/ Scams

Warning: fraudsters are posing as family members on WhatsApp

Scammers using WhatsApp are posing as family members in order to manipulate victims into transferring money. Here’s how it works.

23/12/21: Update

We’re seeing more and more reports of this scam from multiple sources, and even anecdotally from friends, family and Which? staff.

Here are examples of how these messages appear and how the fraudster attempts to move the conversation on once the intended victim has responded.

02/12/21: Posing as family members

Back in May we covered the ‘WhatsApp verification message trick’. Since then, someone targeted by that very scam got in touch when a fraudster pretending to be her sister took over her WhatsApp account.

They started a believable conversation with her, but then asked to borrow cash to pay for ‘car repairs’. Her sister was actually away at university at the time, so the request didn’t seem unusual – she transferred £350.

Later she received another message requesting a further £500 as the bill had been ‘more than expected’. Becoming suspicious, she called her sister who of course knew nothing about it, but was aware that her WhatsApp had been hacked.

‘This is my new number’ impersonation cons

In this case, her sister had indeed been caught out by the verification scam, allowing fraudsters to access her account. You can read more about the methods involved in that particular scam here.

However, we’ve also heard reports of entirely random phone numbers contacting people on WhatsApp, claiming to be a son, daughter or other family member or friend who suddenly has a ‘new number’.

While the techniques involved in contacting you are slightly different, the outcome will be the same: fraudsters are after your money and/or personal data. They will attempt to gain your trust in this way, before requesting money to solve a problem, such as the ‘car repair’ job above. This has become known as the ‘friend in need‘ scam.

Impersonation of friends and family is also common on other messaging apps, and email. We’ve seen cases where fraudsters have gained access to chat history and have continued conversations in progress, cunningly manipulating the course of the conversation into a request for money.

How to handle impersonation scams

If you get a request for money in a message, it’s always worth giving the contact a quick call on the original number you have saved for them to check the details before you go ahead, even if it’s a close relative. Don’t give security codes for any accounts to anyone.

There’s no way someone else’s code could be sent to you by accident. In the case we were contacted about, the money was sent using a bank transfer – the victim isn’t yet sure if she’ll be reimbursed. However, her bank is signed up to the code that pledges to refund customers that fall victim to bank transfer fraud like this.

Guide: how to spot a scam

Guide: how to get your money back after a scam

If she is able to show evidence that she was tricked into the transaction – possibly screenshots from the chat and any correspondence with WhatsApp – she should get her money back.

We let WhatsApp know these scams were continuing to take place on its platform. Its Policy Manager, Kathryn Harnett said:

“WhatsApp protects our users’ personal messages with end-to-end encryption, but we want to remind people that we all have a role to play in keeping our accounts safe by remaining vigilant to the threat of scammers. We advise all users never to share their six-digit PIN code with others, not even friends or family, and recommend that all users set up two-step verification for added security. And if you receive a suspicious message (even if you think you know who it’s from), calling or requesting a voice note is the fastest and simplest way to check someone is who they say they are. A friend in need is a friend worth calling.”

Have you been contacted out of the blue on WhatsApp in this way? Was it a random new number or had some accessed your family member or friend’s account? Let us know in the comments.

Comments

I’m curious about the WhatsApp scam described. It talks about money being transferred. Who to? I would have thought it would be sensible, under normal circumstances, to transfer to the sister’s bank account, in which case for the last year confirmation of payee would presumably apply (if the sister did not already havethe bank details).

I would also have thought that such a request for money would have been expected to be done verbally, not by a WhatsApp message. As was done the second time when the further payment was requested. Certainly when my family need help they ask for it personally, not through a messaging service.

As Lauren says ”If you get a request for money in a message, it’s always worth giving the sender a quick call to check the details before you go ahead, even if it’s a close relative.”. The payer seems to have been rather careless here. As the bank instructed to send the money had, presumably, no knowledge of the reason for the transaction I am puzzled to know why the sister should expect to get her money back, unless her bank can retrieve it for her.

Maybe there are details we haven’t been told?

malcolm r not all people deal with things the way you do. I have two great nephews who i helped raise and they both often ask for money to be transferred to their accounts. I have asked them to please ask me instead but they say they feel awkward. We are now thankfully in a situation that i don’t send money at all.

Even if your relatives feel awkward asking you directly for money and prefer to use social media, there is no reason why you could not speak to them to confirm that it was themselves who were contacting you. I am glad your situation has changed and that you are no longer needing to transfer money, but a similar request could arise at some time in the future and you need to be satisfied that your money is not going to a fraudster.

Patricia Heath says:
2 December 2021

I received one of these texts last impersonating my Son who stays in Wales I live in Scotland.It started with Hi mum dropped my phone down the toilet so this is the number I’m using.Just checked my emails and I have a bill to be paid today could you pay it and I’ll pay you back tomorrow.I text back and asked how much for they text back and said oh there is 2 one for £990 and the other for £980 anyway I got a hold of my son and it wasn’t him thank god something smelt off

Claire says:
2 December 2021

I had this scammer contact me and they wanted the money transfered to a third party account. The story goes “my phone has died and I ‘m using this number and need you to make an urgent payment to X plus the account details.” I played along and got 2 sets of bank details and sent them to the Fraud Squad but no positive response.

Im not sure but this may have happened to me. Its the girl friend and biological father of my great granddaughter who is on my friends list. I gave 180 in total before refusing to give more. I was sent pictures of text saying money would be transferred back into my account but it never happened. I have never spoken to them other than on Watts app. The texts seemed genuine, asking for taxi money as they were stuck and food money etc. As I transferred the money into an account I used some time ago, I am sure it was her account as it matched.

Mr Mark Richardson says:
2 December 2021

What gets me is you go on & on & on, instead of just expressing the difference between the two, fake & real. That to me adds insult to injury, especially to the innocent victims of such. Blind, the deaf. Etc. It’s a bit like listening to a politicians speech. Then saying. “You what”! Were not all computer genie’s!
I appreciate your intention to advise, help the illiterate. Just show a real, then fake item first, then explanation after.
Thanks

Mr Mark Richardson — Not everyone thinks Which? is wasting their time with these important warnings and guidance on dealing with fraudulent messages. Scammers are a criminal menace and the public need to take notice and take care not to get embezzled out of their money. See Ann Cooke’s [and other readers’] comments.

I was contacted on WhatsApp. I got a message that said ‘Hi mum, this is my new number’. The reason i was immediately suspicious was because both of my sons were born and still live in the US. They refer to me as MOM not MUM and we have never contacted each other via WhatsApp. I sent a message back asking who it was but thankfully did not receive a reply. I have had several attempts by scammers to obtain my bank details but thankfully i don’t give anything out and tell them i will call my bank myself. This whole scamming situation is very scary and unfortunately [i’m genuinely not being racist] all of those that have actually spoken to me have all had Asian accents, it is what it is!

What is being done to bring down these evil people who prey on the elderly and those with limited IT skills? Are they ever brought to justice? Or do they remain forever in the dark world of deep Cyberspace? Thank you for all you do to bring awareness to people. But is the job too huge to be effective? How can we help?

I wish I’d had this on Monday. On Tuesday I received a WhatsApp and it could only have been my daughter, I thought. I’ve lost an enormous amount of money. I hope I can get it back.

Julie says:
19 December 2021

This happens to me Friday I lost money too I hope I get mine back to because I’m a pensioner and I don’t know how I’m going to pay it back on a state pension 😢

Paul Richardson says:
2 December 2021

Had nearly exactly this scam played on me.
My daughter (Lives with her mother abroad) claimed to have a new phone number and needed money to pay a bill her in the UK for her new phone… an iPhone at £1300.
Even called the new number and got “pocket static” – which the scammer claimed was because the new SIM wasn’t activated to allow talk. Played the heart strings that didnt want to get in trouble with her mother. Did I not love her. Provided UK bank sort code account number and fake billing details – all very convincing. Luckily my bank stopped the transfer and asked me to contact them. Eventually contacted her mother who confirmed it was a scam. our daughter did not have a new number/phone.
Watch out!!

Thank you Which? for writing this article – very helpful. I have been considering switching to Signal or another messaging app, as our son lives in SA, and our conversations with him and his family would not be protected.
However, I’m puzzled by your fleeting reference to Gmail. We have a Gmail email account. Are you saying it is unsafe?

Had one from my son saying he had damaged his phone and had a new number and was I at home, I responded “of course”. I changed my contact number to reflect his new number. Fortunately he lives with me at the moment so when he arrived home I asked him what had happened to his phone. Nothing had happened – then I knew it was a scam. It is very worrying as I keep myself up with the latest scams but I nearly fell for this one. Like we are always being told … remain vigilant. Such an easy thing to fall for if they have the messaging right. Good news is its reminded me to keep an eye out for messages that might not be quite right. On reflection I now know he would have told me about his phone when he arrived home as no need to inform me before then.

I was texted on WhatsApp. It was the ‘new number’ scam.
It started, ‘ Hi mum’ and advised of a new number and that the phone would not switch on, but I could communicate by text.
Luckily for me, co-incidentally, my son texted and I mentioned his new phone! When he laughed I knew there was no new phone and became suspicious.
I then responded to the scam call texting ‘ who are you?’ The answer was ‘The oldest. Xx.’
It would have been an odd time for my oldest to contact me- he lives in Australia. That made me more suspicious
So I texted him later also no new phone.
I do have two stage authentication, but changed my PIN. Just in case.

Zoe Wright says:
2 December 2021

I have had the new number scam. But they refused to give a name, said “the oldest” and used language that my daughter never uses ,far too soppy. So I asked about her dog but gave the wrong name. They fell right into it so I said bye, and deleted all the calls

Ann Wright says:
2 December 2021

I received a WhatsApp text purporting to be one of my sons. It started hi mum, it’s me. This is my new phone number as I’ve broken mine. I asked which son it was & got back who do you think it is. To cut a long conversation short I got a text saying my son needed to pay a couple of bills urgently but without his phone he couldn’t do it & would I transfer the money (around £1200) for him. By this time I had major doubts & managed to contact son who of course knew nothing about it. I therefore strung the scammer along, agreeing to transfer money & was given account details. Scammer then wanted a picture of transfer. When I asked whether I should send a pic to the police I received the word b***h & no further message. I reported all this to action fraud & local neighbourhood watch. It left me feeling quite shaken as to how close I’d been to being scammed.

Mrs Gillian Marchant says:
2 December 2021

I had a Whatsapp message – ‘ Hi Mum, you will never guess what happened to me today, this is my new phone number’. I did contact one of my sons to make sure it was a scam and he assured me it was and to delete it, which I did. I don’t trust anyone nowadays, which is a shame. Something needs to be done to stop them.

Nigel says:
3 December 2021

I was contacted on WhatsApp saying mother I have changed my number. I sent it back saying you have the wrong number. They then came back and said no. I decided there and then to block them.

Teddy says:
3 December 2021

The report mentioned a six digit code for WhatsApp. I have never seen this code. What is it, and where does it come from?

It’s an authenticator code that comes direct from WhatsApp when you log in from a new phone or device or make some sort of change. You need to text it back to WA to verify your account. What happens is that scammers attempt to log into your WA account; WA sends you a code and you then need to text it back to WA thereby telling them that it’s you that’s trying to log in. I’m a bit hazy on the details so it might be helpful if somebody that actually knows can confirm these.

Anyway, the scammer will then send you a text saying that they’ve sent you the code accidentally and ‘pretty please’ could you send it back to them. Do this and it’s game over – they will then have access to your WA account with all your personal details and contacts – who they will try to get money from as in the scams above and/or take over their accounts by the same method.

Bottom line is, if you ever receive a six-digit code from WA and you haven’t changed your phone or made any other sort of change – be instantly suspicious and do not, whatever you do, send that code to anybody else.

Neeru says:
3 December 2021

I had a similar experience last week – starting ‘Hey mum’ & asking first if I was ok, telling me that it was a new number & to message back that I’d received their message… I did. When I asked if they were ok too, I was told ‘no – I’m not’. I asked ‘what’s wrong’, and after a couple more messages, claiming it was my daughter, they said they don’t have online banking – ‘mum I need to pay two invoices by 6pm, so I don’t get bailiffs coming – can you please be my saviour’ – or words to that effect.
It was only then, that I called my daughter, who said her phone was fine & she hadn’t messaged me.
I reported the number to WhatsApp, who immediately ‘retrieved’ the messages – they disappeared from my phone. I also sent the scam number to my network provider. I don’t know what happened after that, but It’s definitely made me more vigilant about responding & believing messages like that.

Robbo says:
3 December 2021

Just because the banks have signed up to the refund scheme (and this is by no means all of them) don’t believe for a minute that you’ll get refunded. For a start at the moment I think it’s still voluntary. You as a customer will always get the blame for negligence. Also if the money is transferred to a bank that has not signed up to the scheme you are absolutely guaranteed to get zilch. This business is basically theft and thanks to decades of government spending cuts, you can report these things to the FSCS and will probably not live long enough to get an answer, which will probably be no anyway. Social media is too easily hacked and considering how much they make, can easily afford to eliminate this type of activity.

Last week I got a scam massage sent by someone using a friends whats app account.
Lucky for me i knew that this friend would not use her account in this way and I was able to block the account after letting the friend know that it had been hacked.

I once got an email from a friend to say she had been mugged while on holiday abroad and wanted me to send her some money. It was not a lot of money so my immediate thought was to send it, but I phoned her first to check. It turned out that her email account had been hacked and everyone she knew had got a similar email.

It is a sick world we live in when some people are prepared to try to rob others in this way. Nowadays it’s best to assume that emails and phone calls are malicious and not to give away any information. You have done what seems obvious, Martin, but it does not take many people who are trusting to make scamming worthwhile.

David g says:
4 December 2021

As the Bank knows who owns the account to which the scam money is sent, why don’t they inform the police?