The uncomfortable truth is that your family does not need another forwarded collage of scam screenshots. It needs a reflex that still works when a message says your child is stranded, your sibling needs money, or your boss wants a transfer before lunch.
The Ministry of Home Affairs has warned that compromised WhatsApp accounts can be used to issue urgent transfer instructions. That means a familiar profile is not proof. The useful question is not whether the message looks real; it is whether your family knows what to do before fear takes over.
Run this drill when everyone is calm. You are building one boring habit: stop, leave the conversation, and call back using contact details you already had. Boring is excellent. Nobody has ever regretted making a suspicious payment request wait while an uncle searches his contacts with the concentration of a bomb-disposal expert.
The rule: leave the chat and call back
Write this sentence in the family group: No money, code, document or account change happens from a message alone. If a request feels urgent, the recipient stops replying, opens the phone app or another trusted channel, and contacts the supposed sender using a number already saved before the request arrived.
WhatsApp’s own safety advice is to pause, question and verify, then contact the supposed friend or relative directly through another communication method. In guidance aimed at corporate entities and finance teams, India’s I4C recommends a direct voice call or in-person confirmation before acting on an urgent transfer request received over WhatsApp or email. Your house rule turns that advice into a repeatable move.
The callback must be independent. Do not tap a number inside the suspicious message. Do not accept “my old phone is broken, call this new number”. Do not let the sender arrange the verification. Open the contact you already know, call a second relative, or ask a question whose answer cannot be collected from a public profile.
A family password sounds clever but can become one more secret people forget or casually type into chat. A callback is easier to remember and harder for a text-only impersonator to control. If the real person cannot be reached, the request waits. Urgency belongs to the requester; verification belongs to you.
Run the five-minute drill
Choose one organiser and one participant. The participant should be someone who actually handles family payments or paperwork, not the cousin who treats every unknown number like a personal insult. Tell them this is a rehearsal, but do not reveal the exact script.
- Minute one: the organiser sends a short message from their normal account: “I am stuck and need you to transfer money now. I cannot talk.” Keep it believable, not theatrical. The point is to create a small jolt, not frighten anyone.
- Minute two: the participant says nothing useful in the chat. No confirmation of bank details, no family names, no explanation of who is home. They stop and move out of the conversation.
- Minute three: the participant calls the organiser on the saved number. If that call fails, they call a second trusted person who can reach the organiser. They do not call a replacement number supplied by the message.
- Minute four: the participant states the rule aloud: “I will not send money or share a code until I verify this request outside the chat.” Saying it matters because a rehearsed sentence is easier to retrieve under pressure than a vague warning.
- Minute five: the family reviews what caused hesitation. Was it the familiar profile photo, the urgent language, fear of seeming unhelpful, or the amount requested? Fix the weak point in the rule, then save the reporting steps in an easy place.
Pass the drill only when the participant initiates the callback independently. Spotting awkward grammar is not a pass. Neither is asking the suspicious sender to prove who they are inside the same conversation. The safe action is a channel change that the requester does not control.
Test the excuses that usually break the rule
A drill that works only with an obvious stranger teaches almost nothing. Repeat it later with a different pressure point. Use an urgent medical story, a relative claiming to have a new number, a request from a known account, or an instruction that sounds like routine office work. Keep every scenario fictional and avoid naming a real hospital, bank or police officer.
Then practise the replies. “I cannot talk” gets: “That is fine; I will verify through someone nearby.” “Do not tell anyone” gets: “I do not keep financial requests secret.” “The payment must happen now” gets: “Then the payment will wait.” Your family is allowed to be briefly inconvenient. That is cheaper than being permanently polite.
Add a second rule for one-time codes and screen prompts: nobody reads out a code, approves an unexpected request, or shares a screen because a caller claims to be helping. You do not need to diagnose the trick. Stop the interaction and contact the organisation through its official app, statement or website.
For older relatives, make the escape route physical. Put two trusted callback names near the charging spot and pin the family group. For children or teenagers, remove the money language and use a fake request for a photo, document or login code. The behaviour stays the same: stop, tell a trusted person, and verify elsewhere.
Do not turn the debrief into a lecture. Ask, “What made this feel real?” and listen. Shame makes people hide near-misses; a calm review makes them report the next one sooner. The goal is not to crown the family’s smartest scam detective. It is to make asking for help normal.
Harden the route around the drill
The callback rule is the core, but it needs clean contact details. Check that parents and grandparents have the current numbers for two relatives. Rename duplicate contacts. Remove obsolete numbers. Decide who can verify a request when the usual family organiser is travelling, asleep or unavailable.
The same I4C advisory says to review WhatsApp’s Settings > Linked Devices and log out of web sessions that are no longer in use. Do that together after the drill. Treat an unfamiliar linked device as a reason to secure the account, not as a puzzle to solve in the family group. For the wider policy backdrop, see TechDodo’s guide to SIM binding and caller ID.
Agree on a money boundary as well. Any unexpected request for a transfer, account change or financial document gets a callback, even when the amount looks small or the sender sounds annoyed. The rule applies to parents, adult children, domestic staff and work contacts. Status does not replace verification.
Finally, decide how the family will warn everyone if one account is taken over. Use a normal phone call, SMS or another already-agreed channel. Keep the warning short: the account may be compromised; do not open files, send money or trust new instructions from it until the owner confirms recovery.
If somebody already acted
Stop the blame and switch to containment. If money has moved, contact the bank or payment provider immediately, then report the fraud. The official Indian guidance says cyber frauds and suspicious communications should be reported immediately through the National Cyber Crime Helpline at 1930 or the National Cyber Crime Reporting Portal at cybercrime.gov.in.
Preserve the chat, transaction reference, phone number and relevant screenshots. Do not keep negotiating with the sender to “get the money back”. If a WhatsApp account is compromised, I4C advises logging out of linked devices, warning contacts not to open files received from that account, and scanning the affected computer with updated anti-virus software.
After the immediate response, run the drill again without drama. A near-miss exposes a weak handoff, an outdated contact or a rule nobody remembered. Repair that specific gap. Forwarding another scary example may feel productive, but rehearsal is what gives your family a move it can actually use.
What to actually do
- Post the callback rule in your family group today.
- Run one five-minute scenario with the person who handles payments.
- Save two trusted callback contacts on every family phone.
- Review linked devices and remove sessions nobody recognises or uses.
- Save 1930 and cybercrime.gov.in with the family’s emergency notes.