It took less than 30 minutes for a video of an alleged stabbing attack at a church in western Sydney to snake its way through WhatsApp groups across the city.

As chaos was still unfolding inside the Assyrian Christ the Good Shepherd church in Wakeley last Monday night, clips from the alleged attack – during a livestreamed memorial service where a 16-year-old boy allegedly stabbed Bishop Mar Mari Emmanuel – were being shared.

Then, quicker than most news outlets could report on the incident, large WhatsApp groups that connect people across western Sydney – some with more than 800 members – were inundated with forwarded videos, photos and voice notes. Some with inflammatory messages, some with pleas for calm and others that were plainly wrong.

Outside the church, the situation spiralled quickly. Police believe about 2,000 people descended on the scene, smashing police vehicles and injuring a number of officers. Police officers and paramedics say they were stuck in the church for more than three hours.

Police had been called to the church at 7.10pm. Guardian Australia has heard indirectly of how quickly the first video of the alleged attack captured on livestream spread; the earliest verified time stamp on WhatsApp is at 7.38pm.

While false claims about the Bondi Junction attack spread widely on public and quasi-public platforms such as X, Telegram and Facebook, the encrypted nature of WhatsApp makes it difficult to track exactly where forwarded content comes from.

But the way the information spread on the night of the Wakeley attack shows how WhatsApp can go from being a way to communicate between friends and neighbours to a rapidly moving broadcast platform for unfiltered, unmoderated and unverified content.

The initial spread

Fadi* is in several large WhatsApp groups and said he was receiving content and information “very quickly”.

“People were sending things almost as it was being shot and it [was] going around many groups. You couldn’t really filter it out because of the speed at which it was coming through.”

Messages alleging the church-goers were holding the attacker and preventing police from entering the church were being sent at 8.03pm. They also claimed the 16-year-old was “bashed” and that “they chopped his finger off” – which authorities later said was not the case.

Laila* said her son was urged to go to the church almost immediately after the attack.

“His phone was going crazy literally minutes after we received the first video, because some of his friends are Assyrian,” she said.

That claim is backed by videos that began spreading before 8.30pm, showing a large police presence at the church.

“We just kept receiving things all night, and my son’s work mates almost immediately said they were going down [to the church],” Laila said. “It was literally minutes after. It was so quick.”

She said she was receiving footage “much faster” than was being reported in the media.

Videos that were circulating at about 8.30pm show huge crowds gathering in the streets surrounding the church and a mob trying to enter.

Videos of violence began circulating soon after, with clips showing damaged police cars and violence near the church just after 9pm. In one video people can be heard urging the mob to “get in” as the person filming eats popcorn.

Videos shot before 9.30pm feature a growing crowd that seems increasingly outraged, with one video showing people yelling “bring him out” and others show police standing guard around the church.

Rumours of backlash begin

Before 9pm on the night, rumours began circulating on the nature of the attack, and of alleged plans for retaliation against Muslim places of worship.

At 8.48pm, videos of a string of police vehicles parked on a street were being shared, alongside a message saying “this is at a masjid” and “I think they went to the local mosque” without any further details.

Such claims grew in number as the night wore on, with some spreading voice notes that expressed shock and anger that any mosques could be targeted in retaliatory attacks.

Fadi said what stood out to him throughout the night was the breadth of unverified claims that were flooding his group chats.

“The number of different theories and opinions people had about what was happening, none of them verified, was overwhelming,” he said. “Sometimes we would get the same picture or video, with different stories attached to them.”

In one voice note Guardian Australia has heard, prior to 9.23pm, a man can be heard saying he was “ready for jihad” and that he would “go down to anywhere”.

Only 10 minutes later, another voice note from an unknown man called for people to not “shy away from what needs to be done, but at the same time we don’t jump the gun and assume and run off emotion”.

“If they want to retaliate and go eye-for-an-eye, so be it,” he says in both English and Arabic. “We know that among the believers are men. Go be near your local mosque if you can.

“Let the facts come out.”

Earlier, at 8.03pm, a rumour was being spread that a firebombing threat had been issued against a mosque.

But those who heeded the calls and went to their local mosques found little to report.

In a video that was being forwarded just after 10pm, a man says he is at Green Valley mosque and that “there is nothing”.

“Please, stop spreading fake news,” he says.

The alleged attacker

Videos and photos that showed the face of the alleged attacker also spread quickly.

Other voice notes later in the evening were shared by people who claimed they knew the alleged attacker and described him as being “poisoned”.

By 9.25pm, a wrong name that had been circulating linked to the alleged attacker was also being debunked via a screenshot of an apparent Facebook post where a man denied it was him.

Later that night, claims circulated about the alleged attacker’s age, his high school and that he was Muslim.

Laila said there were many rumours that circulated very quickly, including that the alleged attacker had previously been in jail, or that he was “an Assyrian before, and turned to Islam”.

“My son was reading and sending screenshots of messages he was getting, and there was just lots of stories being spread,” she said.

“I was not coping with the anxiety in my house that night. I couldn’t sleep.”

‘A type of virality’

WhatsApp is a key platform for many groups, including diaspora communities and neighbourhoods, to share news and information. But while the platform is often characterised as a private messaging app, that’s not always accurate.

WhatsApp group sizes can reach up to 1,024 members, and its channel function lets organisations broadcast content to multiple followers.

“Despite WhatsApp not having algorithmic curation … which happens on Twitter and Facebook, content can still be made highly visible to many people at one time by that content being forwarded rapidly between groups,” said Amelia Johns, an associate professor at the University of Technology Sydney who has studied the app’s use globally.

“That creates a type of virality that’s more organic and user driven.”

Laila said she was getting all of her updates from WhatsApp, where information was being shared “much faster” than anywhere else.

“We were at least an hour ahead of anyone else reporting on it. And it was mostly coming from group chats.

“The amount of messages were making me very, very nervous. Eventually I just refused to open any of them any more.”

Fadi said the amount of misinformation being shared was “dangerous” and led to the escalation on the night, and community leaders have called “for increased vigilance and security measures” to protect religious institutions.

WhatsApp, which is owned by Meta, limits the number of times a message can be forwarded to five chats at a time as part of efforts to “slow down the spread of rumors, viral messages, and fake news”. If a message has been forwarded through five or more chats, it is also labelled as “forwarded many times”.

WhatsApp messages are encrypted, which means they can’t be read by people outside the groups where they’re shared.

Meta did not comment on whether it had received any requests from New South Wales police regarding WhatsApp data linked to the attack or its aftermath.

“We regularly cooperate with law enforcement and comply with government requests in accordance with applicable law and our terms of service,” a spokesperson said.

* Names have been changed for privacy and safety