WhatsApp scams have become one of the digital threats causing the most headaches for users. Cybercriminals no longer need to trick you into clicking on a link or providing a verification code . The latest trend in Spain is a much more dangerous one: they access your account without your knowledge and use your identity to ask your contacts for money. The National Police have already registered a significant increase in reports of this type of scam, especially in the province of Jaén, and the Civil Guard has reported similar incidents in Huelva.
The most striking case is the one detected on certain iPhones with older versions of the operating system, but authorities warn that the problem can spread to any device if proper precautions aren't taken. The victim doesn't have to do anything for the attack to occur , and they don't even realize their account is being used until their friends and family start alerting them. Here's how it works and what you can do to protect yourself.
The new scam pattern that worries authorities
The National Police have confirmed that reports of WhatsApp account hijacking have skyrocketed in the last month . The modus operandi is always the same: the criminal gains access to the victim's account, but doesn't ban them or prevent them from continuing to use it. Instead, from another device, they begin sending messages to the victim's contacts asking for urgent money. The worst part is that these messages don't appear on the victim's phone, so they remain unaware of what's happening.
Recipients, however, see the request within real conversations, with the usual number, contact name, and previous history. This trust leads many to make a transfer or Bizum payment without hesitation to avoid becoming victims of scams . In several cases, scammers have even provided a foreign bank account number to receive the money. Those affected claim they never shared registration codes or scanned QR codes, indicating that the vulnerability lies elsewhere.
iPhone vulnerability: the 'zero-click' attack
The Spanish Civil Guard has been investigating a type of attack this month called 'zero-click' that affects certain iPhones , specifically those running iOS 16.7.12 or earlier. In this type of attack, the cybercriminal exploits security vulnerabilities that have been patched in later versions to gain access to the device without the victim having to press any buttons. Once inside, they gain control of WhatsApp and begin impersonating the person.
The OCU (Spanish Consumers' Organization) has explained that these criminals use the 'Delete for me only' function to erase any trace of their messages from the original phone. This way, the owner never sees the fraudulent conversations and only finds out when their contacts ask if they were actually asked for money. Experts emphasize that the best protection is to keep the operating system and the app always up to date, as these vulnerabilities have already been patched.
How to protect your account according to the National Police
The National Police have issued a series of recommendations to avoid falling victim to these scams. The first is to update to the latest available security version of both your operating system and WhatsApp , and reinstall the application if necessary. They also advise configuring WhatsApp for greater security by activating two-step verification, which adds an extra layer of protection so that no one can access your account even if they know your registration code.
Another important measure is to regularly check the 'Linked Devices' feature and close any sessions you don't recognize. Keep in mind that the absence of unknown devices doesn't mean your account hasn't been compromised, so you must remain vigilant. Of course, never share SMS codes, QR codes, passwords, or bank details with anyone, not even if the request comes from a trusted contact.
What to do if you have already been a victim
If you discover that your account is being used to send fraudulent messages, act quickly. First, warn family and friends through another channel so they ignore any requests for money they receive from your number. Then, report the impersonation through official WhatsApp support, saving screenshots, phone numbers, and timestamps of the messages.
If you have already made a payment to the scammers, keep all receipts and evidence and report the incident to the police. You should also contact your bank as soon as possible to try to cancel the transaction . Experts recommend not waiting, as the money can be transferred abroad in a matter of minutes.
In short, technology advances and cybercriminals do too, but the preventative measures remain the same: keep everything updated, don't share codes, and be wary of any urgent money requests via WhatsApp, even if they appear to be from someone you know. The golden rule is to verify the identity through a different channel before making any payment. This will help you avoid many unpleasant surprises.
