By Moti Shay · updated July 25, 2026
WhatsApp is scammers' favourite channel: everyone's on it, people trust the messages, and everything is one tap from being shared. Four big scam families circulate on loop: the fake relative in distress ("Mum, I lost my phone"), the theft of your verification code to hijack your account, fake prizes and promotions, and "investment" groups. Here's how to recognise each one — and how to check any message in seconds.
A message from an unknown number: "Mum/Dad, it's me. My phone broke, this is my new number. I have an urgent payment and no access to my bank — can you help?" It all plays on parental panic. The next step is always financial: a transfer, a "quick loan," card details. The defence is simple: call your child's old number. In the vast majority of cases, they answer — with their phone intact.
You get a text with a WhatsApp code you didn't request — then a message from a friend: "Sorry, I sent you a code by mistake, can you send it back?" That friend is already hijacked. If you hand over the code, the scammer takes over your WhatsApp and asks all your contacts for money in your name. Absolute rule: a verification code is never passed to anyone, ever. And turn on two-step verification (Settings → Account): it locks your account even if a code leaks.
"A major retailer is giving away $500 vouchers for its anniversary! Click here": the link leads to a short survey, then asks you to "share with 10 contacts" (that's how it spreads), and finally to pay "shipping" by card or install a malicious app. No retailer gives away vouchers through WhatsApp chains. If the offer isn't on the brand's official site, it doesn't exist.
You're added to a group with a "mentor" and dozens of enthusiastic members (mostly bots). After a few days of displayed "profits," they suggest you deposit a small amount — then a bigger one. The money isn't invested anywhere, and when you try to withdraw they'll demand "release fees" until you understand.
• Urgency and emotional pressure: "now," "urgent," "within the hour" • An unknown number claiming to be someone close • Any request for a verification code — a scam, no exceptions • A shortened link or a domain that doesn't match the brand named • "Share with your contacts to get the prize" • Typos or a machine-translation style
Long-press the message → Copy → paste it into the free Phishy checker on this page. The tool opens the link in an isolated environment (not on your phone), follows it to its real destination, and checks it against global phishing databases. In seconds: safe, suspicious or scam — with a clear explanation.
• Code shared: reconnect to WhatsApp with your number immediately, turn on two-step verification, warn your contacts that the account was hijacked. • Card details entered: block the card immediately and dispute the charges. • App installed: uninstall it, run a security scan, change passwords after removal. • In all cases: report the message and file a report if money was lost.
Never, with anyone — not even a close friend. That code is the key to your account. Whoever asks is trying to hijack an account: yours.
Call his old number first. If the message is real, he'll confirm it by voice. Never send money based on a written message alone.
Settings → Account → Two-step verification → Enable, then choose a PIN. After that, even a stolen SMS code can't hijack your account.
Not necessarily. "You've won" scams spread precisely through groups: whoever shared meant well but didn't check. Test the link before clicking.
Copy and paste it into the Phishy checker on this page — no signup, no install, answer in seconds.