WhatsApp and PayPal warnings: check what the next action authorises

The brief

Switzerland’s NCSC warned on 27 October about WhatsApp takeovers using fake competition requests from compromised contacts. PayPal Hong Kong warned on 30 October about phishing SMS messages falsely using its name. NCSC warning; PayPal statement.

Our analysis asks a practical question: what will the requested action actually permit? A message may describe a vote, a check or an account update while directing the recipient towards account access. A familiar name does not answer that question. For professional instructions, separate recognition of the contact from confirmation of the action. If a message unexpectedly asks for a code, device link, credential or payment, verify the purpose through a route established independently of that message.

The full record

The NCSC described two paths: obtaining a WhatsApp registration code, or persuading the recipient to link an attacker’s device through a QR code. In the second case, the owner may retain access. Its “more than 50” figure concerns reports received during October as of the 27 October publication; it is not a final monthly total. NCSC’s account and response guidance.

PayPal said the Hong Kong phishing SMS messages were unrelated to the company. It identified its registered sender ID as #PayPal and advised against providing credentials or verification codes in response to unsolicited requests. The HKMA separately relayed the warning. PayPal’s statement; HKMA notice.

Our analysis: read the permission, not just the explanation

A professional receiving an unexpected request needs to identify the consequence of the next step. Will it reveal a secret, authorise another device, alter a payment destination or disclose a file? Write the instruction in those terms before deciding whether the action fits the stated purpose.

Consider a hypothetical colleague asking for help with an urgent vote. The relevant question is why that vote would require an account registration code or device access. In a client matter, apply the same reasoning to a sudden request to upload identity documents or approve a new destination. The familiar conversation history can provide context, but it should not supply the missing authority.

Keep an independent recovery route

For sensitive professional exchanges, agree in advance how an unexpected instruction will be checked. That route should remain usable if the main messaging account is compromised. Document who can pause the instruction, who can confirm it and what evidence will be retained. Avoid making the disputed message itself the source of the recovery contact.

The NCSC advises checking unfamiliar linked devices and warning contacts through another channel after compromise. Its guidance distinguishes recovery after a QR-device link from recovery after a stolen registration code. Read the relevant recovery steps.

A useful desk exercise

Ask a team member to inspect a fictional message without acting on it. Have them identify the permission being requested and show how they would reach the purported sender independently. The result should be a clear decision and a short evidence trail. Speed is secondary to correctly understanding the action; this article reports no measured success rate.

Read the NCSC 27 October warning, PayPal Hong Kong’s 30 October statement and the HKMA relay. The cases concern different jurisdictions and mechanisms; their volumes are not combined. The NCSC figure is a partial-month reporting count. The professional-workflow examples are original editorial analysis, not evidence that these specific attacks targeted professional clients.

1. NCSC: WhatsApp account takeovers, 27 October 2026
2. PayPal Hong Kong: phishing statement, 30 October 2026
3. HKMA: PayPal message warning, 30 October 2026