WhatsApp Scam Examples: Verification Codes, Hijacked Contacts and Fake Links

Most WhatsApp scams don't rely on a fake login page at all. They rely on you trusting a message that appears to come from someone you already know, or on you handing over a real, legitimate verification code without realizing what it actually authorizes. That difference is what makes WhatsApp scams effective even against people who'd never fall for a typical phishing email.

This guide covers how these scams actually work, including the account-takeover techniques that don't involve a fake website at all, and what to check before you reply, forward a code, or scan a QR code.

Why Attackers Target WhatsApp Accounts

• A takeover gives attackers a ready-made list of trusting contacts to target next.
• Messages from a "known" contact bypass the skepticism people apply to strangers.
• WhatsApp is used for everyday money requests, so a payment ask doesn't stand out.
• Most people don't realize a six-digit SMS code can hand over their entire account.
• WhatsApp's own linked-devices feature can be abused if a QR code is scanned carelessly.

Common WhatsApp Scam Examples

The Verification Code "Wrong Number" Scam

An attacker enters your phone number into WhatsApp on their own device, which triggers a real six-digit verification code sent by SMS to your phone. Moments later, you receive a message — often from a number styled to look like a friend — asking you to forward that code.

Hi, it's me, I sent my verification code to your number by mistake! Can you send me the 6-digit code you just got?

That code is not a mistake — it's the actual code needed to activate your WhatsApp account on the attacker's device. Forwarding it hands over your account immediately.

Hijacked Contact Asking for Money

Once an account is taken over, attackers message the victim's real contacts, impersonating them convincingly because it's genuinely their name, photo, and chat history.

I'm in a bit of trouble and need to send money urgently but my banking app isn't working. Can you transfer €200 to this account and I'll pay you back tonight?

Because the request comes from a real, trusted contact's account, victims are far less suspicious than they would be of a message from a stranger.

The Linked-Device QR Code Scam

WhatsApp Web and Desktop work by scanning a QR code to link a browser or app to your phone's account. Some scams present a QR code — in person, over a video call, or as an image — under a false pretext ("scan this to enter the giveaway," "scan this to join the group") and use it to silently link the attacker's device to your account instead.

Once linked, the attacker can read your conversations in real time without ever needing your password, because WhatsApp accounts don't use one in the traditional sense.

Fake WhatsApp Business or Brand Support Messages

Attackers impersonate a company's official WhatsApp Business account — sometimes copying a real business's name and photo closely — to send fake order confirmations, delivery notices, or "customer support" messages that lead to phishing links or request payment information.

Fake Prize, Lottery, or Giveaway Messages

A message claims you've won a prize from a well-known brand and asks you to click a link or forward the message to a number of contacts to claim it.

Congratulations! You've been randomly selected to receive a €500 gift card. Claim it here before it expires.

These links typically lead to data-harvesting forms, fake surveys, or pages that request personal or payment details.

Fake "WhatsApp Update" or "WhatsApp Gold" Link

A message claims WhatsApp requires an urgent update, or advertises an unofficial "premium" version with extra features. The link leads to a file or app outside the official app stores, which can carry malware rather than any real WhatsApp feature.

Common Warning Signs

• Anyone — even someone who appears to be a known contact — asking you to forward a verification code.
• An urgent money request from a contact, especially one that avoids a phone call.
• A QR code you're asked to scan for an unrelated or vaguely explained reason.
• Sudden, out-of-character messages from a contact's usual writing style or number.
• Prize or giveaway messages that ask you to forward the message to unlock a reward.
• A link to install WhatsApp or a "special version" from outside your phone's official app store.

How to Verify a WhatsApp Message

1. Never forward a verification code to anyone, for any stated reason — WhatsApp never needs someone else to relay your code to you.
2. If a contact asks for money, call them or verify through a different channel before sending anything.
3. Before scanning any QR code, ask what it actually links — WhatsApp only ever asks you to scan one to link a new device under Settings → Linked Devices, initiated by you.
4. Check WhatsApp Settings → Linked Devices periodically and remove any device you don't recognize.
5. Install WhatsApp only from your phone's official app store, never from a link in a message.
6. Treat unexpected prize or giveaway links the same as any suspicious link — don't click without checking the destination first.

If a message contains a link and you're unsure where it actually leads, check it with 2check.click's URL checker, or use the QR code checker if you were sent a code instead of a link.

How 2check.click Helps

2check.click can analyze a suspicious link or QR code sent through WhatsApp and show you the real destination, any redirects, and common phishing indicators before you open it.

It can't tell you whether the person messaging you is genuinely who they claim to be, and it can't recover a hijacked WhatsApp account — verifying an unusual request through a different channel, and securing your account directly in WhatsApp's settings, are still things only you can do.

What to Do If Your WhatsApp Account Was Taken Over

• Reinstall WhatsApp and verify your number again — this immediately invalidates the session on the attacker's device.
• Enable two-step verification (a PIN) in Settings → Account so a code alone isn't enough to take over the account again.
• Warn your contacts through another channel that your account was compromised and not to trust recent messages or money requests.
• Check Settings → Linked Devices and remove anything unfamiliar.
• If you sent money because of a hijacked-contact request, contact your bank or payment provider immediately.

If you also entered a password or personal details somewhere as part of the same incident, see I Clicked a Phishing Link, What Now? for further steps.

Related Guides

• Apple Scam Examples
• What Is Smishing
• Are QR Codes Safe?
• How to Tell If Your Account Has Been Hacked

Frequently Asked Questions

Why would forwarding a text message steal my WhatsApp account?

Because that "text message" is usually the real verification code WhatsApp sends when someone tries to activate your number on a new device. Forwarding it completes that activation for them, not for you.

Can someone hack my WhatsApp just by sending me a QR code?

Only if you scan it inside WhatsApp's device-linking feature. A QR code by itself does nothing — the risk is scanning one under a false pretext using WhatsApp's own "Linked Devices" scanner.

My friend's account is asking me for money — how can I be sure it's really them?

Contact them through a phone call or a different app. If their WhatsApp has been taken over, a voice call is one of the fastest ways to catch the impersonation.

Does WhatsApp ever contact users directly by chat?

WhatsApp itself doesn't message you individually to request codes, payments, or personal information. Treat any message claiming to be "WhatsApp Support" with suspicion.

Final Thoughts

Most WhatsApp scams don't need to break into anything — they just need you to hand over a code, scan a QR code, or trust a message because it looks like it came from someone you know. Never forward a verification code, verify unusual requests through a second channel, and check Linked Devices regularly so an unfamiliar session doesn't sit there unnoticed.