WhatsApp fraud does not rely on technical skill. It relies on urgency. Nearly every version follows one pattern: a sudden emergency, an unfamiliar number, and a reason you must act right now. Learn the pattern and the individual scams become obvious.
The “Hi Mum” message
An unknown number writes: “Hi Mum, I dropped my phone, this is my new number.” A short, warm exchange follows — then a request to pay an urgent bill, because online banking is not set up on the new handset yet.
It works because it pairs a parent’s instinct with an explanation that sounds ordinary. Amounts usually land somewhere in the low thousands: worth the effort, not so large that anyone stops to think.
The verification code request
An SMS arrives with a six-digit WhatsApp code you did not ask for. Moments later a contact messages: “Sorry, I typed your number by mistake — can you send me that code?”
The contact is real; their account has already been stolen. Forward the code and you lose yours, and the scam continues through your own address book.
Two-step verification blocks this outright: even with the code, nobody reaches the account without your PIN. Setup is covered in WhatsApp privacy settings.
Delivery fees, prize draws and gift cards
“Your parcel could not be delivered. Please confirm the £1.99 customs fee.” The amount is deliberately trivial — the target is not two pounds, it is the card details you type into a convincing replica of a courier’s payment page.
Fake supermarket prize draws forwarded through group chats use the same mechanics, as does any request to settle a debt in gift cards. The tells are consistent:
- A sender address that resembles the real one but is not it — extra hyphens, digits, unusual domain endings
- Time pressure: “today only”, “within 24 hours”
- A request to forward the message to a set number of contacts
- Payment by gift card or instant bank transfer rather than an invoice
- A company address, a working phone number, an order you actually placed
How to recognise any of them
| Signal | What it really means |
|---|---|
| New, unknown number | Nobody’s account was hacked — someone is simply claiming to be them |
| Urgency | Pressure exists to prevent the one question that would expose it |
| Cannot take a call | “I can’t talk right now” is the standard excuse, because a voice would give it away |
| Unusual payment method | Gift cards and instant transfers cannot be reversed |
| Asking for a code | Always an account takeover attempt, without exception |
If it has already happened
-
Take the account back
Register your number with WhatsApp again. That ends the attacker’s session immediately. Then switch on two-step verification.
-
Stop the payment
Call your bank straight away and ask them to recall the transfer. Within the first hours this sometimes still works.
-
Preserve the evidence
Screenshot the whole conversation including the phone number. Delete nothing, including the parts you would rather not show anyone.
-
Report it
In the UK, forward scam texts to 7726 and report to Action Fraud. In the US, report to the FTC at reportfraud.ftc.gov. Elsewhere, your national cybercrime or consumer protection body.
-
Warn your contacts
If your account was taken over, your contacts are next. One short message prevents more damage than anything else on this list.
Frequently asked questions
Is my phone hacked if I clicked a scam link?
Usually not. These scams target information you type in rather than infecting the device. It becomes serious if you actually entered login or card details on the fake page — change those credentials and call your bank now.
Will I get my money back?
Sometimes, if you move fast. Call your bank immediately and ask for a recall. Where gift card codes have already been redeemed, recovery is effectively impossible.
How do I report a scam inside WhatsApp?
Open the chat, tap the name or number, scroll down and choose Report, then Block. The last few messages go to WhatsApp — take your screenshots first, since you may need them for a police report.
How do they know my name?
Names, numbers and relationships usually come from breaches of other services or from publicly visible profile details. A profile photo and status text set to Everyone often supply enough for a convincing opening line.
