The National Police in Alicante have issued a warning regarding a rise in reports of fraud involving the hijacking of WhatsApp accounts. Cybercriminals are stealing the digital identity of victims to contact their family, friends and acquaintances to demand money, exploiting their existing personal relationships.
While the number of incidents recorded in the province of Alicante remains low at present, officers issued the alert following a significant increase in complaints over the past month in other parts of Spain.
Investigations show that the scams follow a consistent pattern. Fraudsters gain control of a victim’s WhatsApp account and impersonate them within recent chat conversations to ask their contacts for money transfers. In several instances, the scammers even provide bank account details, which sometimes belong to foreign institutions.
A notable feature of this particular cyber fraud is that victims are still able to use their WhatsApp application as normal. The cybercriminals manage to send messages using the victim’s identity without logging the real user out of the account. The National Police also warned that unrecognised active sessions may not even show up under the “Linked devices” section within the application settings.
Consequently, affected users may not immediately realise that someone else is using their account. In the meantime, their personal contacts receive requests for money within ongoing, familiar messaging threads. For the recipient, the request can look entirely genuine because it comes directly from the usual phone number, displays the correct contact name, and appears in an established chat history.
Victims affected by the scam have confirmed that they never shared registration codes or PINs, scanned QR codes, or knowingly linked their WhatsApp account to another person’s device.
To guard against the scam, officers advise users to keep their phone operating systems and the WhatsApp application updated to the latest software versions. They also recommend enabling two-step verification and regularly checking the “Linked devices” feature to log out of any unfamiliar sessions, although they caution that finding no unknown devices is not a guarantee that an account has not been compromised. Furthermore, people should never share SMS codes, QR codes, or registration and verification codes with anyone else.
If anyone discovers that their account is being used to ask for money, the police advise using alternative communication methods to notify family and friends immediately so they can ignore any financial requests. Victims should also report the impersonation directly through official WhatsApp support channels and visit a local police station to file a report.
