The National Police have issued a warning about a new type of scam using WhatsApp that is affecting thousands of users in Spain. It's an identity theft technique that allows cybercriminals to impersonate you to your contacts without your knowledge. The most worrying aspect is that the victim retains access to their account and can continue using the app normally, while the scammers send fraudulent messages in their name.
The fraud has been detected in several autonomous communities, with a particularly significant increase in Castile and León, where 82 complaints have been filed in just fifteen days, resulting in financial losses of €10.751. Police have also reported cases in Navarre and Alicante , although the incidence is lower in these areas. What is striking is that all the victims claim not to have provided registration codes, PINs, or scanned QR codes, suggesting that the attackers are exploiting vulnerabilities in outdated devices.
How the scam works
The modus operandi is particularly sophisticated. The criminals manage to access the victim's WhatsApp account without the victim losing access. In fact, in most of the cases analyzed, the legitimate user and the attacker coexist on the same account, without the former being banned. No unknown sessions appear in the "Linked Devices" section either, which allows the intrusion to go unnoticed.
Once they have control, the scammers select contacts from the victim's address book with whom they have a relationship of trust. The typical message is an urgent request for money , claiming that their phone is broken or that they need to make a transfer and can't. The amounts requested usually range between 950 and 1.000 euros, and the criminals provide a bank account number, sometimes from a foreign institution, to receive the money.
The most dangerous aspect is that the fraudulent messages don't appear on the victim's phone . However, recipients receive them within legitimate conversations, using their usual name and phone number, making the scam almost impossible to detect at first glance. Victims typically only become aware of the scam when a family member or friend contacts them through another channel to inquire about the money request.
What signs should raise suspicion
The main red flag is receiving an unexpected request for money via WhatsApp, especially if it comes with a sense of urgency and asks for a transfer to an account that doesn't belong to the person supposedly asking for help. Just because the message comes from a known conversation doesn't guarantee its legitimacy , as scammers are using the victim's real identity.
The police recommend verifying any such financial requests through a different channel. A phone call or a message via another method can clear up any doubts in seconds. Furthermore, it's important to remember that the account owner may not be aware that their contacts are receiving fraudulent messages, so if someone asks you for money via WhatsApp, don't hesitate to check.
Protection measures
To avoid falling victim to this scam, the National Police emphasize the importance of keeping both your phone's operating system and the WhatsApp application updated to the latest version. Updates correct vulnerabilities that can be exploited by cybercriminals , and a concentration of cases has been observed on devices that were not up to date.
It's also crucial to configure WhatsApp to protect against scammers by enabling two-step verification, which adds an extra layer of security. Regularly checking the "Linked Devices" section is another recommended measure, although the absence of unknown devices doesn't guarantee that the account hasn't been compromised. If you see a device you don't recognize, unlink it immediately.
Finally, never share registration codes, two-step verification PINs, or QR codes via messages. If a family member or friend asks you for money via WhatsApp, always confirm it through another channel before making any transfer. And if you detect that your account is being used to send fraudulent requests, notify your contacts through an alternative channel and file a report with the authorities.
In short, this new WhatsApp scam is especially dangerous because it preys on the trust we place in our regular conversations. The combination of simultaneous access, lack of visible signs, and messages that don't appear on the victim's phone makes it one of the most difficult threats to detect. The best defense is prevention: keep everything updated, activate two-step verification, and be wary of any request for money that arrives via this channel, no matter how legitimate it may seem.
