WhatsApp has more than 2 billion active users across 180 countries, making it the world's most popular messaging app and one of the most targeted platforms for scammers. WhatsApp removed 6.8 million accounts linked to large-scale scam operations during the first half of 2025, many tied to organized crime networks in Southeast Asia. In December 2025 alone, scammers sent 19.2 billion spam text messages globally — about 63 per person in the United States. The FTC reports that losses from text-based scams reached $470 million in 2024, and that number continues to climb as WhatsApp-based fraud becomes increasingly sophisticated.

Why Scammers Target WhatsApp

WhatsApp's features that make it convenient for legitimate users also make it attractive to criminals. End-to-end encryption means message content is difficult for platforms and law enforcement to monitor. Group chats can host hundreds of members, allowing scammers to reach large audiences at once. International messaging without phone charges enables scam operations in countries like Myanmar, Cambodia, and Nigeria to target victims in the United States, United Kingdom, and Australia at no cost. And the trust people place in messages from "known contacts" makes WhatsApp impersonation scams especially effective.

The Most Common WhatsApp Scams

Account Hijacking

This is the most damaging WhatsApp scam because it gives criminals full access to your account and contacts. The scammer triggers a verification code to be sent to your phone number, then contacts you — often posing as a friend whose account they have already compromised — and asks you to forward "a code that was sent to you by mistake." Once they have the code, they take over your account and immediately target your contacts with the same trick or with money requests.

In December 2025, researchers at Malwarebytes documented a technique called GhostPairing, which exploits WhatsApp's linked-device functionality to hijack active sessions without needing the verification code at all. As of February 2026, a separate phishing campaign targeting WhatsApp users has been observed in more than 15 countries according to Whalebone Threat Intelligence.

The "Wrong Number" Scam

You receive a friendly message that appears to be sent to the wrong person. "Hey, is this Jessica? I just got a new phone and lost my contacts!" When you reply to correct the mistake, the scammer pivots to casual conversation. Over days or weeks, they build rapport before steering the conversation toward cryptocurrency investments, dating, or business opportunities. This is a hallmark opening tactic for pig butchering scams, which have become the largest category of financial fraud worldwide. A Bay Area man lost $1 million after responding to a seemingly innocent wrong number WhatsApp message.

Fake Job Offer Scams

Messages arrive offering high-paying remote work — data entry, product reviews, social media engagement — with minimal qualifications needed. The "employer" asks for personal information including your Social Security number, bank details, or an upfront payment for "training materials" or "equipment." Some schemes involve task-based scams where victims complete small online tasks, see fake earnings accumulate, and are then asked to deposit money to "unlock" their payments.

Crypto Investment Groups

Scammers add you to WhatsApp groups filled with fake members who post screenshots of enormous trading profits. A "group admin" poses as a financial expert or influencer and directs members to invest through a specific platform. These platforms are fraudulent — they show fabricated gains, and when victims attempt to withdraw, they are told to pay "taxes" or "fees" first. The CFTC has issued specific warnings about crypto scam groups on messaging platforms.

Family Emergency and Impersonation Scams

"Mom, I dropped my phone and this is my new number. Can you send me money for an emergency?" This scam exploits the fact that WhatsApp messages from new numbers cannot be immediately verified. The scammer knows just enough about the family to seem credible and creates urgency around a medical bill, car breakdown, or legal situation.

Malicious Links and Malware

In 2025, a WhatsApp campaign spread malware through seemingly harmless memes and images that, when opened, gave hackers access to victims' personal data and banking applications. Other variants include links to fake login pages, fraudulent prize claim sites, or "WhatsApp Gold" upgrade invitations that install spyware on your device.

Charity and Disaster Relief Scams

Following natural disasters, health crises, or humanitarian events, scammers create WhatsApp broadcast lists soliciting donations. They share emotionally compelling images alongside cryptocurrency wallet addresses or payment links. None of the donations reach any actual cause.

Red Flags in WhatsApp Messages

• Messages from unknown numbers that immediately feel familiar or personal
• Requests to share any verification code sent to your phone
• Links to websites you do not recognize, especially shortened URLs
• Urgent requests for money from contacts who recently changed their number
• Investment opportunities shared by people you have never met in person
• Job offers that require upfront payment or excessive personal information
• Group additions to chats you did not join voluntarily

How to Protect Your WhatsApp Account

Enable two-step verification. Open WhatsApp, go to Settings, then Account, then Two-Step Verification. Set a 6-digit PIN that will be required whenever your phone number is registered on a new device. This blocks hijacking attempts even if a scammer obtains your SMS code.

Tighten your privacy settings. Under Settings, then Privacy, configure your profile photo, about, status, and last seen to "My Contacts" instead of "Everyone." This prevents scammers from harvesting your information to craft convincing impersonation attempts.

Disable group auto-add. Go to Settings, then Privacy, then Groups, and select "My Contacts" or "My Contacts Except." This prevents unknown numbers from adding you to scam investment or crypto groups.

Verify identity through a separate channel. If a family member, friend, or colleague sends an unusual request via WhatsApp, call them on their known phone number or reach out through a different platform to confirm. Never rely solely on a WhatsApp message to verify identity.

Review linked devices regularly. Check Settings, then Linked Devices, and remove any sessions you do not recognize. The GhostPairing vulnerability makes this especially important — an unauthorized linked device could be monitoring all your conversations.

Never click suspicious links. If you receive a link from an unknown contact — or an unexpected link from a known contact — do not click it. You can check suspicious URLs before opening them.

What to Do If You Have Been Scammed

1. Reclaim your account by logging back in with your phone number if it was hijacked
2. Enable two-step verification immediately after regaining access
3. Warn your contacts that your account was compromised so they do not fall for follow-up scams
4. Report the scammer by opening the chat, tapping the contact name, and selecting Report
5. File a report with the FTC at reportfraud.ftc.gov
6. Report to the FBI IC3 at ic3.gov for significant financial losses
7. Document everything with screenshots of messages, phone numbers, and any wallet addresses or payment links

If you lost money through a WhatsApp scam, consult our complete scam recovery guide for steps to maximize your chances of getting funds back.

Related Resources

WhatsApp itself is a secure and legitimate communication tool, but its massive global reach and encrypted infrastructure make it a favorite channel for scammers. The best defense is simple skepticism: if a message creates urgency, asks for money, or requests a verification code, slow down and verify through an independent channel before taking any action.