Have you encountered any of this WhatsApp Scams recebtky? Do you know what you need to do to avoid them?
In a Nutshell
WhatsApp has 3 billion users worldwide, which makes it a prime target for fraud. The FTC found that nearly 30% of people who lost money to a scam in 2025 said it started on social media, with losses hitting $2.1 billion total. WhatsApp ranked as the second most costly platform after Facebook.
These scams keep getting more organized and harder to trace. Meta banned over 6.8 million scam-linked accounts on WhatsApp in the first half of 2026 alone. The accounts keep coming back. Here are the six scams circulating most actively right now, how they work, and what to do about them.
A message arrives from an unknown number: "Hi Mum, it's me. I broke my phone and I'm using a friend's number." An emergency follows, and money is needed urgently. The sender is a professional fraudster who has run this script hundreds of times.
Example of “Hi Mom” Scam
The scam works because it hits parental instinct and time pressure at once. The "new number" excuse explains the unfamiliar contact, and the urgency stops the victim from pausing to check. Scammers now also use AI-generated voice clips that mimic a family member's voice.
Watch for a message from an unknown number claiming to be family, a request to save the new number and delete the old one, an urgent request for money to an unfamiliar account, and resistance when you try calling back the original number.
What to do: verify through a separate channel before sending anything. Call the person's real number, message them on another platform, or ask something only they would know. A real emergency can survive a quick check.
This is one of the fastest-growing WhatsApp scams globally. Hong Kong saw cases surge 170% in the first seven months of 2026, with nearly 2,000 incidents and some victims losing over HK$10 million. Police pointed to AI-generated fake websites as a key driver.
The method: someone who already has your phone number enters it on the WhatsApp login screen, triggering a real six-digit code to your phone. They then message you pretending to be a friend, a company, or WhatsApp support, and ask for that code. Once you share it, they take over your account, lock you out, and run scams on your entire contact list using your credibility.
From inside your account, an attacker can message your contacts for money, sell access to your account, use it to recruit people into other scams, and dig through your saved messages for personal information.
What to do: turn on two-step verification under Settings > Account > Two-step verification. This adds a PIN on top of the code, which makes takeover much harder. Treat any request for a verification code as an automatic red flag. WhatsApp never asks for your code in a chat.
Investment fraud causes the biggest losses of any online scam category. The FTC linked $1.1 billion in 2025 losses to investment fraud that began on social media, more than half of all social-media scam losses. WhatsApp is a major delivery channel.
It usually starts elsewhere: a dating app, LinkedIn, Instagram. A stranger builds rapport over days or weeks, then mentions a lucrative investment and suggests continuing on WhatsApp. This slow build before the loss is why it's called "pig butchering."
A common variant adds the victim to a WhatsApp group full of fake investors, fabricated profit screenshots, and a "financial expert" posting daily tips. Small early investments pay off to build trust, then the victim is pushed toward larger sums, often in crypto. When they try to withdraw, they're told they owe fees or taxes first. The money disappears.
Warning signs include unsolicited contact that turns into investment talk, a group where everyone claims steady profits, pressure to use an unfamiliar crypto platform, and fees demanded before you can withdraw earnings.
What to do: check whether the platform is registered with your country's financial regulator, such as the SEC's investment adviser search in the US or the FCA register in the UK. If it can't be verified officially, treat it as fraud.
A new fake site impersonating WhatsApp goes live roughly every two hours. A study of domains registered between December 2025 and March 2026 found 1,216 malicious sites impersonating the platform, with 70% using the exact word "whatsapp" and 46% using hyphens to fake subpages, like whatsapp-support.com.
These links arrive by WhatsApp message, email, text, or group post, usually claiming your account will be suspended, that you need to verify your identity, or that you've won a prize. Clicking leads to a convincing fake page built to steal your login or install malware. One persistent version claims you've won vouchers from a known brand and asks you to fill out a survey with personal and payment details. There is no prize.
Check the URL closely. Real WhatsApp communication comes from whatsapp.com. Anything with extra words, hyphens, or misspellings like "whatsap.com" is fake.
What to do: never click links in unsolicited messages, even from contacts, since their account may be compromised. If a link looks suspicious, check the domain at ScamAdviser before opening it. ScamAdviser's own writeup on WhatsApp scams covers the fake giveaway and fake "WhatsApp Gold" scams in more detail. If you've already entered credentials on a fake site, change your password and turn on two-step verification right away.
Unsolicited job offers on WhatsApp are among the most reported scam types worldwide. Singapore's Annual Scam and Cybercrime Brief 2025 put job scam losses at $123.5 million in that country alone.
These messages often come from a foreign number, offering flexible hours, few qualifications, and a generous salary for tasks like product reviews, social media boosting, or data entry. One version pays out small amounts for simple tasks to build trust, then asks for a deposit to unlock bigger payouts or release your earnings, which never comes back. Another version poses as a recruiter and collects passport scans, ID numbers, and bank details under the cover of "onboarding," then uses or sells that data.
Be suspicious of phrases like "earn money daily from home, no experience needed," "this position was found through your profile" from a stranger, requests for a deposit to access earnings, or requests for ID documents to start a background check.
What to do: legitimate employers don't recruit through cold WhatsApp messages. Verify any company independently through its official website or LinkedIn rather than through contact details given in the message.
This one targets employees. A scammer poses as a senior executive and messages a staff member with an urgent, confidential request, usually a bank transfer, gift card purchase, or company credentials. AI voice cloning now adds fake audio that sounds like the real executive. In India, two companies together lost nearly $420,000 to this kind of scam.
It works because employees are trained to act fast on requests from leadership, and the instruction to keep it quiet cuts off anyone who might raise doubts.
What to do: verify any financial request through a known separate channel, such as calling the executive on a number you already have. Many organizations now ban authorizing payments through messaging apps entirely, and yours should too.
Contact your bank immediately to report the transaction and ask about a reversal. Report the account within WhatsApp using the "Report" option on the contact. Report to your national authority: ReportFraud.ftc.gov in the US, Report Fraud UK, or your national consumer protection agency in the EU. Preserve evidence by screenshotting the conversation and saving payment details before deleting anything. If your account was compromised, re-register your number, enable two-step verification, and warn your contacts.
Pause before acting. Every scam here depends on you reacting before you verify. A real request survives a five-minute check call. A scam doesn't.
If you receive a suspicious link or are unsure about a website or phone number mentioned in a message, check it at ScamAdviser before engaging. The check takes seconds and could save you significantly more.
Adam Collins is a cybersecurity researcher at ScamAdviser who operates under a pseudonym for privacy and security. With over four years on the digital frontlines, he specialises in translating complex threats into actionable advice. His mission: exposing red flags so you can navigate the web with confidence.
