Identity theft via WhatsApp has become one of the most serious threats to mobile phone users. The National Police have warned of a new method that allows cybercriminals to impersonate you without your knowledge. The National Cybersecurity Institute (INCIBE) has already issued a warning about this fraud, which is having a significant impact on the population.
The scam involves an attacker gaining access to your real WhatsApp account and sending messages to your family and friends urgently requesting money. The most worrying aspect is that the victim doesn't lose access to the app or notice anything unusual. The first cases were detected in Italy in May 2026, and since then they have spread rapidly to Spain, especially in regions like Castile and León and Murcia.
This is how the scam works
According to INCIBE, criminals are exploiting two linked vulnerabilities : one in the iOS operating system (in versions prior to 16.7.12) and another in the WhatsApp application itself. This flaw allows for a 'zero-click' attack, meaning you don't need to do anything for your account to be compromised. There are no links, codes, or downloads involved.
Once inside, they use the 'delete only for me' option from a linked device. This way, the fraudulent messages they send don't appear on your phone, but they do reach your contacts. The National Police explain that checking linked devices doesn't always reveal an unknown terminal, making it difficult to detect the hack.
The typical message follows a very specific pattern: "I need your help ," "my phone is broken," "a new one costs around €980–€1.000," "I can't make a transfer right now," "can you advance me the money?" and "I'll send you the merchant's IBAN." The amounts usually range between €950 and €1.000, although there are also cases of smaller requests, from €250 to €500, as in Murcia.
What makes this scam unique is that the account holder continues to use WhatsApp normally and receives no alerts. The messages only appear in the recipients' conversations, who trust that they are talking to their loved one. Unlike other WhatsApp scams that use code theft and an unknown number, this one uses the account holder's usual number within the regular conversation.
The update problem
Investigations have detected a significant concentration of unpatched devices . Both Apple and WhatsApp have already fixed the vulnerabilities, but those who haven't installed the patches remain vulnerable. In Castile and León, the police have registered 82 complaints in fifteen days, with financial losses of €10.751. An increase in cases has also been observed in Murcia.
The spokesperson for the National Police in Murcia, Diego Seral, points out that criminals "take advantage of these security flaws to gain access to our mobile phones and send messages to our contacts without our knowledge." Furthermore, the victim usually only finds out when a contact calls them through another means to confirm whether they actually requested money. A case reported by El PaÃs shows how a father received a message from his daughter requesting 988 euros for an urgent payment; in the end, the daughter hadn't sent anything and there was no trace of it on her phone.
This vulnerability also affects the "child in distress" scam, where criminals impersonate a relative to solicit money from elderly people. In Murcia, a case has been reported in which a fake police commissioner convinced a victim to hand over €3.000 as a deposit.
Recommendations to protect yourself
The National Police and INCIBE recommend keeping both your operating system and WhatsApp application up to date . Configuring WhatsApp against scammers by enabling two-step verification is another essential measure, as it adds an extra layer of protection. It is also crucial never to share verification codes, SMS codes, PINs, or QR codes under any circumstances.
If you receive an urgent request for money via WhatsApp, even if it appears to be from a family member, be suspicious and verify it through another channel . Call the person directly or send a message through a different app. Do not make any transfers or send payments via Bizum without verifying the information. If you have been a victim, you can find out how to recover your WhatsApp account and warn all your contacts through alternative means to ignore any further financial requests.
Prevention is the best tool against this type of fraud. Keeping your software updated, enabling two-factor authentication, and being wary of urgent requests are basic measures that can make all the difference. If you have already fallen into the trap, report it to the National Police and go to the police station to file a formal complaint.
