Cybercriminals take control of WhatsApp accounts in moments; know how to defend yourself
WhatsApp accounts have become one of the main focuses for criminals who use social engineering tactics to carry out fraud. In increasingly elaborate schemes, scammers are able to take over a victim’s profile in a matter of moments, right after obtaining the application’s security code. On Thursday, July 10, 2026, this type of action continued to worry users, as experts warned.
The dynamics of the attack usually begin when the fraudster tries to register the user’s phone number on a different device. For the operation to be completed, WhatsApp itself forwards a verification code directly to the legitimate owner of the account.
On the same topic: Fake police scam in Japan extracts 5.68 million yen from man with isolation tactics and artificial intelligence threat
Subsequently, the scammer establishes contact with the victim, often pretending to be an acquaintance, a relative or even a representative of an organization, claiming to have sent the code “by mistake”. At this point, he asks the victim to reveal the numerical sequence received. When the user provides this code, access to their account is immediately transferred to the criminals.
Once in control of the profile, attackers gain unrestricted access to messages, images and files stored in the application. Furthermore, it is common for them to use the hijacked account to request financial transfers from the victim’s friends and family or to distribute fraudulent links, looking for new people to deceive.
How to identify possible scam attempts
- Requests to share a security code received via SMS or the app itself.
- Announcements that employ an emergency tone or that press for immediate action.
- Financial or bank transfer requests that arise completely unexpectedly.
- Messages from family contacts or friends that present atypical and unusual requests.
Digital security professionals emphasize that no legitimate institution or service provider will ever ask for the verification code that is sent directly to the user. This code is personal and non-transferable, serving as the master key to your profile.
See Also
Pokémon Go users report massive failures with login and connection to the game server
Instability in the Nubank application affects customers and service is normalized in a few hours
Tsitsipas overcomes initial challenge in Cincinnati and prepares for duel against Aliassime
More on this story: Security on WhatsApp: learn how to identify signs of cloning and protect your account against attackers
Essential measures to ensure account security
- Never reveal the security code that arrives via SMS or through the messaging app.
- Enable the two-step verification function by establishing an additional PIN for greater security.
- Employ cell phone locking features such as biometrics or facial recognition to secure access to the device.
- Set a robust PIN that is unique to the application, avoiding obvious or repeated combinations.
- Configure the device to not display the content of messages on the lock screen, preserving privacy.
- Always check, via a phone call or other channel, any request for money received via WhatsApp.
Two-step verification is widely recognized as one of the most effective protective barriers. It adds an extra layer of security by requiring a unique PIN even if the scammer manages to intercept the initial confirmation code.
One of the most serious consequences of hacking a WhatsApp account is that the damage can extend to the victim’s entire network of contacts. Upon gaining access to the profile, criminals often exploit this trust, requesting bank transfers, personal information or distributing fraudulent links, which exponentially amplifies the reach of the scam.
Learn more: Moroccan is detained in Paraná after carrying out a scam and abandoning women at a bus station
Given this scenario, cybersecurity experts strongly recommend that any unusual or suspicious request that arrives via the messaging application be rigorously verified by another means of communication, such as a direct call, before any interaction or sending of values.
