WhatsApp, text and email scams: how to spot them and what to do

A message scam almost always combines three things: pressure, a request for money or a code, and a sender you cannot verify. If a message says it is urgent, comes from a new number belonging to someone you know, or asks for a transfer, a six-digit code or a click on a link, stop and check through another route by calling the number you already have saved. If you have already paid or shared the code, tell your bank immediately, recover your WhatsApp account with your phone number, warn your contacts and report it to the police.

How to spot a scam message

Banking and cybersecurity bodies on different continents, such as Febraban, the Brazilian banks' federation, and INCIBE, Spain's national cybersecurity institute, describe the same warning signs:

• Urgency or threats: your account will be blocked, the parcel will be returned, your relative has to pay a bill right now. The rush is there to stop you thinking.
• An unexpected request for money, usually through an instant payment that is hard to reverse, such as Pix in Brazil or Bizum in Spain.
• A request for a code: your WhatsApp verification code, a code sent by text, or a password. According to Febraban, legitimate banks do not ask for passwords by phone, text, WhatsApp or social media.
• An unknown number claiming to be someone close to you, with a story about a broken, stolen or replaced phone.
• A link to update your details, pay a fee or unlock something, sometimes with spelling mistakes or an address that looks like the real one.
• A request for secrecy: do not tell anyone, sort this out just with me.

The most common WhatsApp scams

The fake relative, often called the hi mum scam: someone writes from an unknown number, sometimes using your photo or a relative's copied from social media, saying they changed phones after a robbery or a loss. A request for an urgent transfer soon follows. INCIBE describes the same tactic in Spain, with texts starting hola mamá that move the chat to WhatsApp and end with a request for a Bizum payment or a transfer.

Account theft through the six-digit code: the scammer poses as staff from a shop, a bank or a website where you have an account and says they are sending a confirmation or promotional code. That code is the one WhatsApp sends by text when someone tries to register your number on another phone: whoever passes it on hands over the account. From then on, the criminal messages your contacts pretending to be you and asks for money. According to the WhatsApp Help Center, they cannot read your past chats, which are stored on your device, but they can talk in your name.

Fake texts (smishing): the fake delivery and the fake bank

According to INCIBE, texts tend to feel more trustworthy than email. The most common versions are the parcel held because the house number is missing or a fee is unpaid, the alert about a login from a new device, the blocked card and the suspicious charge you need to confirm. They all carry a link to a fake page that imitates the company's, or to a malicious app. And the sender name can be spoofed so it looks like your real bank.

Fake emails (phishing): bills and locked accounts

By email, the bait is a bill you do not recognise, a locked account warning, a prize or a tax refund. Before clicking, run through some of the checks on Febraban's anti-phishing list:

• Is the sender's address really the company's, or only the display name?
• Are there spelling mistakes, a badly drawn logo or strange formatting?
• Does it ask for personal data, a password or a card number?
• Does the link point somewhere other than the official site, or is the attachment an unusual file type?

When in doubt, open the official app or type the website address yourself and check whether the bill really exists.

How to avoid WhatsApp and message scams

1. Turn on two-step verification

   In WhatsApp, go to Settings, Account and Two-step verification. With it on, someone who gets your six-digit code still needs a second proof. The Help Center says the old six-digit PIN is becoming a password with at least 8 characters, including at least one letter and one number. Add an email address too, so you can recover the account.

2. Never share the code

   WhatsApp itself says your verification code should not be shared with anyone, not even friends or family. If you receive a code you did not request, someone is trying to register your number: ignore it.

3. Check through another channel

   A request for money only counts after you call the number already in your contacts, never the one that messaged you. INCIBE suggests agreeing on a family code word for these situations.

4. Do not click: go straight to the source

   Delivery, bank or shop: open the app or type the official website address. Install apps only from your phone's official store.

5. Hide what scammers use

   Make your profile photo visible only to your contacts and turn on the option to silence calls from unknown numbers in WhatsApp's privacy settings.

I fell for a scam: what to do, step by step

1. Call your bank right away

   If you sent money, contact your bank through the app or by phone and ask them to block and reverse the payment. The sooner you act, the better the chance the money is still in the receiving account.

2. Recover your WhatsApp account

   On the phone with your SIM card, open WhatsApp and register your number again with the six-digit code sent by text or call. This logs out the scammer and every linked device. If they turned on two-step verification, WhatsApp says to wait seven days and try again.

3. Warn your contacts and groups

   Tell people through another channel that someone is using your name. WhatsApp recommends trying to recover the account before reporting it, because a report can get the account itself banned.

4. Keep the evidence

   Take screenshots, note the numbers used and the account that received the money, and keep the payment receipt.

5. Report it to the police

   File a police report with your evidence. In Spain, the Guardia Civil takes online reports of internet scams; in Brazil, each state's Civil Police runs an online station.

6. Change passwords and add protection

   If you typed a password into a fake site, change it and turn on two-step verification.

Paid by instant transfer? How to try to get the money back

Instant payments are hard to undo, so speed matters most. In Spain, INCIBE advises contacting your bank as soon as possible with a copy of the police report to try to cancel the operation, and escalating to the Bank of Spain if that fails. In Brazil, Pix has its own tool, the Special Return Mechanism (MED) of the Central Bank, which applies even when the victim authorised the transfer after being tricked, and can be requested up to 80 days after the payment through the bank's app or support channel. In both cases, any refund depends on the money still being in the account that received it.

How to report a scam on WhatsApp

In the chat with the scammer, open the options menu and use Block and Report. The reported person is not notified, and WhatsApp receives up to five of the most recent messages in that chat for review. If the scammer uses other numbers, each one has to be blocked and reported. A report in the app does not replace a police report.

Where to get help and report

• Spain: INCIBE's free cybersecurity helpline answers on 017 every day from 8:00 to 23:00, and also on WhatsApp (900 116 117) and Telegram (@INCIBE017). Reports go to the police; the Guardia Civil accepts online reports of scams and fraudulent charges made by electronic means, signed with an electronic signature.
• Brazil: a police report (boletim de ocorrência) at a station or through the state Civil Police's online station; your bank, for the Pix MED; and a complaint to the Central Bank if the bank does not resolve it.
• Anywhere else: if a crime was committed or you feel unsafe, WhatsApp advises contacting the police or local authorities.