The Complete Guide to WhatsApp Scams: Every Warning Sign, Scam Type and Protection Method
How WhatsApp scams work, from stolen accounts and fake relatives to job and investment groups, the settings that protect you, and what to do if you are caught.
A message arrives from a friend you have not spoken to in months: "Hey! I accidentally sent a six-digit code to your number instead of mine. Can you forward it to me? It's urgent." A code has just arrived by text. It is your friend's number and your friend's photo. What could go wrong?
Everything, as it happens. That code is the key to your own WhatsApp account, and your friend's account was stolen an hour ago. Once you forward it, the scammer owns your account too, and starts messaging everyone you know.
WhatsApp scams work because WhatsApp is where we talk to the people we trust most. This guide covers how WhatsApp scams reach you, every common type, the warning signs, the settings that make your account much harder to steal, and exactly what to do if your account or your money is taken. It applies wherever you use WhatsApp, on Android, iPhone or the web.
Why scammers love WhatsApp
- It is where trust lives. Family groups, work chats and close friends all sit in one app, so a message there feels personal.
- Accounts are tied to phone numbers. Anyone with a number can message you, and a stolen account inherits all of its owner's contacts.
- Groups reach many people at once. One scam post in a busy group can reach hundreds of people.
- Only you can judge the message. End-to-end encryption protects your privacy, which also means nobody is screening the content for you. The decision is yours.
The underlying tricks are the same ones described in our complete guide to online scams. WhatsApp simply delivers them in a more personal wrapper.
How WhatsApp scams reach you
- Messages from unknown numbers, often friendly, sometimes pretending to have the wrong number.
- Messages from a contact whose account has been stolen. The name and photo are real; the person typing is not.
- Groups you were added to without asking, especially "investment", "jobs" or "giveaway" groups.
- Voice and video calls from unknown numbers, sometimes using recorded or faked audio and video.
- Links shared in chats and statuses that lead to fake websites, fake surveys or app downloads.
- Accounts pretending to be businesses, banks, delivery companies or customer support.
The most common WhatsApp scams
The verification code scam (account takeover)
A scammer tries to register your number on their phone, which makes WhatsApp text you a six-digit code. Then someone, often a friend's stolen account, asks you to forward "their" code. If you do, your account moves to the scammer's phone. WhatsApp's own advice is simple: never share your registration code with anyone.
"Hi Mum, this is my new number"
A message from an unknown number claims to be your child, parent or sibling who has lost or broken their phone. After a short chat comes an urgent request to pay a bill or transfer money. Our article how to tell if a WhatsApp message is a scam walks through this one in detail.
A friend's hacked account asking for money
Once an account is stolen, the scammer messages its contacts: a loan until tomorrow, an emergency, a "great investment", or a request to vote in a competition by forwarding a code. It feels safe because the name and history are real.
Job and task offers
A recruiter offers flexible remote work, paid tasks such as liking videos, or a high salary for simple work. Small early payments build trust before you are asked to deposit money to continue. See fake job offers.
Investment and trading groups
You are added to a group full of profit screenshots and enthusiastic members, many of them fake accounts. An "expert" or "assistant" offers to guide you. Our guide to financial scams explains how these schemes work and how to check a provider's licence.
The wrong-number friendship
"Hi, is this David? We met at the conference." When you say they have the wrong number, they apologise charmingly and keep chatting. Over days or weeks the friendship grows, and eventually turns to an investment opportunity or a request for money.
Fake customer support and businesses
Accounts pose as banks, mobile networks, airlines, delivery companies or WhatsApp itself, and ask for account details, codes or payments. WhatsApp support will not message you asking for your code or password.
Fake giveaways, surveys and "free data" links
Messages promise a prize, a voucher or free mobile data if you complete a survey and forward the message to your contacts. The link collects your details or leads to further scams, and the forwarding spreads it.
Linked device and QR code tricks
Someone asks you to scan a QR code, for example to "join a group" or "verify your account". Scanning a WhatsApp login QR code can link your account to their computer, giving them access to your chats. Only scan WhatsApp QR codes on devices you control.
Voice notes, video calls and deepfakes
Recorded or AI-generated voice notes can imitate someone you know, and video calls can be used to record you for blackmail. If a voice asks for money, call the person back on their usual number. Read deepfake voice calls for more on voice cloning.
Fake WhatsApp versions and "premium" features
Messages offer special versions of WhatsApp with extra features. These unofficial apps can contain malware and put your account at risk. Only install WhatsApp from the official app store for your phone.
Warning signs at a glance
| Warning sign | Example | What to do |
|---|---|---|
| Asked to forward a code | "I sent a code to your number by mistake" | Never share it. Tell your friend through another channel. |
| A new number for someone you know | "My phone broke, this is my new number" | Call their old number or ask something only they know |
| Money request by chat | "Can you pay this bill for me today?" | Confirm by a normal phone call first |
| Added to a group you did not join | A trading or jobs group with strangers | Leave, report and change group privacy |
| A QR code to scan | "Scan this to join" | Do not scan WhatsApp login codes for others |
| Wrong-number friendliness | "Sorry, wrong number! But nice to meet you" | Do not continue the chat. Block and report. |
| Prizes and forwarding | "Forward to 10 friends to claim" | Delete. Real prizes do not work this way. |
| Unofficial app versions | "Get WhatsApp Gold" | Install only from the official app store |
Illustrative examples, with the red flags explained
These examples are fictional and written for this guide. Links have been broken on purpose so they cannot be clicked.
- Codes are sent to the number being registered. It was your account being registered, not your friend's.
- Urgency and a trusted name.
- What to do: do not send the code. Call your friend to warn them that their account has been taken.
- A new number, an emotional hook, and money requested within minutes.
- A reason why they cannot pay themselves or talk on the phone.
- What to do: call your child's old number, or ask a question only they could answer, before doing anything.
hxxps://gps-vip-trade[.]net/join- You were added without asking, and the returns are unrealistic.
- A friendly "assistant" and a registration link outside any regulated platform.
- What to do: leave the group, report it, and check any investment provider with your country's regulator.
How to check if a WhatsApp message is a scam
- Pause before you reply. Most WhatsApp scams depend on a quick, emotional response.
- Verify the person on another channel. A normal phone call to a number you already have, a video call where you can see and question them, or a message to a mutual contact.
- Look at the account. Is it a new number? Does the profile photo match? Is there a business badge where there should be one?
- Never share codes, PINs or passwords, whatever the reason given.
- Check links before opening them. Press and hold to see the address, and prefer going to the official website yourself.
Get a second opinion. Copy the message or take a screenshot and paste or upload it into CyberWatch AI Scan. It is free, works in any language and explains what looks suspicious. Use it alongside a quick call to the person.
The settings that protect your account
A few minutes in WhatsApp's settings makes your account much harder to steal and much quieter for scammers. Menu names can vary slightly between Android, iPhone and app versions.
1. Turn on two-step verification
In Settings, then Account, then Two-step verification, set a PIN or password and add an email address. Anyone trying to register your number on a new phone then needs that PIN or password as well as the text code. It is the single most important setting.
2. Control who can add you to groups
In Settings, then Privacy, then Groups, choose My contacts or My contacts except. Strangers can then no longer drop you into scam groups.
3. Silence unknown callers
In Settings, then Privacy, then Calls, turn on Silence unknown callers. Calls from numbers not in your contacts will not ring, but will still appear in your Calls list.
4. Check your linked devices
In Settings, then Linked devices, look for any computer or browser you do not recognise and log it out.
5. Limit what strangers can see
In Settings, then Privacy, choose who can see your profile photo, About, last seen and online status. Scammers use photos and details to impersonate you or research you.
6. Block and report
Open the chat, tap the contact or group name, and choose Block and Report. Reporting sends WhatsApp recent messages from that chat so it can act against the account.
If your WhatsApp account has been stolen
- Re-register on your own phone. Open WhatsApp, verify your number and enter the new six-digit code. This logs out the other device.
- If you are asked for a two-step verification PIN you did not set, the scammer has set one. You may need to wait before you can reset it, or use the email reset option if you added an email earlier. Keep trying to re-register.
- Warn your contacts through another channel, such as a normal text, social media or a phone call, that messages from your WhatsApp may not be from you.
- Check Linked devices once you are back in, and log out anything unfamiliar.
- Turn on two-step verification with a PIN or password and an email address.
- Contact WhatsApp support from the app or the Help Center if you cannot get back in.
- If your phone suddenly has no network, your number itself may have been taken. Read SIM swap fraud and contact your mobile network immediately.
If you sent money or shared details
- Money: call your bank or mobile money provider immediately on its official number and ask them to stop the payment. See the first-hour plan in our guide to financial scams.
- Passwords: change them straight away from a trusted device, starting with your email.
- ID documents: watch for accounts or loans opened in your name and report the misuse.
- Evidence: screenshot the chat, the number and any payment details before you block, then report the account in WhatsApp.
- Report the crime to your national reporting service. Our online scams guide lists them for several countries.
Keeping groups and communities safe
Family groups, school parent groups, church and community groups, alumni groups and neighbourhood groups are all targets, because members trust whatever appears there. If you run a group, a few habits protect everyone in it.
- Limit who can post or add members in the group settings, so only admins can add people or change the group details.
- Set a clear rule for money. For example: "We never collect money through a link or a new number. Contributions only go to the treasurer's known account, confirmed in a meeting or by phone."
- Remove and report suspicious members quickly, and post a short warning so others do not click.
- Warn members when an account is stolen. If a member's account starts posting strange links or money requests, tell the group straight away through another admin.
Helping parents and older relatives
Many people who are less comfortable with technology use WhatsApp every day, and scammers know it. Ten minutes together can prevent a painful loss.
- Turn on two-step verification and group privacy on their phone with them.
- Agree one family rule: nobody in the family will ever ask for money by message alone, and nobody will ever ask for a code. Any such request gets a phone call first.
- Save a family code word that anyone claiming to be a relative in trouble must know.
- Make it safe to ask. Tell them you would always rather get a call about a strange message than find out later.
WhatsApp scams and your workplace
Many teams now run on WhatsApp, which means scammers impersonate managers, colleagues, suppliers and customers there too: an urgent payment request from "the boss", changed bank details from a "supplier", or a fake IT message asking for a code. Organizations should treat WhatsApp as a work channel with the same rules as email: verify payment requests by phone, never share codes, and report suspicious messages. CyberWatch AI helps organizations train staff on scams across email and messaging apps and gives every employee a quick way to check and report something suspicious.
Common mistakes and myths
- "It came from my friend's number, so it's my friend." Stolen accounts keep the real name, photo and chat history.
- "Encrypted means safe." Encryption protects privacy, not honesty.
- "I'll just send the code, they're my friend." The code is for your account, not theirs.
- "I'll stay in the group but not reply." Staying keeps you exposed to more links and approaches. Leave and report.
- "Two-step verification is a hassle." It takes a minute to set up and blocks the most common way accounts are stolen.
Frequently asked questions
Someone asked me to forward a six-digit code I received by text. What is it?
It is almost certainly your WhatsApp registration code. Whoever has it can take over your account on their phone. Never share it with anyone, even a friend. If you already shared it, re-register WhatsApp on your own phone straight away with a new code, which logs the other person out.
Can someone take over my WhatsApp without the code?
It is much harder. The usual routes are tricking you into sharing the registration code, scanning a QR code that links your account to their computer, or taking over your phone number through a SIM swap. Two-step verification adds a second barrier, so turn it on.
My friend's WhatsApp is asking me for money. Is it really them?
Not necessarily. Accounts are often stolen and used to message every contact. Call your friend on a regular phone call or reach them another way before sending anything. If the account has been taken, warn them through another channel.
How do I stop strangers adding me to WhatsApp groups?
Go to Settings, then Privacy, then Groups, and choose My contacts or My contacts except. Only people in your contacts can then add you to groups. Leave and report any scam group you are already in.
What is Silence Unknown Callers?
It is a WhatsApp setting that stops calls from numbers not in your contacts from ringing. The calls still appear in your Calls list, so you do not miss anything important. It cuts down on scam and spam calls.
Does end-to-end encryption mean WhatsApp messages are safe?
Encryption stops outsiders reading your messages in transit. It does not tell you whether the person writing to you is honest. Scammers use encrypted chats too, so you still have to judge each message.
What should I do if my WhatsApp account has been stolen?
Re-register WhatsApp on your phone with your number and the new six-digit code, which logs out every other device. Turn on two-step verification, check Linked devices, and warn your contacts through another channel. If you cannot get back in, contact WhatsApp support from the app or its help centre.
Is a green or blue verified badge a guarantee that a business is genuine?
A verified badge shows the account has been checked by the platform, which is a good sign. Scammers often use similar names and profile photos without the badge. Check the badge itself, and contact the business through its official website if in doubt.
Should I reply to a wrong-number message from a stranger?
It is safer not to. Friendly wrong-number messages are a common way to start long romance and investment scams. Block and report the number instead.
Can CyberWatch AI check a suspicious WhatsApp message?
Yes. Copy the text or take a screenshot and paste or upload it into CyberWatch AI Scan for free. It explains what looks suspicious and what to do. Still confirm anything involving money or codes by calling the person directly.
Sources
- About suspicious messages and scams, WhatsApp Help Center
- How to protect yourself from suspicious messages and scams, WhatsApp Help Center
- Received verification code without requesting it, WhatsApp Help Center
- How to recover a compromised account, WhatsApp Help Center
- About two-step verification, WhatsApp Help Center
- How to silence unknown callers, WhatsApp Help Center
- How to change group privacy settings, WhatsApp Help Center
- How to block and report someone, WhatsApp Help Center
- Account security tips, WhatsApp Help Center
- How To Avoid a Scam, US Federal Trade Commission
- Phishing: Spot and report scam emails, texts, websites and calls, UK National Cyber Security Centre
