Some people have discovered the fraud only after friends or relatives called to ask about an unexpected request for money. The Policía Nacional in Córdoba says criminals are using genuine WhatsApp accounts to contact people connected to their owners.
The account holder may continue using the app as usual while a third party sends messages in their name. The messages come from the victim’s normal number and profile, sometimes appearing in existing conversations. This differs from a conventional account takeover, where a victim gives away a verification code and loses access.
People affected say they did not share codes or scan QR codes. They report that the fraudulent messages are absent from their own phones and that no unfamiliar session appears under «Dispositivos vinculados». Often, they learn about the activity when a contact calls them.
The requests follow a familiar script. The sender claims to need urgent help, perhaps because their phone has broken or they cannot make a transfer, and asks for about €1,000. The money is to be sent to an account belonging to an alleged business or another person, with repayment promised soon.
Urgency paired with excuses to avoid a phone conversation is a warning sign, as are requests to pay a third party. The police say many recipients spotted the fraud by checking the request outside WhatsApp before sending money.
Verify any demand for money with an ordinary phone call or in person; a WhatsApp call or message does not independently confirm who is making the request. If it cannot be checked, do not pay. WhatsApp provides two-step verification and a «Dispositivos vinculados» screen for reviewing connected sessions. Keep the phone’s operating system and WhatsApp updated, and enable two-step verification. Never share registration codes or other account credentials, including PINs and QR codes, as the Policía Nacional advises. Check «Dispositivos vinculados» regularly and close sessions you do not recognise.
If someone is using your account, alert contacts through another channel so they do not pay. Keep evidence before deleting conversations or reinstalling the app, then report the impersonation to WhatsApp’s official support. Anyone who has transferred money should contact their bank promptly.
The Policía Nacional says people can report the impersonation or messages at any police station, even if no money was lost. Its 091 line is available 24 hours a day, 365 days a year.
