WhatsApp Scam Alert: The 2 Tricks Stealing Accounts and Cash

The message was short and friendly. “Hey man, how are you doing? I have a problem with my card. Can you lend me money? I will bring it back in a day.”

It came from a colleague’s WhatsApp, in the same chat they had used for years. So in July 2026, a senior South African sports editor did what most of us would do for a friend. He sent R1,500. Two hours later came a second request, for R800. He sent that too. Only when a third request arrived did something feel off, and a phone call confirmed it: his colleague’s WhatsApp had been stolen (Sowetan).

He later said he let his guard down because the message came from someone he knew. That is exactly how this kind of WhatsApp scam is designed.

If you have ever wondered how a WhatsApp scam actually works, this post explains the two most common ones, and how they work hand in hand: criminals stealing real accounts, and strangers pretending to be family on a “new number”. Neither needs any clever hacking. They rely on one thing: getting us to act before we check.

Scam one: the six digits that hand over your WhatsApp

When you set up WhatsApp on a phone, WhatsApp sends a six-digit code by SMS to prove the number is yours. Think of that code as the key to your front door. Whoever has it can let themselves in, read along as you, and lock you out.

Here is how criminals get that key from you.

You get a message from a friend, a cousin or someone from church. They chat for a bit. Then your phone beeps with an SMS containing a code, and a moment later your “friend” writes: “Sorry, I sent my code to your number by mistake. Can you send it to me?”

It sounds harmless. It isn’t. Your friend’s account was already stolen, and the person behind it has just asked WhatsApp to move your account to their phone. The code that arrived is your key. The moment you pass it on, your WhatsApp becomes theirs, and they start the same trick on everyone in your contacts (Daily Investor; Ubuntu Guard).

Then the money requests begin, sent in your name, with your photo, in chats your friends have trusted for years. As one South African security expert put it, whoever takes over the account inherits all of that trust (Daily Investor).

If you remember only one thing from this post, make it this: nobody genuine will ever need your WhatsApp code. Not a friend, not your child, not “WhatsApp support”. Someone asking for it is the scam.

WhatsApp scam warning: never share your WhatsApp code, turn on two-step verification, and call the old number if someone says they have a new one

Scam two: “Hi Mum, this is my new number”

The second scam doesn’t steal anything at first. It simply knocks on the door pretending to be family.

A message arrives from a number you don’t know: “Hi Mom, my phone broke. This is my new number, please save it.” It might say Dad, or use a friend’s name. It feels natural, because phones really do break and get lost.

A little chat follows to build trust. Then comes the real reason for the message: an urgent bill, rent, a new phone, and the banking app “won’t work on the new phone”. Could you help, just this once? (Daily Investor)

This WhatsApp scam keeps changing its clothes. In 2025, Santander bank in the UK warned that it was evolving at “breakneck speed”, including AI-made voice notes that sound like your child. Its data showed criminals posing as a son were the most successful, then daughters, then mothers (The Independent via AOL). In July 2026, a British version used the heatwave: “I’m so hot and stressed mum, text me on this new number” (The Independent via Newswav). German consumer groups were still warning about the same “Hallo Mama” messages in July 2026, and noted that spelling mistakes are almost always a giveaway (Verbraucherzentrale).

The two WhatsApp scams feed each other. When criminals have stolen a real account, the request comes from your daughter’s actual chat, photo and all. When they haven’t, they fall back on the “new number”. Either way, it ends the same: you send the money yourself.

Why careful people still fall for a WhatsApp scam

A WhatsApp scam doesn’t target foolish people. It targets kind ones. They work because they borrow the voice of someone we love, invent an emergency, and count on us paying before anyone picks up the phone to check. One South African expert summed it up: the whole trick runs on ten minutes of panic (Daily Investor).

Criminals also do their homework. Posts about a matric dance, a gap year, a new job or an overseas trip give them a believable story to tell (Daily Investor). And because WhatsApp is linked to Facebook and Instagram, details like birthdays and family names are often easy to find (BusinessTech).

A big problem in South Africa

For many South Africans, WhatsApp is the phone. Family groups, school updates, work, the plumber: it all happens there. That makes it a natural hunting ground.

The bigger picture is sobering. South Africans lost R2.4 billion to digital banking crime in 2025, across about 110,000 reported incidents, and the banking industry says most of it came from people being tricked rather than banks being hacked (BusinessTech; Daily Investor). That figure covers all digital banking fraud, not WhatsApp alone, but WhatsApp is one of the main ways the trickery starts. Complaints to the banking ombud also rose about 25% in 2025, with account takeovers and scams prominent among them (Moonstone). For the wider picture, see our guide to banking scams in South Africa.

And everywhere else

The WhatsApp scam is not a South African problem alone. In Singapore, Meta’s apps (Facebook, WhatsApp and Instagram) were used to reach victims in over a third of scam cases in the first half of 2025 (Must Share News). In the UK, banks and police were still issuing “Hi Mum” warnings in 2026. And in 2025, WhatsApp itself banned more than 6.8 million accounts linked to criminal scam centres, many run by organised crime in South East Asia (Meta). The message you receive in Durban or Dorset may come from the same kind of operation.

The newer WhatsApp scam tricks of 2025 and 2026

The “send me the code” message is the old favourite, but criminals have found other doors too.

“Your account needs verifying.” An SMS warns that your WhatsApp will stop working unless you verify it, and links to a page that looks like WhatsApp. You type in your number and the code, and the account is gone. Singapore Police arrested two men over exactly this in November 2025 (Singapore Police).

“Hey, I just found your photo!” Discovered in late 2025 and nicknamed “GhostPairing”, this one starts with a message from a friend’s account and a link. The page asks you to confirm a code or scan a QR code inside WhatsApp. It feels like a routine check, but you have just connected the criminal’s computer to your account, the same way you might connect WhatsApp on a laptop. Your phone keeps working normally while someone quietly reads along and messages your contacts (Malwarebytes). Dutch consumer group Consumentenbond calls it the new trick of 2025 (Consumentenbond).

Your phone suddenly has no signal. In a SIM swap, criminals get your number moved to a SIM card they control, so WhatsApp’s code goes to them. In one week in mid-2026, a Correctional Services spokesperson and a radio reporter in South Africa both lost signal this way, and their contacts were asked for money. One friend got a request for R2,500 (Sowetan).

The voice note that sounds just like them. With voice cloning, a few seconds of someone’s voice from social media can be turned into a convincing message. As one expert warned, “it sounded just like him” is no longer a safe test (Daily Investor).

What to expect from WhatsApp scams in 2027

Nobody can predict every WhatsApp scam, but the direction of travel is clear from what happened in 2025 and 2026. This is our reading of where things are heading, not a forecast from any official body.

More convincing voices and messages. South Africa’s banking industry already sees criminals using AI to write messages and imitate trusted people (The Outlier). Expect fewer spelling mistakes and more voice notes that sound exactly right. The old tells will fade, so the call-back habit matters more.

Fewer stolen codes, more tricked approvals. WhatsApp is making stolen codes less useful (more on that below). So criminals are likely to lean harder on getting you to approve something yourself, like the photo-link trick above.

New ways to pretend. Commentators expect usernames to reduce how often we share phone numbers, but warn that a familiar-looking username could become a new disguise (TechRepublic).

The same old story underneath. Whatever the technology, the script stays the same: someone you trust, an emergency, and a rush. That’s good news, because the defence stays simple too.

WhatsApp is fighting back

In August 2026, WhatsApp added stronger protection. Its extra security step, two-step verification, can now use a proper password instead of only a six-digit PIN. It can also use a passkey, which means confirming it’s you with your fingerprint, face or screen lock. WhatsApp says over a billion people already use a passkey (WhatsApp). The catch: none of this switches on by itself. You have to turn it on (Malwarebytes).

Simple habits that protect you and your family

You don’t need to be good with technology to stay safe. A few habits do most of the work.

Never share a code. Not with friends, family or anyone claiming to be from WhatsApp. If a website or message asks you to type a WhatsApp code or scan a QR code, stop.

Call back on the number you already have. If “your son” messages from a new number, phone his old one. If a friend asks for money on WhatsApp, ring them, or ask someone who is with them. A child who is really stranded will understand why you wanted to hear their voice first (Daily Investor).

Agree a family rule today, while nobody is panicking. Any request for money gets a call-back first, however urgent it sounds. Some families add a code word that only they know. A criminal can’t copy it from a voice note or a video online (Daily Investor).

Switch on the extra lock. In WhatsApp, go to Settings, then Account, then Two-step verification, and turn it on with a password you’ll remember. While you’re there, set up a passkey too. If this feels fiddly, ask a grandchild or a tech-savvy friend to sit with you for ten minutes. It’s worth it.

Check who else is connected. Under Settings, then Linked devices, you’ll see every computer or tablet using your WhatsApp. If you don’t recognise one, log it out (Malwarebytes).

Watch for the warning signs. Be wary if someone refuses to take a voice or video call (EWN). The same goes if they ask you to pay a “friend’s” account, or come back for a second payment. And if your phone suddenly loses signal for no reason, take it seriously.

Share what you know. Older relatives are often the target of a WhatsApp scam, and a five-minute chat with them could save their savings.

If a WhatsApp scam has already caught you

First, don’t be hard on yourself. A WhatsApp scam is built by professionals to fool decent people. What matters now is speed: South Africa’s banking industry warns that stolen money is moved quickly through several accounts, which makes it harder to trace the longer you wait (Daily Investor).

If you sent money, call your bank’s fraud line straight away. Use the number on the back of your card or in your bank’s official app, not one sent to you in a message. Keep screenshots of the chat and the payment details, and report it to the police. In South Africa, if your bank won’t help, the banking ombud can review your complaint (Moonstone). In the UK, reports now go to Report Fraud, which replaced Action Fraud in December 2025 (GOV.UK).

If your WhatsApp was taken over, open WhatsApp and register your number again with the SMS code; this pushes the criminal out (Ubuntu Guard). Then warn your contacts some other way, by SMS, a phone call or another social account, so they don’t fall for messages “from you” (Daily Investor). If your phone has no signal, go to your network provider immediately, then your bank (EWN).

And tell your family about any attempt, even if nobody paid. The next message might go to them.

A word about links

Sometimes a WhatsApp scam doesn’t ask for money directly. Instead the “friend” or “new number” sends a link: a shop with an amazing deal, a holiday rental, an investment, a payment page. AdUncovered can’t tell you whether the person messaging you is genuine; only a phone call to someone you trust can do that. But we can research the website, shop or platform behind a link before you pay, and give you the public evidence so you can make up your own mind.

Stay kind, stay curious, and when money is involved, always check first.

“Hi Mum, this is my new number”: the WhatsApp scams built on trust

Scam one: the six digits that hand over your WhatsApp

Scam two: “Hi Mum, this is my new number”