No WhatsApp, no clients: what is happening with business accounts in Kosovo?

Losing access to WhatsApp accounts has caused concern among several business owners in Kosovo, raising the alarm over the possible misuse of sensitive content inside them. The causes remain unclear, while institutions have not disclosed the extent of the phenomenon or concrete steps to stop it.

On the morning of September 5, Vellaznim Kryeziu from Pristina opened the WhatsApp application to check his conversations with his clients, as he usually does.

Kryeziu is the owner of a real-estate company in Pristina and used the application to communicate with hundreds of clients, to whom he sent offers, videos and information about properties.

For a few minutes, he says, he received several codes and notifications that appeared to be about an application update, which he clicked on. Afterwards, he lost access to the account — along with it, a network of contacts built up over years.

As he was not receiving messages from clients, even though he had publicly announced the loss of access, he says his relations with clients were damaged.

He tells Radio Free Europe that he found it impossible to open the account on another phone and has written repeatedly to WhatsApp’s support service, but has still not regained access. In the meantime, he has taken a new number.

His experience is not isolated.

Arber Abazi, who runs a business in the quarrying field, says that for two to three weeks he had received notifications about attempts by someone else to activate his WhatsApp account. Afterwards, his account was blocked. According to him, after a request for review, he was allowed to reactivate it, but when he tried to log in, it was blocked again.

Abazi also used WhatsApp to communicate with supplier companies from abroad. He is also worried about possible misuse of the content exchanged there.

“Because there were invoices there, various documents,” he says.

However, Abazi says he is not aware that anyone has used his account to write to his contacts or to commit any misuse.

He is awaiting the review of his direct complaint to the platform’s WhatsApp consumer-care service.

In recent weeks, concerns have grown over blocked access to WhatsApp accounts, mainly business ones.

Cybersecurity expert Korab Keqekolla says the reports he and his colleagues have received about such cases began around two to three months ago, initially for business accounts.

He personally says he has received over 100 messages from people asking for help to recover their accounts.

He adds that his colleagues within the Kosovo Open Source Intelligence community (KOSINT) report at least hundreds of other cases. KOSINT is an organisation that brings together open-source intelligence enthusiasts, including cybersecurity experts.

However, so far there are no official data on how many accounts have been affected by this phenomenon.

The Regulatory Authority for Electronic and Postal Communications (ARKEP), the state institution that regulates and oversees the implementation of the law on electronic communications, has reacted to this phenomenon but has not provided official figures on the reports.

An official notice from the National Cyber Security Unit (KOS-CERT), which operates within ARKEP, said only that the reported cases concerning WhatsApp accounts are being analysed.

“(We are) making efforts to communicate with the relevant institutions, with the aim of addressing and resolving this issue,” the September 28 notice said, with no further details.

Radio Free Europe asked ARKEP for data on the number of reported cases, their nature and the results of the technical analysis, but by the time the article was published, it had received no response.

What is happening with WhatsApp accounts?

Keqekolla presents two hypotheses.

One of them says it may be misuse of the “SS7 protocol” in telephone networks. This code is a set of international telecommunications protocols used to exchange information and signals between elements of a telephone network.

As he explains, through this code, messages with verification codes can be redirected.

“This protocol is known globally to be open to misuse,” he says.

Two telephone operators operate in Kosovo: Vala, which is a state company, and IPKO, a private one.

Both operators have issued public calls sharing advice for consumers who use WhatsApp on how to prevent misuse of their accounts.

Vala told Radio Free Europe that it has received many complaints. However, the company claims the problem does not lie with their systems.

“Our systems are protected with advanced security technology. Nevertheless, we are aware that in our industry attempts at cyberattacks are continuous, so research and monitoring of our systems is ongoing,” Vala said.

IPKO, on the other hand, told Radio Free Europe that it had received 13 reports of WhatsApp problems from its clients. This company also says it has not identified any vulnerability or security incident within its systems.

Could the problem be with Meta?

The second hypothesis raised by Keqekolla together with colleagues in the community is that there is a problem in the identity verification process for users on the platform of Meta, the company that owns WhatsApp.

However, he stresses that without concrete technical data, “we can only raise hypotheses about this problem”.

Keqekolla says that in some cases he has noticed the use of the Indonesian language in emails confirming accounts. He sees this as a possible indicator of a link with actors who, according to him, have previously carried out fraudulent campaigns against users in Kosovo.

However, the use of this language still does not prove the origin or location of the attackers.

Radio Free Europe has also contacted the company Meta about the blocking of WhatsApp accounts. By the time this article was published, it had received no response.

Institutions, operators and cybersecurity experts have consistently recommended activating two-step verification on WhatsApp accounts and that businesses also have other channels of communication with clients.

For Vellaznim Kryeziu, besides recovering the account and the contacts, it remains important to understand what happened.

“(Someone should) give me the reason, so I don’t make the same mistake, because I have bought another number, but so I don’t make the same mistake, so I don’t lose the clients again,” he says. /REL