Don’t Get Caught! WhatsApp Scams To Watch Out For

Essentials to know

• Watch for “red flag” tactics: Modern scams rely on high pressure, secret requests, unexpected links/attachments, or sudden changes to payment details- often using public business info or polished AI tools to sound authentic.
• Beware the verification-code trap: Scammers try to hijack business accounts by tricking you into sharing your 6-digit WhatsApp registration code; never share this PIN under any circumstances.
• Verify AI deepfakes and audio: Voice notes and calls can now be convincingly faked using AI. Always independently call the person back on a known, saved number and establish a private “safe word” for urgent requests.
• Treat desktop attachments & links with caution: Malicious files labelled as “invoices” or fake updates like “WhatsApp Gold” can compromise your PC; only update via official app stores and verify unexpected documents before opening.
• Separate personal & business communications: Isolating work chats from personal messages using a dedicated business number (like YourBusinessNumber) makes out-of-place scam attempts instantly easier to spot.

How confident are you that you could spot a WhatsApp scam?

We’re all tempted to think we’d never fall for one, but these days, modern scams aren’t always badly written messages from obviously fake numbers. They’re designed to reach you when you’re busy, distracted or trying to deal with a customer quickly.

For small business owners, the stakes can be even higher. A scammer might pose as a supplier who has changed their bank details, a customer sending proof of payment or a member of staff who needs an urgent transfer. They may also try to steal your WhatsApp Business account, giving them access to a trusted number they can use to target your customers and contacts.

So, what should you be looking for? Read on to learn how WhatsApp scams work, which tactics are common in different countries, and what to do if your business is targeted.

The anatomy of a WhatsApp scam: red flags to watch for

WhatsApp scams come in many forms, but most rely on the same basic ingredients: trust, pressure and a request that takes you outside your normal process.

The scammer may impersonate someone you know, use the logo of a familiar organisation or refer to real details about your business. Information from your website, social media pages, company legal listings or public reviews can all make the story sound more believable.

Most commonly, scam messages will:

• Create an emergency or threaten immediate consequences if you don’t take an action now
• Ask you to keep the request secret
• Come from a familiar person using an unfamiliar number
• Claim that payment or bank details have suddenly changed
• Ask for passwords, registration codes or 2-step verification PINs
• Include an unexpected link, QR code or attachment
• Push you to pay using gift cards, cryptocurrency or an instant transfer
• Offer a refund, rebate, prize or opportunity you weren’t expecting
• Ask you to move a conversation away from an official platform
• Tell you not to call the person or organisation directly

Poor spelling can still be a warning sign, but you shouldn’t depend on it as a test. Now, AI tools can help criminals create polished, natural-sounding messages in different languages.

If a request is asking for money, data or account access, pause and verify it independently. Don’t use the number, link or contact information supplied in the suspicious message; instead, call a number you already trust or visit the organisation’s official website yourself.

The verification-code trap: how scammers hijack business accounts

A WhatsApp account is registered using a six-digit code sent to the relevant phone number. If someone is trying to register your number on another device, you may receive a code you didn’t request. The scammer then needs to persuade you to share it.

They may pretend to be a customer who sent the code accidentally, a colleague setting up a linked device or a member of WhatsApp support checking your account.

Whatever the case may be, the rule is simple: never share a WhatsApp registration code. Without that code, the other person shouldn’t be able to complete the registration. If you receive a code unexpectedly, don’t reply to anyone who asks for it; instead, check your linked devices, turn on 2-step verification and add an email address you control so you have another recovery route.

If the scammer succeeds, they may lock you out and start messaging customers, relatives or suppliers from your trusted account. They could request payments, send phishing links or claim your bank details have changed.

You can attempt to recover a compromised account by logging back into WhatsApp with your phone number and following the verification process. WhatsApp provides current account-recovery instructions through its Help Centre.

AI voices and deepfakes: the new frontier of impersonation

A strange writing style used to be one of the easiest ways to spot an impersonation scam, but now, voice messages and video calls can feel much harder to question – especially when the person looks or sounds familiar.

AI tools can recreate a person’s voice using audio taken from social media, interviews, videos or voicemail greetings. A scammer may then send a voice note or make a call that appears to come from a company director, employee or relative.

For example, a finance assistant might receive a message that sounds like the owner of the company, asking them to pay a confidential supplier invoice immediately. A family-run business may be told that a relative is in trouble and needs emergency funds.

Don’t rely on recognising someone’s voice. The US Federal Trade Commission recommends calling the person using a number you know to verify the story, rather than trusting the incoming call or message.

Businesses should also consider agreeing a safe word for unusual or urgent requests. Keep it private, don’t include it in emails or public documents, and change it if you think it has been exposed.

For higher-value payments, use a two-person approval process. A convincing voice message shouldn’t be enough to bypass your normal financial controls.

“WhatsApp Gold” and fake updates: the malware threat

“WhatsApp Gold” is a long-running scam that promises access to an exclusive, premium or upgraded version of WhatsApp. The message may claim the new app includes enhanced privacy, extra business tools or features that aren’t available to ordinary users.

The truth is, there is no official WhatsApp Gold upgrade. Links in these messages may lead to fake login pages, unofficial app downloads or malicious software. Similar scams may claim that your version of WhatsApp is expiring or that you need an urgent security update.

Only update WhatsApp through the official Apple App Store, Google Play Store, Microsoft Store or WhatsApp website. Don’t install an app or browser extension sent through an unexpected chat.

Scammers may also circulate chain messages warning about dangerous videos, account closures or new fees. These are often designed to spread panic and encourage forwarding. Don’t pass them on simply because the message tells you to warn everyone you know.

Malicious attachments: why your PC or laptop could be a target

WhatsApp Business is often used to exchange invoices, job specifications, CVs, product lists and order documents. That makes an attachment feel like a normal part of the working day, and also gives scammers useful cover.

A file labelled “invoice”, “delivery note”, “customer order” or “price list” may contain malware or direct you to a fake login page. The risk can be particularly easy to overlook when using WhatsApp Desktop on a computer, where the device may also contain customer records, saved passwords and access to email or cloud-storage accounts.

Be especially cautious with unexpected executable files, compressed folders and documents that ask you to enable macros or install software. Don’t assume a file is safe because it appears to come from a known contact – their account may have been compromised.

Before opening an unexpected business attachment:

• Confirm it with the sender through a trusted method
• Check whether the filename and format make sense
• Scan the file with up-to-date security software
• Keep your operating system, WhatsApp and your browser updated
• Avoid using an administrator account for everyday work
• Back up important business data away from the main device

If you open a suspicious file, disconnect the affected computer from your network, run a security scan and change important passwords from a different, trusted device.

How to report and block a scammer without losing your data

Blocking someone stops them from calling or messaging you through WhatsApp, but it doesn’t automatically delete the existing conversation from your device.

Before blocking the scammer, preserve anything you may need as evidence. Take screenshots showing the number, profile, messages, links, payment details and dates. If money has been sent, save the receipt and contact your bank immediately.

You can then open the contact or chat information and choose Report or Report and block. WhatsApp may receive recent messages from that conversation as part of the report. Reporting doesn’t notify the other person that you were the one who reported them.

If a link or attachment may have exposed business data, don’t treat blocking as the end of the incident. Change affected passwords, sign out of unfamiliar sessions, check linked WhatsApp devices and tell anyone whose information may be at risk.

The correct external reporting route depends on where your business is based, so we’ll cover these below.

Common WhatsApp scams targeting UK businesses

HMRC and energy rebate scams

UK scammers often impersonate an organisation with authority: HMRC, Royal Mail, a bank, an energy supplier or a government department. A message may claim that your business owes tax, has missed a filing deadline or qualifies for a rebate. Energy-related versions may offer help with a grant, refund or support payment before directing you to a fake form.

The pressure is the point. The scammer wants you to worry about a penalty, missed parcel or lost rebate before you have time to check the details.

HMRC says it won’t use WhatsApp to tell you about a tax rebate or penalty or ask for personal or payment information. If you receive a suspicious HMRC message through WhatsApp, take a screenshot and send it to [email protected].

Don’t click the link, download an attachment or call a number supplied in the chat. Open GOV.UK yourself or use contact details you already trust.

The “Hi Mum” evolution: targeting family-run businesses

The “Hi Mum” scam traditionally begins with someone claiming to be a son or daughter who has lost or damaged their phone. Once the new number has been accepted, they ask for help paying an urgent bill.

For a family-run business, the story can easily be applied to the working day. The scammer might pretend to be a relative, employee or business partner and claim that a supplier needs paying before a delivery can be released. AI-generated voice notes can make the request feel even more convincing.

Agree a family and business safe word, and confirm payment requests through another channel. If “your brother” sends a message from a new number asking you to pay a wholesaler, call the number you already have saved before doing anything else.

A bit of healthy scepticism can protect your cash flow. If a message is unusually urgent, secretive or threatening, that’s a reason to slow down – not speed up.

Reporting a scam in the UK

If you’ve lost money or been hacked in England, Wales or Northern Ireland, report the incident to Report Fraud, the service that has replaced Action Fraud. You can report online or call 0300 123 2040. In Scotland, report the incident to Police Scotland by calling 101.

You can also:

• Forward suspicious texts to 7726
• Forward suspicious emails to [email protected]
• Report suspicious HMRC WhatsApp messages to [email protected]
• Contact your bank immediately if money has been transferred
• Report and block the account within WhatsApp

If customer or employee information has been exposed, you may also need to assess whether the incident must be reported to the Information Commissioner’s Office.

How can businesses stay safe on WhatsApp?

Luckily, you don’t need to treat every new customer like a criminal in order to stay safe on WhatsApp. A few consistent rules can remove many of the opportunities scammers rely on.

• Turn on 2-step verification and add a recovery email to your account
• Never share registration codes, passwords or security PINs
• Review linked devices regularly
• Verify new bank details using a trusted contact method
• Use a safe word for urgent family or staff requests
• Require two approvals for larger or unusual payments
• Keep phones, computers, browsers and WhatsApp updated
• Back up important business data
• Train staff to recognise phishing, quishing and AI impersonation
• Keep personal and business communications clearly separated
• Contact your bank immediately if money has been sent

It’s a good idea to write these rules down rather than assuming everyone will remember them. A simple, pre-planned process is much easier to follow when someone is busy, under pressure, and a message appears urgent.

Is WhatsApp Business secure?

WhatsApp uses end-to-end encryption for personal messages and calls. However, most WhatsApp scams don’t break that encryption. They manipulate the person using the account.

A scammer doesn’t need to defeat WhatsApp’s security if they can persuade you to hand over a registration code, open a malicious attachment or transfer money to a fake supplier.

That’s why account security needs to be supported by good business processes: independent checks, clear payment rules, staff training and sensible separation between personal and professional communication.

Separate business and personal communication with YourBusinessNumber

A dedicated WhatsApp Business number can make suspicious messages easier to spot.

If a relative suddenly asks for emergency money through a number you only use for customers, you already have a reason to question it. If personal chats and supplier payments aren’t mixed, it’s easier to understand who should be contacting each number and why.

YourBusinessNumber helps you keep your personal mobile number private while giving customers a dedicated way to contact your business. Depending on your setup, you can use a second number or business eSIM for WhatsApp Business, customer calls, enquiries and bookings.

That means clearer work-life boundaries, more professional communication and one less opportunity for a convincing scam message to blend into the wrong conversation.

Ready to separate your work and personal messages? Grab a virtual number for WhatsApp or WhatsApp Business today.