A code, a click, a hack: Inside the WhatsApp fraud that trapped Kannada actors Upendra and Priyanka
In this week’s edition of The Safe Side, we explain how a fake delivery scam exposed the WhatsApp accounts of actor Upendra and his wife Priyanka, and how you can stay safe.
Hackers can easily break into your WhatsApp account, and one of the most common tricks today involves delivery scams. Actor-director Upendra, known as Real Star, and his wife Priyanka recently fell prey to one such fraud.
Priyanka received a call from someone posing as a delivery agent from Dubai, who claimed her package could not be delivered. She was asked to dial a code. Though hesitant, she complied — her phone froze soon after. She forwarded the link to her husband, and once Upendra clicked it, his phone, too, stopped working.
Within minutes, messages from Priyanka’s WhatsApp began reaching friends and family, pleading for urgent money. Some even responded, believing the couple was in trouble. Calls to their numbers were diverted, keeping them unaware. Realising they had been hacked, the couple contacted the cyber helpline 1930 and police, later issuing a warning on social media. Priyanka also revealed that fraudsters used AI to mimic her voice.
Cyber experts say these scams rely less on technical loopholes and more on human manipulation. “With continuous technological advancement, cybercriminals are no longer relying solely on technical loopholes; now they are constantly tapping human behaviour and scamming people,” said Srinivas L, executive director, 63 SATS Cybertech.
Niharika Tyagi, cybersecurity researcher at Webhack Solutions Pvt Ltd, explained: “Earlier, we only got calls from delivery boys to receive orders. Now, fraudsters exploit that habit. They use breached customer data, pose as delivery executives or support staff, and then trick victims into merging calls. At the same time, they trigger a WhatsApp linking code request. Once the victim unknowingly merges the call, scammers capture the code and gain full access to WhatsApp and its data.”
Amit Relan, CEO and co-founder of mFilterIt, said, “What we are witnessing is not low-level cybercrime, but the professionalisation of fraud. Fake delivery calls, malicious links, and AI-driven voice cloning are no longer isolated tactics — they are part of a well-orchestrated playbook designed to exploit trust at scale. Once a WhatsApp account is compromised, it doesn’t just endanger one individual, it weaponises their entire network. Cybersecurity today is a collective responsibility — and ignoring that reality will only widen the advantage fraudsters already hold.”
How do these scams work?
Tyagi explained how these scams work.
Story continues below this ad
These are just tricks: Scammers fool potential victims into merging calls or sharing OTPs instead of directly hacking.
Account takeover: With the code, they register your WhatsApp on their own device.
Impersonation: Once inside the account, scammers send fake urgent messages to the victim’s contacts.
Timing the attack: They often act when the victim is asleep or busy, so one can’t stop them quickly and the damage is already done.
Story continues below this ad
How to stay safe
Tyagi also shared tips on how to stay safe from such frauds. Don’t trust or answer unknown calls; verify with caller ID apps. – Never merge calls when asked by strangers. – Regularly check and log out of unknown devices linked to your WhatsApp. – Never share OTPs with anyone. – Enable two-step verification on WhatsApp. – Treat unusual calls or messages with doubt, and always confirm the source.
Some cybersecurity firms have launched tools to help. “To address rising cyber threats, 63SATS Cybertech has launched CYBX, a mobile app focused on security. It offers private, encrypted calls, real-time phishing checks, QR code verification, and even cybersecurity insurance for financial cover in case of fraud,” Srinivas said.
What does Meta suggest?
A Meta spokesperson told indianexpress.com: “We strongly advise people never to click on links from unknown numbers or share personal details, including their six-digit PIN code, with anyone, not even friends or family.”
On WhatsApp, the spokesperson recommended turning the two-step verification on for added security, silencing unknown callers to filter out spam, blocking and reporting suspicious accounts, and frequent privacy checkups to update who can contact you and who can see your personal details.
Story continues below this ad
The company also runs public awareness campaigns like Scams se Bacho and is part of the Safer Internet India coalition to tackle cybercrime, the Meta Spokesperson said.
What to do if you fall victim
If money is lost, report at https://cybercrime.gov.in or dial 1930 and keep details of the transaction ready to be reported. Also, visit the nearest police station to file a cyber complaint.
Ankita Deshkar is a Deputy Copy Editor and a dedicated fact-checker at The Indian Express. Based in Maharashtra, she specializes in bridging the gap between technical complexity and public understanding. With a deep focus on Cyber Law, Information Technology, and Public Safety, she leads "The Safe Side" series, where she deconstructs emerging digital threats and financial scams. Ankita is also a certified trainer for the Google News Initiative (GNI) India Training Network, specializing in online verification and the fight against misinformation. She is also an AI trainer with ADiRA (AI for Digital Readiness and Advancement)
Professional Background & Expertise
Role: Fact-checker & Deputy Copy Editor, The Indian Express
Experience: Started working in 2016
Ankita brings a unique multidisciplinary background to her journalism, combining engineering logic with mass communication expertise. Her work often intersects regional governance, wildlife conservation, and digital rights, making her a leading voice on issues affecting Central India, particularly the Vidarbha region.
Key focus areas include:
Fact-Checking & Verification: As a GNI-certified trainer, she conducts workshops on debunking deepfakes, verifying viral claims, and using OSINT (Open Source Intelligence) tools.
Cyber Law & IT: With postgraduate specialization in Cyber Law, she decodes the legalities of data privacy, digital fraud, and the evolving landscape of intellectual property rights.
Public Safety & Health: Through her "The Safe Side" column, she provides actionable intelligence on avoiding "juice jacking," "e-SIM scams," and digital extortion.
Regional Reporting: She provides on-ground coverage of high-stakes issues in Maharashtra, from Maoist surrenders in Gadchiroli to critical healthcare updates and wildlife-human conflict in Nagpur.
Education & Credentials
Ankita is currently pursuing her PhD in Mass Communication and Journalism, focusing on the non-verbal communication through Indian classical dance forms. Her academic foundation includes:
MA in Mass Communication (RTM Nagpur University)
Bachelors in Electrical Engineering (RTM Nagpur University)
Post Graduate Diploma (PGTD) in Cyber Law and Information Technology
Specialization in Intellectual Property Rights
Recent Notable Coverage
Ankita’s reportage is recognized for its investigative depth and emphasis on accountability:
Cyber Security: "Lost money to a scam? Act within the 'golden hour' or risk losing it all" — A deep dive into the critical window for freezing fraudulent transactions.
Public Health: "From deep coma to recovery: First fully recovered Coldrif patient discharged" — Investigating the aftermath of pharmaceutical toxins and the healthcare response.
Governance & Conflict: "Gadchiroli now looks like any normal city: SP Neelotpal" — An analysis of the socio-political shift in Maoist-affected regions.
Signature Beat
Ankita is best known for her ability to translate "technical jargon into human stories." Whether she is explaining how AI tools like MahaCrimeOS assist the police or exposing the dire conditions of wildlife transit centres, her writing serves as a bridge between specialized knowledge and everyday safety.
Contact & Follow
X (Twitter): @ankita_deshkar
Email: ankita.deshkar@indianexpress.com
... Read More
