A message that is spreading virally via WhatsApp currently warns against helping strangers with a problem with their smartphone because criminals could allegedly steal a fingerprint, a recording of the voice and a picture of the face and immediately misuse it for loans. However, consumer advocates show that this is just a harmless WhatsApp chain letter.

WhatsApp chain letter: Warning about biometric theft is false

According to a fact check by the consumer protection portal “Mimikama”, there is no reliable evidence for the dramatic sequence of events described in the WhatsApp chain letter. And this despite the fact that, given today’s possibilities in the areas of deepfakes and identity fraud, it doesn’t sound all that unlikely, as there are certainly real risks.

How do you recognize the false message? Typical features are:

• strong call to forward: “One share means one less victim”
• Times for special drama: “30 minutes can ruin your life”
• Appeal to morality: “They just want your kindness”

The core of the message does not stand up to technical scrutiny. Modern smartphones store biometric data such as fingerprints or facial information locally and encrypted on the device. So if you briefly touch someone else’s smartphone, this data cannot be easily accessed or used directly for banking transactions.

In addition, biometric methods usually only replace a password or authorization that is already stored on your device. A single fingerprint is therefore of little use to criminals as long as they neither have access to the appropriate smartphone nor to accounts or other personal data. The instant fraud within 30 minutes described in the WhatsApp chain letter therefore seems greatly exaggerated.

Real risks lie more with recordings and social engineering

The warning only has a kernel of truth in one other place. If someone films you helping or records your voice, such recordings can generally be used later for deception. Deepfake calls or fake voice messages are conceivable, which fraudsters can then use to put pressure on other people.

However, short recordings alone are usually not enough for quick credit fraud. Digital lending processes typically require multiple checks, including identity matching, credit checks and additional confirmations. Classic social engineering is therefore more plausible than the alleged biometric theft.

However, it still makes sense not to give up your smartphone, to help unknown people carefully and to consistently use security functions such as two-factor authentication. The WhatsApp chain letter can at least attract more attention at this point, even if you should otherwise ignore it.