The Seven Most Common WhatsApp Scams (and How to Avoid Them)

Most typical WhatsApp scams don’t involve high-tech security breaches. They’re not orchestrated by state-sponsored hacker groups with deep pockets and military-grade technology. In fact, most are carried out by low-tech criminal syndicates using social engineering techniques to exploit people’s weaknesses and trust in others.

In the second half of 2025 alone, Meta removed 6.8 million WhatsApp accounts linked to cybercrime and digital fraud. But attacks show no signs of slowing down, as they’re inexpensive and easy to launch, and chatbots do much of the work automatically. However, there’s a downside: social engineering only works when you don’t know what to look for.

Most of these scams follow a specific pattern and have a similar procedure. If you know what to look for, you can stop them before they compromise your data or lead you into financial ruin. Below are seven of the most common scams used by cybercriminals on WhatsApp, along with tips on how to safely avoid each one. Learn how to recognize when you’re about to be scammed, activate new features that protect your account privacy, and know how to respond when an attack has already begun.

Hacking the verification code

I’d rate this as the most dangerous WhatsApp scam on this list because it locks your entire account and hands it over to the attacker. It’s also one of the easiest to execute. Here’s how it works: the attacker enters your phone number into WhatsApp to log in to your account using their device. This triggers WhatsApp to send a verification code to your registered phone number. Immediately, someone posing as a friend or family member sends you an SMS asking you to share the verification code under some false pretense. If you share the verification code, that’s it: WhatsApp logs out of your current device and hands over access to your account to the attacker, who can then do whatever they want with it, including changing all your login information.

Avoiding this attack is also very simple. Simply don’t share your WhatsApp verification code with anyone by phone or SMS, even if it appears to be someone in your contact list. If you receive a message from WhatsApp with a new verification code, take it as a sign that someone is trying to hack your account, and don’t assume it’s just a glitch.

Also, be sure to enable two-factor authentication on your WhatsApp account by going to Settings > Account > Two-Factor Authentication in the Android or iOS app. This way, anyone who steals your verification code won’t be able to immediately access your account, as they’ll also need to confirm the request using your chosen authentication method.

Simulation of an emergency situation

Having gained access to someone’s WhatsApp account, the attacker, often following the same pattern I described in the previous example, sends a series of messages from the hacked account to all of the victim’s contacts. They pretend to be the victim experiencing a medical or financial emergency and then ask people to transfer money as quickly as possible.

The reference to an emergency triggers panic in people, making them less willing to verify the authenticity of the request. By the time the initial victim finally reports their account being hacked, several people have already fallen victim to scams using the stolen account. Scammers sometimes even use AI-generated voice messages to make the request appear legitimate, assuming they already know the voice of the real account owner.

I always tell my friends and acquaintances never to transfer money or fulfill confidential requests sent via SMS without verifying their authenticity. If you receive such a request on WhatsApp, simply call the person directly using a known contact number that hasn’t changed recently. If the sender claims the number has changed or the phone’s battery is dead, that’s a warning sign. If you’re concerned the request might be genuine, call a neighbor or visit the person in person to verify.

Long-Term Digital Romance Scams

WhatsApp is a popular messaging app for online dating scams due to its popularity, but these scammers rarely reveal themselves immediately. Instead, the scammers spend months building rapport with potential victims through long chains of text and audio messages. Once they’re confident in the level of trust they’ve established, the requests begin. Initially, they ask for small transfers of up to $100, citing something urgent but not critical.

Gradually, the requests for money escalate until the victim realizes something is wrong and stops. Family emergencies, personal cash flow problems, and even offers to invest in cryptocurrency or private funds are often used to coerce the victim into handing over money. If someone you’ve never met in person asks you for money, it’s an immediate sign that something is wrong. Normal people rarely ask someone for money unless they know them personally, so be wary when faced with such a request.

Invitations to a paid app subscription

This is a very common scam, especially popular among demographics with low digital literacy. You receive a private message from a user purporting to be an official WhatsApp account, inviting you to try a new data plan not available to the general public. The message often includes a link to download and install an app from an unknown source. Once you click the link, malware, ranging from ransomware to keyloggers, is installed on your device, which can then be used for blackmail or cyberattacks.

If you receive an invitation to subscribe to WhatsApp Gold , WhatsApp Premium, or any other similar subscription that hasn’t been verified by official sources, do not click the link. Also, as a general rule, avoid installing apps that aren’t distributed through official sources like Google Play or the App Store unless you’re sure the developer sending you the link is trustworthy. Apps installed via third-party links don’t undergo the usual security checks required by official app stores, increasing the risk of malware infection. Most smartphones disable the installation of third-party apps by default for this very reason.

For even greater security, go to Settings > Privacy > Advanced in WhatsApp and enable the “Disable link previews” option. While link previews in WhatsApp are generally safe, they can briefly reveal your device metadata and general geolocation to the website administrator, which could be used for more sophisticated cyberattacks.

Impersonating popular service providers

A common WhatsApp scam involves using official names and logos to impersonate service providers and reputable organizations, such as banks, delivery services, tech support services, and sometimes even local law enforcement agencies. Since people are more likely to trust messages from such providers without further verification, this gives scammers the opportunity to make unsubstantiated requests.

If someone claims to be a bank employee and asks you for a one-time password for security verification, offer to call back on a known official number rather than continuing the conversation through the same (potentially compromised) channel. The same applies to anyone claiming to be a local police or tax office employee. They may threaten to refuse, but remember that you can always call the relevant agency and officially confirm the information instead of acting on a random call. Sometimes scammers even pretend to be technical support staff and request remote access to your device for troubleshooting. IT staff know that doing this outside of established channels is unacceptable.

The problem with such requests is that they can vary greatly in how the scammer presents themselves and what they initially ask for. But the general rule is that organizations or their employees typically don’t call from a personal number or even an unknown work number to request details. Simply politely offer to call back on an official number you can verify, and then disconnect the call. This almost always immediately stops such attempts, as they use a “shoot-at-the-dark” tactic to target a large number of people and find an easy victim. I personally have received several calls from people claiming to be local police officers asking me to confirm the address on my passport, but a quick call to the department’s landline revealed that this was not the case.

Job placement and interview scams using games

According to the Federal Trade Commission (FTC) , in 2024 alone, US residents lost over $500 million to job scams. Given high unemployment, most people are reluctant to engage with job offers. Scammers know this and are counting on it. It can all start with a WhatsApp message from an unknown number offering a simple remote job. Sometimes, they even pay small fees to establish trust in exchange for simple tasks, such as promoting a product in a catalog.

Eventually, before receiving the next batch of tasks, you’ll be asked to deposit a significant amount of money into their account for “verification.” That’s when you’ll immediately realize something is amiss. Most people know that employers would never ask you to pay for just work, but scammers can come up with clever excuses for these strange requests. Sometimes, the request isn’t for money at all. Instead, the job scammers will demand access to your device or even ask you to complete a short survey using a (malicious) link.

The best way to recognize a WhatsApp job scam is to never trust unknown numbers offering a job or even an interview. No matter how trivial the request, it could give them the opportunity to hack your device or access your accounts. Simply ask them to contact you using your official company email address or landline. If they refuse, it’s a clear sign you’ve fallen victim.

Fake charities, disaster relief organizations and NGOs

WhatsApp scams prey on people’s emotional vulnerability, often using deception, with scammers posing as charities or disaster relief funds to trick people into sending money. Worse, these messages are often forwarded from one victim to another without verification, creating a sense of implicit trust that isn’t earned but assumed. You can use platforms like Charity Navigator and CharityWatch to determine whether a charity is legitimate and obtain its official contact information for verification. Most legitimate charities don’t solicit donations via WhatsApp, and even if one does, it’s better (and safer) to pay through the official method listed on the organization’s website.

Here are some more WhatsApp security tips.

• WhatsApp scammers often use images of real people to commit scams. If you’re concerned that your profile photo or identity could be used to commit fraud, you can restrict access to your profile photo, “About Me,” and activity status to contacts only by going to “Settings” > “Privacy.”

• Periodically check for unauthorized devices connected to your account by going to Settings > Connected Devices . If you’re unsure whether the device you’re logging into is yours, log out of all active sessions just in case.

• In Settings > Privacy, you can enable the Silence Calls from Unknown Callers feature to prevent scammers and malicious users from calling from numbers not in your contact list.

• WhatsApp now offers the option to specify a username without a phone number for those who don’t want their phone number to be publicly visible on their account. This feature can be accessed by going to Settings > Account > Username in the mobile app.

• If you suspect this is a scam, use the Report and Block feature to notify WhatsApp of the attempted scam, and the system will check the scammer’s account.

More…