Whatsapp Scam: Suspicious Messages and Recovery Steps

Suspicious messages are more likely to be deceptive when they arrive unexpectedly, create urgency, demand secrecy, promise guaranteed returns, or request money, cryptocurrency, gift cards, account codes, or personal data. A profile photo, familiar name, or copied credential does not independently verify the sender. Other warning signs include withdrawal fees, remote-access software, QR-code requests, or payment to an unfamiliar account or wallet.

Yes. A familiar number may belong to a compromised account, or the sender may impersonate a friend, relative, executive, or government employee. Verify any unusual request through a number or channel you already know to be genuine before sending money, sharing a code, or opening a link.

These schemes begin with a promise of simple work or high returns. The operator may make a small initial payment to build confidence, then request increasing deposits. Any displayed earnings may be fictitious, and each additional payment can lead to another demand for fees, taxes, or deposits. According to FTC data, consumers reported $2.1 billion in losses from scams that began on social media in 2025, with investment scams accounting for more than half. This figure covers social media scams generally, not WhatsApp alone.

Impersonation schemes use copied photos, hacked accounts, or fabricated credentials to appear trustworthy. Account-takeover attempts request a registration code, PIN, QR scan, or device access. Once an account is compromised, the operator may use the victim's own profile to solicit money or credentials from the victim's contacts.

Do not open a link, share a verification code, or send money until the sender is independently verified. Preserve the sender's number, profile, and message history before reporting and blocking the account through WhatsApp. Enable two-step verification and review linked devices.

Secure affected accounts from a trusted device, change compromised passwords, enable multi-factor authentication, and contact the relevant provider. Preserve the message, URL, and any login alerts before deleting them, and monitor financial accounts for unauthorized activity.

Contact the bank, payment app, wire service, or cryptocurrency exchange immediately and report the transfer as fraudulent. Request a hold, recall, chargeback, or account freeze. Preserve the full conversation and transaction records before blocking the contact.

Preserve the complete conversation, sender's number and profile, timestamps, links, attachments, payment instructions, receipts, and communications with financial institutions. For cryptocurrency, retain wallet addresses, transaction hashes, exchange records, asset type, amount, and transfer time. Keep the original device and backups intact.

Report the account to WhatsApp and notify the relevant payment provider. U.S. .ictims may report through the FTC's fraud reporting portal, the FBI's Internet Crime Complaint Center, and, where identity theft is involved, IdentityTheft.gov. Investment-related conduct may also warrant a report to securities regulators. Detailed transaction information helps IC3 assess the complaint, but filing does not guarantee an investigation or account freeze.

Bank transfers may sometimes be recalled or frozen if reported quickly. Cryptocurrency transfers are generally difficult to reverse, though transaction tracing may support an investigation or civil claim. A financial institution's obligations may differ depending on whether the customer was deceived into authorizing the payment or a third party initiated the transfer without permission.

Authorities may investigate wire fraud, identity theft, computer intrusion, or money laundering, but victims do not prosecute criminal charges themselves. Civil claims may include fraud, conversion, unjust enrichment, or claims against knowing participants depending on the jurisdiction and evidence. In New York, attachment under CPLR 6201, injunctive relief under CPLR 6301, or pre-action disclosure under CPLR 3102(c) may be available when statutory requirements are satisfied.

Recovery schemes target people who have already lost money by impersonating lawyers, investigators, or asset-recovery companies. The FBI has warned that fictitious law firms contact victims of cyber fraud and charge advance fees in exchange for promised fund recovery. Before engaging any service, verify the provider's bar registration, physical office, and official email domain. Reject guaranteed-recovery claims and demands for additional payment in cryptocurrency.