Dear WeCom users:
To ensure the security of your company and account, we strongly advise against using any unauthorized add-on functions for WeCom.
I. Risks Involved
1. Information leakage: Add-ons may secretly access all information of your company and employees, including organizational structure, chat history, emails, documents, etc. The use of add-ons increases the risk of information theft or leakage, jeopardize your company and employee information.
2. Impact on customer experience: Multi-account login or unlimited broadcast messages enabled by add-ons can adversely impact service quality and customer experience, and may even lead to customer harassment, loss of followers/group members, customer churn, and brand reputation damage.
3. Violation of laws and regulations: The use of add-ons may violate relevant laws or regulations due to infringement upon individual privacy and data theft. This could expose your company to legal disputes and liabilities.
4. Virus and malware attacks: Add-ons may contain viruses, malware, or malicious code, which could damage your devices or lead to hacker attacks.
Given these serious risks, the WeCom platform may block accounts found to be using unauthorized add-ons, in order to protect the legitimate rights and interests of companies and customers.
II. Common Add-on Functions and Self-check Methods
1. Multi-account operation or use multiple WeCom accounts on one device
Application Scenarios:
● Some companies assign one employee to operate multiple WeCom accounts on the same device to maintain customer relationships. This can reduce manpower but may also hamper the customer communication experience and service quality.
●Some third-party add-on tools provide functions to aggregate multiple WeCom accounts (see the figure below). This requires scanning a QR code to host the WeCom accounts on the add-on tool, which takes the accounts off the official WeCom client and compromises account security.
Self-check methods:
●Check if there are multiple WeCom icons on the computer taskbar.
●Check if you have modified the registry to run multiple instances of WeCom.
●Check if you have downloaded third-party multi-account tools like Process Explorer or other “WeCom Multi-Account Assistants”.
●Check if you have installed any programs or browser extensions that can manage multiple WeCom accounts simultaneously.
●Check if any teams or members in your company are using third-party tools for the purposes described above.
2. Auto message broadcasting and scheduled sending
Application Scenarios:
●To avoid disturbing users, WeCom has restrictions on the daily limit of broadcast messages that can be sent to customers. Some companies use unauthorized third-party add-on tools to send an excessive number of product promotion messages to the target customer groups or frequently send scheduled messages to customers, which can seriously impact the user experience.
●The following figures show how a common third-party add-on tool provides functions like unlimited broadcasting in private chats, unlimited broadcasting in group chats, and unlimited scheduled broadcasting.
○Unlimited broadcasting in private chats
○Unlimited broadcasting in group chats
○Unlimited scheduled broadcasting
Self-check methods:
●The official WeCom broadcasting feature requires manual confirmation before broadcasting. If there is no such manual process, it is likely that an unauthorized add-on tool is being used.
●Any third-party tools claiming to enable “unlimited broadcasting” or exceed the official broadcasting limit are considered add-ons.
●Check if you are using the WeCom app and have authorized login on non-official WeCom websites.
●Check if any teams or members in your company are using third-party tools for the purposes described above.
3. Unauthorized auto reply function
Application Scenarios:
●Some companies, not caring about the accuracy of replies and also not prioritizing user privacy protection, overly rely on auto reply add-on capabilities, which impacts the customer experience. For example:
① Automatically answering users’ frequently asked questions;
② Automatically guiding customers to provide information for calculations and output, such as insurance quote or logistics tracking;
③ Automatically providing marketing campaign information to engage customers;
④ Automatically notifying customers of service hours outside of work time.
●The following figures shows how a common third-party add-on tool automatically replies when message keywords are matched.
Self-check methods:
●Currently, WeCom only allows setting auto replies for customer groups. Any auto replies that are not configured in the official admin console or auto replies outside of customer groups are considered unauthorized add-on capabilities.
●Check if you are using the WeCom app and have authorized login on non-official WeCom websites.
●Check if any teams or members in your company are using third-party tools for the purposes described above.
●If you want to learn how to properly set up authorized auto replies for customer groups, you can refer to: “How to configure auto replies for WeCom customer groups”.
4. Using unauthorized functionality to obtain, monitor, and store account or company data
Application Scenarios:
●Some companies, in an effort to save costs, disregard the data privacy and security issues of the company and users. They use third-party add-on capabilities to collect and analyze customer data for personalized services, as well as monitor employee account activities, chat records, files, and other data content.
●The following figures show how a common third-party add-on tool downloads all WeCom chat content.
Self-check methods:
●Check if any chat history backup or monitoring tools have been installed.
●Check if you are using the WeCom app and have authorized login on non-official WeCom websites.
●Check if any teams or members in your company are using third-party tools for the purposes described above.
●WeCom provides the feature “Company Data Archiving”. For details, please refer to the document: What is “Company Data Archiving”.
5. Mass Posting to Customer Moments
Application Scenarios:
●The Customer Moments feature in WeCom is similar to “Moments” in WeChat. It allows employees to manually post content to improve brand exposure, customer engagement, and interactions. However, some companies have misused this feature by leveraging third-party add-on tools to automatically post product updates, promotional activities, and even automatically like, comment, and reply to posts. This can result in harassment and significantly impact the customer experience.
●The following figures show how a common third-party add-on tool implement the functionality of automatically posting to customer Moments, with options for immediate or scheduled posting, as well as automatic liking, commenting, and replying.
Self-check methods:
●The official WeCom Moments feature requires manual confirmation before posting. If there is no such manual process, it is likely that an unauthorized add-on tool is being used.
●Check if you are using the WeCom app and have authorized login on non-official WeCom websites.
●Check if you are using any third-party add-on tools.
6. Other unauthorized add-on functionalities
●Unauthorized mass group invitations:
WeCom does not provide external automated or batch group creation/invitation APIs. Some companies use third-party add-on tools to automatically add external customers into group chats, and then proceed to send advertisements or promotional messages, which seriously disturbs users.
●Unauthorized auto mass friending:
WeCom does not provide automated or batch capabilities to proactively add contacts as friends. Some companies use add-on tools to quickly add potential customers as friends, in order to send them advertisements or promotional information. This can be done by uploading phone numbers from an Excel sheet, and having the hosted WeCom account automatically send friend requests based on the phone numbers. Or they may select specific groups, and have the hosted WeCom account automatically send friend requests to the group members.
III. How to Use WeCom Properly
●Download and update the WeCom app only from the official WeCom website or other legitimate app stores.
●Strictly adhere to the official WeCom terms of use. Do not use any unauthorized third-party software or functionalities.
●If you encounter any issues, refer to the official WeCom Help Center or contact the official WeCom Customer Service for assistance.
●If you discover during your self-check that you have been using unauthorized add-ons, or are unsure how to deal with such add-ons, promptly contact the official WeCom Customer Service for assistance.