The most popular messaging app in Spain could be on the cusp of a major shift. According to the latest information leaked by WABetaInfo, Meta's platform is finalizing preparations to expand its integrated payment system into new markets, including several European countries. If confirmed, this move would pose a direct challenge to Bizum's dominance in peer-to-peer express transfers, a market where the instant payment app has so far faced no serious competition.
But it's not all good news. In recent weeks, the Civil Guard has detected a surge in attacks targeting WhatsApp accounts in Spain, employing a particularly sophisticated modus operandi that doesn't require the victim to click on anything. The combination of these two realities—the expansion of features and the increase in threats—paints a picture in which users will have to be more vigilant than ever about the security of their conversations and their money.
WhatsApp's payment system is taking firm steps towards Europe
The latest WhatsApp beta for iOS, version 26.33.10.70 available on TestFlight, has revealed a redesigned menu for managing cards and billing information. According to leaked screenshots, the interface is divided into three sections: one for paying a contact directly, another for choosing from saved payment methods, and a third for storing a shipping address. The key feature is that users will be able to link credit and debit cards from multiple banks , a significant difference from Bizum, which ties the user to a single bank and phone number that cannot be changed without first unlinking it.
The screenshots leaked by WABetaInfo show countries like the Netherlands, Spain, Germany, Italy, Austria, Australia, Canada, Ghana, and the United States as billing address options. Their inclusion in the code doesn't guarantee an imminent launch , but it demonstrates that the infrastructure is being designed with a clear international focus. In countries like India, Brazil, Singapore, and Mexico, WhatsApp's payment system already operates successfully using local networks such as UPI, PIX, and PayNow, and the company has had to obtain regulatory licenses in each market.
The move is no coincidence. Meta has placed Kunal Shah, a founding member of CRED, one of India's most popular payments and rewards fintech companies, at the helm of WhatsApp. The arrival of someone with such a background in the financial sector reinforces the theory that payments are a strategic priority for the company. However, experts warn that the process will be lengthy: these types of features require banking and regulatory approvals in each country, and even beta users can't test them yet.
The Civil Guard warns of zero-click attacks on iPhones
As WhatsApp expands its features, cybercriminals are also making their move. The Civil Guard in La Rioja has detected four attacks on WhatsApp accounts on iPhones registered in Calahorra, Haro, and Logroño in recent weeks. In one case, the victim suffered financial losses of €2.000. The most worrying aspect of this method is that the attacker can impersonate the victim within their own account to message family and friends asking for money, exploiting the existing trust.
Investigators from the Cybercrime Unit (EDITE) have found that these incidents have different characteristics than traditional ghost pairing attacks. In the cases analyzed, account holders confirmed that they did not provide verification codes or scan QR codes , and no unknown sessions appeared in the 'Linked Devices' section. These are zero-click attacks, which can compromise a device without any user action: it is not necessary to click a link, enter a password, or scan anything.
The exploited vulnerability, known as CVE-2025-43300, has already been patched in the latest versions of iOS, but it still affects those who haven't updated their devices. The only way to protect yourself is to install the latest operating system update , with iOS 18.7.8 or later, and enable two-step verification on WhatsApp. The Civil Guard also recommends periodically checking linked devices, being wary of any money requests received solely through WhatsApp, and always confirming requests through another method, such as a phone call.
The Spanish Data Protection Agency (AEPD) sanctions the dissemination of health data in neighborhood chat rooms.
Security isn't just a matter of technology. The Spanish Data Protection Agency (AEPD) has fined a homeowners' association €1.000 for sharing information about a neighbor's chemical sensitivity via WhatsApp groups. The agency argues that the informal nature of a neighborhood chat group doesn't exempt them from data protection responsibilities and reiterates that voluntarily disclosing a health issue to certain individuals doesn't authorize sharing it with other residents.
The case began when a resident informed the president of her building's residents' association about her chemical sensitivity in order to halt a phytosanitary treatment. The president then shared the medical report in two WhatsApp groups: one for the presidents of the communities that make up the association, and another for all the residents of the building. The Spanish Data Protection Agency (AEPD) considers that informing residents about the work stoppage does not justify disclosing a person's complete medical data , and has classified the action as a violation of Article 5.1.f) of the GDPR, concerning the principle of integrity and confidentiality, and Article 9, regarding particularly sensitive data.
The fine amounts to €500 for each of the two infractions, totaling €1.000. The ruling makes it clear that health data is especially sensitive and that its dissemination without explicit consent has legal consequences , even when it occurs in a seemingly informal context such as a neighborhood chat group. The Spanish Data Protection Agency (AEPD) reminds users that privacy is not suspended in WhatsApp groups and that administrators and participants must exercise extreme caution when handling third-party personal information.
New security measures to protect accounts
In response to this situation, WhatsApp has announced a series of security updates on its official blog. The company has implemented an access key for logging in, strengthened two-step verification, and requires users to provide more information before replying to an unknown contact. Two-step verification is no longer limited to a six-digit PIN : users can now set a longer password, including letters and symbols, which greatly hinders spoofing attempts.
The access key can be configured in Settings, under the Account section, and allows you to use your fingerprint, facial recognition, or the phone's normal unlocking method. On Android, more information will also be displayed about unknown contacts not in your address book , such as the country of origin of the number or whether you share any groups with them. According to the company, these measures aim to prevent users from falling victim to scams or online fraud , a threat that has increased in recent months.
Finally, it's worth remembering that security also depends on each user's habits. Updating the operating system, enabling two-step verification, checking linked devices, and being wary of any requests for money via WhatsApp are basic measures that can make the difference between falling victim to fraud and avoiding it. The combination of the expansion of integrated payments and the increase in attacks makes caution more necessary than ever.
