Most typical WhatsApp scams aren’t high-tech security breaches. They aren’t orchestrated by state-sponsored hacker groups with a bottomless wallet and military-grade technology. In fact, most of them are run by low-tech crime syndicates relying on social engineering techniques to take advantage of people’s blind spots and trust in others. Meta removed 6.8 million WhatsApp accounts associated with cyber crime and digital scams just in the second half of 2025. But the attacks show no sign of slowing down because they are low on cost and easy to spin up, with chatbots executing most of the legwork on autopilot. However, there’s a flip side to all this: social engineering only works when you don’t know what to look for. Most of these scams follow a specific playbook and have a similar pattern of execution. If you know what to watch out for, you can stop them before they compromise your data or lead you into a financial trap. Below are seven of the most common scams that WhatsApp cybercriminals like to run, with tips on how to safely avoid every one of them. Learn how to tell when you’re about to be scammed, enable new features that protect your account privacy, and know how to respond when an attack is already underway. You can enable two-step verification on WhatsApp under Settings > Account Credit: Meta The verification code hijackI’d rate this as the most dangerous WhatsApp scam in this list, because it locks you out of your entire account and puts it in the hands of the attacker. It’s also one of the simplest to execute. Here's how it works: A scammer enters your phone number on WhatsApp to log into your account using their device. This triggers WhatsApp to send a verification code to your registered phone number. Right on cue, someone pretending to be a friend or family member texts you with a request to share the verification code you just received under some false premise. If you hand over that verification code you received in response, that’s it: WhatsApp will log you out of your current device and transfer access of your account to the attacker, who can then do whatever they want with it, including changing all your credentials. Avoiding this attack is also equally simple. Just don’t share your WhatsApp verification code to anyone over a call or text, even if it seems like someone from your contact list. If you receive a message from WhatsApp with a new verification code, take it as a sign that someone’s attempting to hijack your account and don’t just assume it’s a glitch. Also make it a point to enable 2-step verification on your WhatsApp account as a standard practice, by navigating to Settings > Account > Two-step verification in the Android or iOS app. That way, an attacker with a stolen verification code won’t be able to get into your account right away, because they will also need to verify the request using your preferred authentication method. Faking an emergencyOnce an attacker has access to someone’s WhatsApp account, often by doing just as I discussed in the last example, they will fire off a string of messages using that compromised account to everyone in the victim’s contact list. They will pretend to be the victim in some kind of medical or financial emergency, then ask people to send them money as quickly as possible. Citing an emergency creates panic within people, which makes them less likely to verify the authenticity of the request. By the time the original victim gets around to sharing that their account has been hijacked, multiple people have already been scammed using that stolen account. Scammers will sometimes even use AI-generated voice messages to make the request seem legitimate, provided they already know what the real account holder sounds like. I always tell my friends and acquaintances never to transfer funds or honor a sensitive request sent over text without double-checking if it’s real. When you get a request like this on WhatsApp, simply call that person directly over the phone, using a known contact number that’s not been recently changed. If the requester claims that the number has changed or the phone is out of battery, that’s a red flag. If you’re worried that the request might be authentic, call someone else who lives near that person or go over physically to verify. Scammers often use hijacked WhatsApp accounts to ask for money Credit: Lifehacker Long-term digital romance scamsWhatsApp is a popular choice for online dating scams thanks to its popularity as a messaging service, but these scams rarely give themselves away at first. Instead, attacker spend months building rapport with a potential victim over long chains of text and audio messages. When they’re confident about the level of trust they have established, the asks begin. First, they ask for small transfers that don’t go over $100, citing something urgent but non-critical. Slowly, the requests grow in financial value until the victim realizes something’s up and calls it off. Family emergencies, personal cash flow issues, and even investment offers in cryptocurrency or private funds are often used to pressure victims into giving away money. If someone you’ve never met in physical space asks you for cash, that’s an immediate giveaway that something is wrong. Normal people rarely ask someone for money unless they know them well in person, so use caution whenever you spot a request like that. Premium app subscription invites This is a very common play that’s especially popular when targeting demographics with low digital literacy. You receive a private message from what looks like an official WhatsApp account claiming that you’ve been invited to try out a new subscription tier that isn’t available to the general public. Often, the message is accompanied by a link to download and install an app from an unknown source. As soon as you click on the link, it installs malware on your device that could range from ransomware to keyloggers, which can then be used to execute blackmails or cyberattacks. If you receive a message inviting you to WhatsApp Gold, WhatsApp Premium, or any other equivalent subscription tier that cannot be verified through official sources, do not click on the link. Also generally avoid installing apps that don’t come from official sources like Google Play or App Store, unless you explicitly trust the developer sending you the link. Apps installed from third-party links are not subject to the usual security audit that official marketplaces require them to clear, which increases the risk of being infected by malware. Most smartphones disable third-party app installation by default for this exact reason. If you want to be even safer, navigate to Settings > Privacy > Advanced inside WhatsApp and toggle on Disable link previews. While link previews in WhatsApp are generally safe, they can expose your device’s metadata and general geolocation to the website administrator for a small period, which can be used to escalate more sophisticated cyber attacks. Disable link previews is an advanced WhatsApp privacy feature you can enable with a click Credit: Meta Impersonating popular service providersA common pattern among WhatsApp scams is the use of official names and logos to impersonate service providers and trusted authorities, like banks, delivery services, tech support, and sometimes even local law enforcement. Since people are more likely to trust messages that come from these providers without further verification, it gives attackers the window they need to make otherwise unreasonable requests. If someone claims to be a bank employee who needs you to share a one-time password for a security check, offer to call them back using a known official number instead of continuing the conversation in the same (potentially compromised) channel. Same goes for anyone who identifies as a local law enforcement or tax department official. They could threaten you with non-compliance if you refuse, but remember that you can always call the agency and verify it with them officially, instead of acting on a random call. Sometimes, scammers even pretend to be tech support and ask for remote access to your device so they can troubleshoot an issue. IT staff knows not to do this outside of established channels.The problem with these requests is that they can vary wildly in how the attacker presents themselves and what their initial ask is. But the common thread is that organizations or their employees won’t typically call you from their personal number or even an unknown business number to ask for details. Just politely offer to call back using an official number that you can verify, then disconnect the call. That almost always stops these attempts right away, because they use a spray-and-pray approach to target large numbers of people and look for an easy mark. I’ve personally received multiple calls from people claiming to be local law enforcement reaching out about a passport address verification, but a quick call to the department landline showed that this wasn’t the case. Gamified job and interview scamsAccording to the FTC, people in the United States lost over $500 million in 2024 to job scams alone. With unemployment rates being as high as they are, most people don’t want to antagonize anyone coming to them with a job offer. Scammers know this and they count on it. It may start by getting a WhatsApp text from an unknown number with an easy remote work offer. Sometimes, they will even pay you small amounts to establish trust in return for simple jobs like boosting a product listing. Eventually, they’ll ask you to deposit a significant amount of funds with them before you receive the next batch of tasks, for “verification purposes.” That’s when you can immediately tell that something is wrong. Most people know that employers will never ask you for payment just to give you work, but scammers can come up with clever reasoning to justify these odd requests. Sometimes, the ask isn’t for a money deposit at all. Instead job scammers will demand access to your device or even ask you to complete a short survey using a (malicious) link. Your best bet for spotting job scams on WhatsApp is to never trust an unknown number with an offer of employment or even an interview. No matter how small the request, it may offer a way for them to compromise your device or gain access to your accounts. Simply ask them to communicate using an official company email address or landline. If they refuse, that’s a strong indication you're being targeted. Fake charity, disaster relief, and NGOsWhatsApp scams prey on people’s emotional vulnerabilities, which is why pretending to be a charity or disaster relief fund is a common way to trick people into sending money. Worse still, these messages often get forwarded from one victim to another without verification, creating a sense of implicit trust that is not earned but assumed. You can use platforms like Charity Navigator and CharityWatch to determine if a charity is real and obtain their official contact details for verification. Most legitimate charities do not solicit donations through WhatsApp, and even if one does, it’s better (and safer) to pay through an official method listed on their organization website anyway. A few more WhatsApp security tipsWhatsApp scammers often use real people’s likenesses to perpetuate scams. If you’re worried about your profile picture or identity being used to commit fraud, you can restrict your profile photo, about section, and activity status to Contacts only by navigating to Settings > Privacy.Periodically check for any unauthorized devices connected to your account by going to Settings > Linked devices. If you’re not sure if a log in came from a device you own, you should log out of all active sessions just to be safe. Under Settings > Privacy, you can choose to toggle on silence unknown callers to avoid being approached by scammers and attackers using numbers not in your contact list. WhatsApp now offers optional usernames for those who don’t want their phone number to be publicly visible on their account. You can access this feature by going to Settings > Account > Username on your mobile app. When you suspect that something is a scam, use the Report and block option to notify WhatsApp of the attempt so it can put the attacker’s account under review.