve a more direct route into the victim’s phone. The scammer may persuade someone to download a malicious Android application, known as an APK, or grant an app permissions that expose sensitive information.
For example, a woman in Mumbai reportedly lost ₹13.20 lakh after installing a malicious APK sent through WhatsApp under the pretext of updating her Union Bank Aadhaar details.
In another case, fraudsters posing as an SBI official sent a WhatsApp link that supposedly contained a cheque image. The victim downloaded the file, which reportedly installed an APK, and more than ₹10 lakh was lost.
In August 2026, Ministry of Home Affairs warned about a campaign targeting professionals and corporate finance teams. Attackers circulated malicious ZIP files disguised as account statements or regulatory communications. When victims extracted and opened the malicious Windows files, malware could compromise their computers and hijack active WhatsApp Web sessions.
These cases describe a route through which malware can reach a phone. They do not establish that replying to a text message can activate malware without any further action or software vulnerability.
To support that claim, we need to identify the code involved, explain how it ran and show how it gained access to the device or banking information.
Zero-click attacks are real. Is this one?
Yes, attackers can sometimes compromise a device without asking the victim to click a link or install an app. These are known as zero-click attacks. They exploit vulnerabilities in software that processes incoming messages or other content.
In February 2025, WhatsApp said it had disrupted a spyware campaign involving Paragon Solutions that targeted around 90 journalists and members of civil society. The reported campaign used a zero-click attack, meaning victims did not need to click anything for the exploit to work. The same report also referred to Meta’s legal action against NSO Group over the use of Pegasus spyware to target WhatsApp users in 2019.
These cases show that some attacks can work without a victim’s interaction. They do not show that sending the word “NO” triggers an exploit. A zero-click attack depends on a technical vulnerability and a way to exploit it. The existence of such attacks is not evidence that the mechanism described in this particular warning works.
What do we know about the reported losses?
If someone loses money after replying “NO”, police need to establish what happened between the reply and the unauthorised transaction. The scammer may have followed up with a call, persuaded the victim to install an app or gained access to sensitive information through another route. An already compromised device or account could also be relevant. These are possibilities, not confirmed explanations for the reported case.
A victim’s account of what they did or did not click is useful evidence. To establish how the fraud occurred, investigators would also need to examine available device records, banking transactions and evidence of unauthorised access or malware.
Banks have separately warned customers about fake debit alerts that ask them to reply “YES” or “NO”. Jammu and Kashmir Bank cautioned customers against such messages and advised them not to treat them as legitimate transaction confirmations. That warning supports the need to be careful with fake bank alerts. It does not, by itself, establish that replying installs malware.
How to protect your bank account
If you receive an unexpected message claiming money has been debited, check your account through your bank’s official app or internet banking service. Do not use a link or phone number supplied in the message. If you need help, contact the bank using a number printed on your bank card or passbook, or one listed on its official website.
Never install an APK received through WhatsApp or SMS because a sender claims it will update your KYC, secure your account or reverse a transaction. Be wary of requests to enable Accessibility permissions, share your screen or reveal an OTP. Keep your phone and apps updated, and review permissions granted to unfamiliar applications.
If you have already replied “NO”, that alone does not mean your phone has been hacked. Block and report the sender, check your account and watch out for follow-up calls or messages. If you find an unauthorised transaction, contact your bank immediately. In India, you can report financial cyber fraud by calling 1930 or using the National Cyber Crime Reporting Portal.
Treat unsolicited WhatsApp bank alerts as suspicious and verify transactions independently. The available evidence supports the risk of follow-up scams and malware delivered through deceptive links or apps. It does not establish that replying “NO” by itself activates hidden malware and empties a bank account.
