The scam doesn't arrive from a stranger anymore. It arrives from your sister, your old classmate or your boss, in an existing chat, because their account has been taken over. That's why WhatsApp scams work so well: the message really does come from someone you know. The attacker has only borrowed their account.
This guide covers the seven scams behind most reported losses, with the numbers police have published, the tell-tale signs of each and the steps to take if you've already responded.
TL;DR
- The most common WhatsApp scams are a friend asking for your six-digit code, a hijacked contact asking for money, "Hi Mum" new-number messages, fake photo or vote links, fake WhatsApp Web pages, screen-sharing with a "bank officer" and fake job offers.
- In Singapore alone, police reported at least 128 impersonation cases and S$249,000 in losses between September and October 2026 from hijacked accounts.
- A WhatsApp code is a key to your account. Nobody legitimate will ask you for it.
- For any money request, call the person on a number you already have. Don't use the chat to check.
- A VPN does not stop scams.
How WhatsApp scams work
Almost every one of them uses the same three moves:
- Borrow trust. A hijacked contact, a "new number" from a relative or a message from a "company".
- Create urgency. A lost phone, a blocked card, a prize that expires, a job that's filling.
- Ask for something you can't take back. A code, a pairing request, a transfer or a gift card.
Knowing the pattern is more useful than memorising every variant, because the details change every few months.
The seven scams
1. "I sent you a code by mistake"
How it works. The scammer types your number into WhatsApp to log in as you. WhatsApp sends you a six-digit code by SMS or message. A moment later a friend, whose account the scammer already controls, writes: "I sent my code to you by accident, can you send it back?"
The facts. Singapore police warned in May 2026 that this was driving a wave of cases: at least 52 reports and S$46,000 in losses since April 1. Once you hand over the code, the scammer logs in as you and the cycle repeats with your contacts. Police say never to give your WhatsApp code to anyone, because you lose access to your account.
Red flag. You received a code you didn't ask for, followed by a message asking for it.
2. A hijacked friend or relative asking for money
How it works. The scammer controls a real account and messages its contacts. The reasons repeat: "I've reached my transfer limit", "my bank app is locked", "can you pay this for me and I'll send it back?"
The facts. On October 21, 2026, Singapore police said that since September there had been at least 128 cases and at least S$249,000 lost to scammers using hijacked accounts to ask for loans. Some victims received messages from "children" asking them to pay for an exchange programme. In the first half of 2026, Singapore recorded 391 impersonation scams through compromised WhatsApp accounts, 66.6% of its social media impersonation cases, according to The Straits Times. Read the police advisory.
Red flag. A familiar person who suddenly needs money, can't speak and gives you an account number you've never seen.
3. "Hi Mum" and "Hi Dad"
How it works. A message from an unknown number says: "Hi Mum, I've lost my phone, this is my new number." Within a few messages comes a bill that can't be paid because online banking is "locked".
The facts. Australia's competition regulator reported in August 2022 that more than 1,150 Australians had fallen for it in seven months, with A$2.6 million lost, most often through WhatsApp, the ACCC said. In the UK, Action Fraud received 1,235 reports and £1.5 million in losses between February and June 2022, Which? reported. Scamwatch recorded 9,307 reports of "Hi Mum" family impersonation in the year to late November 2023, it said.
Red flag. A new number plus money plus urgency. The fix is to call your child on the number you already have. If they pick up, you know it's a scam.
4. The "I found your photo" or voting link
How it works. A friend sends a link: "Hey, I just found your photo!" or "Please vote for my niece". The page copies a Facebook-style viewer and asks you to verify with a code or QR. What you enter is WhatsApp's own pairing code, which links the attacker's browser to your account.
The facts. Gen Digital named this GhostPairing in December 2025. There is no password theft. The victim approves the attacker, and the phone keeps working normally, so many don't notice. Gen's report says the attacker can read synced history and media and message contacts as you.
Red flag. Any link that asks you to "verify" through WhatsApp to see something.
5. Fake WhatsApp Web
How it works. You search for WhatsApp Web, click a sponsored or lookalike result and land on a page showing a QR code. It is a real code, copied from the official site. Scanning it logs the scammer in, not you.
The facts. Singapore police warned in 2023 that victims lost S$176,000 to this variant in a few weeks, and described the same technique again in 2024. The correct address is web.whatsapp.com. See the 2023 advisory.
Red flag. Reaching WhatsApp Web through an ad or search result instead of typing the address.
6. The "bank officer" who asks you to share your screen
How it works. A caller on WhatsApp pretends to be from a bank or a government agency and asks for a screen share "to verify details". While you share, they trigger a WhatsApp login on their side. The six-digit code arrives on your screen, which they can see.
The facts. Singapore police described this exact trick in June 2024. A real bank will not ask you to screen share a messaging app.
Red flag. Any request to share your screen with someone who called you.
7. Job and "task" offers
How it works. You get an unsolicited message about easy remote work, good pay and quick onboarding. Later you're asked for fees, personal documents or "deposits" to unlock earnings.
The facts. Australia's Scamwatch reported that job and employment scams were the fastest-growing scam type in 2023, with losses up 435% to A$22.7 million year to date. Recruitment scams also featured on UK mobile operator Virgin Media O2's 2025 list of most reported scam texts.
Red flag. An employer you never contacted, offering high pay for little work, via WhatsApp.
Red flags that apply to all of them
- A request for a code, a PIN, a QR scan or a pairing code.
- A new number claiming to be someone you know.
- Money plus urgency.
- Unusual wording from a person you know well.
- Links that ask you to log in through WhatsApp.
- Reluctance to talk on the phone.
What to do if you responded
- Money sent? Call your bank straight away to try to stop or recall the transfer. Speed matters.
- Gave a code or scanned a QR? Open WhatsApp, check Settings > Linked Devices, remove unknown devices, then turn on two-step verification. Our guide to recovering a hacked WhatsApp lists the steps in order.
- Gave bank or card details? Tell your bank and change online banking credentials.
- Warn your contacts if your account was used.
- Report it. Use Block and Report in WhatsApp, and report to your national authority: in the United States, ReportFraud.ftc.gov; in Australia, Scamwatch; in the UK, Action Fraud; in Singapore, the ScamShield helpline.
How to protect yourself and your family
- Agree on a code word with relatives. If someone asks for money, ask for it.
- Never share a six-digit code, a PIN, a QR code or a pairing code.
- Turn on two-step verification: Settings > Account > Two-step verification.
- Silence unknown callers in Settings > Privacy > Calls, and set Groups to "My contacts".
- Review linked devices once a month.
- Get WhatsApp only from your app store, and open WhatsApp Web by typing web.whatsapp.com.
- Use WhatsApp's own scam guidance for the latest patterns.
More settings are in is WhatsApp safe.
Where a VPN fits
Not here. Every scam above works through a person, a code or a pairing request. A VPN doesn't stop a hijacked friend from messaging you, and it doesn't check whether a link is genuine.
A VPN does one separate job on the connection side, which is protecting what a shared network can see, and for that Atomic VPN is a fair addition to the habits above. It is no substitute for them.
The one rule
If a message asks for a code or money, stop and call the person on a number you already have. That single habit defeats most of the scams on this page.
