- The WhatsApp code scam uses social engineering to steal accounts using a six-digit code sent via SMS.
- The criminals pose as trusted contacts or technical support to obtain the code and hijack the account.
- Two-step verification and never sharing codes or sensitive data are the best defenses against these scams.
- If the account is stolen, you must regain access as soon as possible, notify the bank if there are any payments, and report it to the authorities.
The WhatsApp code scam has become one of the most common frauds in Spain. Every week, people lose their accounts because someone, posing as a family member, a friend, or even WhatsApp support, convinces them to share a simple six-digit code received via SMS. This seemingly innocent gesture is precisely what allows cybercriminals to take complete control of the account.
Recently, the National Police, the Civil Guard, and INCIBE have issued repeated warnings about this scam, as it is growing rapidly and affects both individuals and businesses. The underlying strategy is always the same: using social engineering techniques to trick the victim into unknowingly handing over their WhatsApp access key, and then soliciting money, stealing information, or spreading the scam among their contacts.
What is the WhatsApp code scam and why is it so dangerous?
When we talk about the WhatsApp code scam, we're referring to the six-digit scam , also known as WhatsApp account hijacking. Essentially, criminals try to register your phone number on a mobile device they control. For security reasons, WhatsApp sends an SMS with a verification code to the legitimate owner of the number, and the scammers simply need to convince you to give it to them.
Law enforcement agencies have detected that this scam takes many forms, but they all share the same objective: to obtain the verification code sent to your mobile phone. Sometimes the message appears to be from a friend, other times from a supposed WhatsApp technician warning you that your account is at risk, and occasionally from an acquaintance who claims to have changed phones and is "not receiving" the code. The common thread is that they try to create a sense of urgency or worry so you don't think too much about it.
Once the victim provides those six digits, the attacker takes control of the account in seconds. The legitimate user is automatically logged out of their own WhatsApp account, losing access to their chats, and in many cases, regaining access can be a long and tedious process requiring contacting the platform's support team.
This complete control allows for highly sensitive actions: cybercriminals can read conversations, access backups, view contact lists , change profile pictures, or even activate new security measures to make it harder for the true owner to recover the account. Furthermore, with all this information, it's much easier to impersonate someone and deceive others.
Typical case: “I’ve changed my mobile phone, I’m not receiving the code, can I use your number?”
One of the most common forms of the WhatsApp code scam begins with a completely ordinary message from a contact who, at first glance, seems trustworthy . It could be a friend, a family member, or someone you talk to frequently on the app. Precisely for this reason, many victims immediately let their guard down.
In this type of conversation, the person writes something like: “ I’ve changed phones and I’m trying to transfer my WhatsApp to the new one, but I’m not receiving the code. Can I use your number so it reaches you and then you can send it to me?” The request is made in a very informal way, with spelling mistakes or colloquial phrases, which gives a false sense of naturalness and closeness.
However, those who have analyzed these scams have found that the message isn't actually written by your contact, but by a criminal who has already stolen their account . Once they gain access, they use that person's profile to further spread the fraud: they target other close contacts and, leveraging the established trust, try to obtain new passwords and new accounts.
When you accept and send the six-digit code you received via SMS, what you're actually doing is authorizing the registration of your number on the scammer's device. WhatsApp assumes the new phone is legitimate and immediately disconnects you. From that moment on, the attacker can repeat the process with your friends and family, creating a chain of victims that keeps growing.
The added problem is that the criminal has access to all your conversations, including those containing personal data, banking information, or sensitive documents . Although they don't always use this information directly, it makes future scams more believable, as it includes details that only someone close to you should know.
The fake WhatsApp tech support scam and the six-digit fraud
Another widespread variation of the WhatsApp code scam involves impersonating the app's support or security team . In this case, the message attempts to appear official, using a serious tone and even logos or names reminiscent of the app's developer.
The content usually revolves around a supposed security issue: they tell you that your account has been "stolen," "blocked," or that they've detected "suspicious activity." They then inform you that the only way to prevent account deletion is to provide the verification code that, they claim, was sent to you via SMS. They include alarmist warnings urging you to act quickly, such as that you'll lose chats, photos, or contacts if you don't cooperate immediately.
This tactic, highlighted by the Civil Guard and INCIBE, is a clear example of social engineering. The attackers aim to make you stop thinking rationally and respond out of fear or urgency. The key is that, by design, WhatsApp will never ask for this code via chat , direct message, or any other channel. If someone does, it's a scam.
The moment the user gives in and shares the six digits, the result is the same as in other variations of the scam: the scammer takes over the account, can change settings, see your groups, contact your friends, or even activate an additional verification that will make it even more difficult to regain access.
The National Police emphasize that any message requesting codes received via SMS, regardless of its origin, should raise suspicion . If it also includes veiled threats (account loss, immediate closure, penalties) or a need to act "right now," the likelihood of it being a scam is very high.
How account hijacking works step by step
The National Cybersecurity Institute explains that the so-called WhatsApp hijacking is built on fairly simple, yet highly effective, social engineering techniques. Attackers only need to know the victim's phone number and have a device with the app installed on which to attempt to register that account.
When a cybercriminal starts the registration process with your number, the app itself sends an SMS with a verification code to your legitimate mobile phone. This message usually says something like: “Your account is being registered on a new device. Do not share this code with anyone. Your code is XXX-XXX.” This is where the deception comes in: the attacker contacts you, using a fake or completely new profile, and convinces you to forward the code.
If the victim falls for the scam and sends the six digits, the registration is successfully completed on the scammer's phone. The system assumes the new device should be in control, so it logs the account out of the original phone . For the affected user, the most obvious symptom is that they can no longer access their WhatsApp, or a message appears indicating that the account is active on another device.
From that moment on, the attacker has a wide range of possibilities: they can read the messages the account receives, send texts to individual contacts or groups, request money, share malicious links , or even explore the chat history and documents if they have managed to restore the backup.
As recommended by both the National Police and INCIBE (National Cybersecurity Institute), if you discover that your account has been compromised, you should try to re-register your number on your own device as soon as possible, before the attacker activates extra layers of security. Doing so will send a new code via SMS, and if no one else knows it, you will be able to regain control. At the same time, it's advisable to inform WhatsApp's official support and file a report with the State Security Forces, as well as call 017 (the cybersecurity helpline) for guidance.
Other common scams circulating on WhatsApp
Verification code fraud isn't the only threat circulating on this app. Authorities and cybersecurity experts warn of several recurring scams on WhatsApp that also rely on social engineering and can affect both individual users and businesses.
One of the simplest, yet most common, scams begins with the typical "Hi, how are you?" message from an unknown number. Behind it is usually a fraudster trying to start a conversation to obtain personal information , such as your full name, email address, city, employment status, or even financial details. Sometimes, they impersonate a well-known brand offering "exclusive" prizes or promotions and send you a link to a fraudulent website where they ask you to fill out a form with your personal information.
Another more sophisticated scam, targeting the business world, is the so-called CEO fraud via WhatsApp . In this case, the cybercriminal impersonates a high-ranking company executive (CEO, CFO, etc.) and contacts an employee in the finance or administration department via message. They use real company data to sound convincing and urgently request, under the guise of confidentiality, a large transfer to close a supposedly key business deal.
The insistence on urgency, extreme secrecy, and flattery toward the employee are clear indicators of this type of attack. The goal is to prevent the employee from verifying the request through other channels (direct call, official email) and to make the payment without checking the sender's identity. By the time the scam is detected, the money has already been transferred to an account that is difficult to trace.
The so-called "foreign relative scam" has also become popular. The user receives a message from someone claiming to be a relative living abroad , but never mentioning their name. Instead of identifying themselves, they encourage the recipient to "guess" who they are. If the person has a relative they don't speak to often, they're likely to fall for the trick and mention a name. From there, the scammer knows who to impersonate and, using that as a pretext, requests money or sensitive information.
Often, these scams also involve the theft of personal and banking information . Criminals can then use this information in further scams or sell it on the black market. That's why it's so important to immediately end any suspicious conversations and never share private information with unknown numbers or dubious profiles.
How to detect if someone is trying to scam you on WhatsApp
There are several signs that, when combined, can help you identify if you're facing a potential fraud attempt. The first and most obvious is that the message comes from a number you don't have saved in your contacts. While this isn't a guarantee that it's a scam (we all receive legitimate messages from unknown numbers), it is a reason to be extra cautious.
Another common indicator is that the sender avoids providing specific details . In the case of the supposed relative, they don't mention their name or relationship to you; in CEO fraud, they don't provide verifiable details about their position or circumstances; in fake promotions, the information about the company or official website is confusing or simply nonexistent. It's also common for capitalization to be mixed in an unusual way, or for the text to contain numerous spelling and grammatical errors.
Messages of this type often play on urgency: “It’s very important,” “It has to be today,” “If you don’t do it now, you’ll lose the opportunity,” or similar phrases. This time pressure is a tool to prevent you from stopping to think calmly or verifying the information through other means. If you notice that the other person in the chat is very insistent that you respond quickly and almost scolds you for taking so long, there are reasons to be suspicious.
In the financial sector, another red flag is being offered money transfer services like Bizum, instant transfers , or similar systems without clear documentation or proof of transaction. Criminals exploit the fact that these services allow small amounts to be moved in seconds and are very convenient for users.
Finally, it's always wise to be wary of anyone identifying themselves as a bank, government agency, or technical support representative via WhatsApp. Banks never request passwords or sensitive data through this app, and official digital platform support will never ask for verification codes received via SMS in a chat. If a supposed "technician" asks you for something like this, the safest course of action is to end the conversation and, if you have any doubts, contact the official, known channels.
How to avoid falling for the WhatsApp code scam and other frauds
The best defense against these types of scams is to combine healthy skepticism with good security practices ; discover how to avoid financial fraud . First and foremost: never share a verification code you receive via SMS with anyone, whether it's for accessing WhatsApp, your email, social media, or any other account. These codes are personal and non-transferable.
Even if the message supposedly comes from your partner, child, or mother, take a moment to verify the request through another channel . Call them, send a voice note asking a very specific question that only that person would know, or contact them through another social media platform. If it's a scammer on the other end, they're very likely to be unable to maintain the conversation without contradicting themselves.
Another key measure is to activate WhatsApp's two-step verification . This feature allows you to set a six-digit PIN that will be required when someone tries to register your account on a new device, even if they already have the SMS verification code. This way, even if a cybercriminal obtains your six digits, they will encounter a second barrier that they cannot overcome without knowing the PIN.
To activate this extra layer of security, open WhatsApp, go to Settings, then Account, tap on “Two-step verification,” and follow the instructions. The system also allows you to add a recovery email address , which is recommended for resetting your PIN if you forget it. This setup takes less than a minute and greatly reduces the risk of losing your account.
In addition to this, it is advisable not to respond to strange messages, to immediately block those who ask for personal data or money without a clear reason, and, if a conversation has been started, to avoid providing information that could be used in future attacks (such as identity documents, bank accounts, addresses, or sensitive photographs).
What to do if you have already been the victim of a WhatsApp scam
If you suspect you've fallen for the WhatsApp code scam or any other similar fraud, the first step is to act quickly . If you still have access to your account, go to the suspicious conversation, tap the three dots in the upper right corner, select "Report" or "Report and block," and follow the instructions to inform the platform and cut off all contact.
If your account has already been hacked and you can't log in, try registering your number again on your own phone as soon as possible. WhatsApp will send you another code via SMS, and if no one else knows it, you'll regain control of your profile . It's important that you don't forward this new code to anyone, even if they're supposedly "helping" you through other channels.
If you have shared financial information or sent money, you should contact your bank immediately to explain the situation and request that they block cards, accounts, or suspicious transactions . In some cases, acting quickly can stop fraudulent activity or minimize financial damage.
It is also highly recommended that you file a report with the National Police, the Civil Guard, or the relevant regional police force. Your testimony helps the authorities identify patterns of behavior , dismantle fraud networks, and prevent others from falling for the same scam. For further guidance, you can call 017, the free cybersecurity helpline managed by INCIBE.
Finally, if your conversations have been accessed, consider changing the passwords for any other services where you may have shared information via WhatsApp and warn your contacts about what happened. This will reduce the chances of criminals continuing to use your identity to deceive others in your network.
The rise of the WhatsApp code scam illustrates how cybercriminals exploit the popularity of this app to multiply their victims, but it also demonstrates that, with a little caution, simple measures such as two-step verification, and the habit of not sharing codes or sensitive data via chat, it is possible to keep your account safe , curb the spread of these scams, and navigate instant messaging with much more peace of mind.
