Companies
WhatsApp scams: how the fake messages work
WhatsApp scams involve fraudsters exploiting the messaging platform through account takeover schemes, fake security alerts, and fraudulent job or investment offers. Attackers frequently trick users into sharing six-digit verification codes or forwarding malicious links to hijack accounts and deceive contacts into sending money. WhatsApp never requests payment, subscription fees, or verification codes.
Last reviewed: August 9, 2026 · Drafted with AI assistance. Every figure on this page was checked against the source cited for it. Not yet reviewed by a human editor.
ScamPreventionGuide is an independent consumer-protection resource. We are not affiliated with, endorsed by, or sponsored by WhatsApp. Company names and trademarks are the property of their respective owners and are used here only to identify the companies that scammers impersonate.
Is the WhatsApp message real?
In-app reporting feature (open chat -> tap contact/group name or three dots -> Report Contact / Report) and email support via the WhatsApp Contact Us page · https://www.whatsapp.com/contact · Published date unknown (accessed August 2026) · Covering 2026.
WhatsApp never initiates contact via SMS, email, or phone calls for support, account verification, or security alerts. Official communications regarding account status or security are conducted strictly through in-app notifications or push alerts originating from verified official system channels. WhatsApp never asks users for money, subscription fees, payment card details, bank account credentials, verification codes, or remote access under any circumstances.
According to Federal Trade Commission (FTC) data published in June 2026, U.S. consumers reported losing a record $3.5 billion to imposter scams in 2025, representing nearly one in three fraud reports and nearly triple the losses recorded in 2020. Across all social media channels (including Facebook, Instagram, and WhatsApp), reported scam losses reached $2.1 billion in 2025, up from $1.9 billion in 2024 and $1.5 billion in 2023. Source: Federal Trade Commission (FTC).
Which versions are in circulation?
The versions in circulation, and what each one is after:
| Version | How it reaches you | What it wants |
|---|---|---|
| Account Takeover / Verification Code Hijacking | SMS / Social | To steal the victim's 6-digit WhatsApp verification OTP to register and hijack the victim's WhatsApp account on the scammer's device. |
| Fake WhatsApp Security Centre / Account Locked Impersonation | Social / Web | To harvest account credentials, personal identifying information, and multi-factor authentication codes to take over the account. |
| Fake Job Offer / Task Scam | Social / SMS | To lure victims into paying fake "registration fees" or depositing cryptocurrency into fraudulent investment/task dashboards under the guise of earning commissions. |
| Romance & Relationship Impersonation Scam | Social | To extract money through fraudulent cryptocurrency investments, wire transfers, or direct cash gifts under emotional pretexts. |
| Fake Investment & Crypto Scheme | Social | To steal funds deposited into fake trading platforms controlled by fraudsters. |
| Family Member in Distress ("Hi Mum / Hi Dad") Impersonation | Social | To trick the victim into transferring funds instantly via bank wire or peer-to-peer payment apps to a fraudulent account. |
How can you tell a real message from a fake one?
The differences you can check yourself:
- The genuine WhatsApp registration process sends a 6-digit code solely to initiate account setup on your own device; genuine contacts or WhatsApp support will never ask you to forward or reveal this code.
- A message claiming to be from a close local friend or family member originating from an unfamiliar foreign country code (+234, +44, etc.) indicates an impersonation or hacked account.
- The genuine WhatsApp application is entirely free; any message demanding subscription fees, activation payments, or unbanning fees is a scam.
- When receiving a message from an unsaved number for the first time, WhatsApp displays contextual banner warnings showing if the phone number is registered in a different country; ignoring this warning exposes you to fraud.
- Links provided in security alerts or support claims do not use official domains ending in
whatsapp.com, but instead employ lookalike domains or third-party web domains.
What should you do in the first hour?
It depends on how far it got. Find your situation:
- Open the chat in WhatsApp, tap the contact name or number, select Block Contact, and tap Report Contact to flag the account to WhatsApp.
- Delete the chat thread to prevent accidental link clicks.
- Open WhatsApp on your phone, enter your phone number, and verify it using the 6-digit OTP sent via SMS. Entering your code automatically logs out the scammer from your hijacked account.
- Once logged back in, go to Settings > Account > Two-step verification and set up a secure PIN to prevent future unauthorized takeovers.
- Go to Settings > Linked Devices and immediately log out any unknown or unrecognized desktop/web sessions.
Where do you report it?
In-app reporting feature (open chat -> tap contact/group name or three dots -> Report Contact / Report) and email support via the WhatsApp Contact Us page · https://www.whatsapp.com/contact · Published date unknown (accessed August 2026) · Covering 2026.
Whatever the brand, two official channels take the report. File with the US Federal Trade Commission at reportfraud.ftc.gov, and — if money was lost or a computer was accessed — with the FBI's Internet Crime Complaint Center at ic3.gov. Reporting rarely recovers money on its own; it is what makes the next person's warning possible.
Sources
- ScamShield Singapore, 2025-04-29.
- Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT), 2026-06-12.
- Bitdefender Hot for Security, 2026-03-16.
- WhatsApp LLC, 2026-08-07.
- WhatsApp LLC, 2026-08-07.
- WhatsApp LLC, 2026-08-07.
- WhatsApp LLC, 2026-08-07.
- Federal Trade Commission (FTC), 2026-06-15.