- The National Police have detected a new pattern of cyber fraud on WhatsApp where criminals send messages to the victim's contacts without the victim losing access to their account.
- Castilla y León accounts for 82 complaints in just fifteen days with losses exceeding 10.000 euros, although the fraud is already spreading to other communities such as Navarra, La Rioja or Alicante.
- The scam usually begins with messages like "my mobile phone is broken" and requests for between 950 and 1.000 euros, always avoiding deposits in the victim's name to give more credibility to the scam.
- Experts recommend updating your operating system and WhatsApp, enabling two-step verification, and periodically checking linked devices.
The National Police have focused on a new type of WhatsApp scam that has raised alarms in several autonomous communities in recent weeks. The fraud, dubbed a "silent usurpation" system by the police, allows cybercriminals to impersonate someone and request money from their contacts without the legitimate account owner being aware of anything. The most worrying aspect is that the victim can continue using the application normally while the scammers operate in parallel from the same account.
The modus operandi is truly sophisticated and differs significantly from the more common WhatsApp scams circulating on the instant messaging platform. In this case, the criminals don't need the victim to click on a suspicious link or willingly provide any verification code . They simply exploit vulnerabilities in devices that lack the latest security updates and manage to infiltrate the account almost undetectably. The victim doesn't even notice any unusual activity in the "Linked Devices" section of WhatsApp, making the fraud particularly difficult to detect at first glance.
A scam that is growing rapidly throughout Spain
The data handled by the authorities paints a rather worrying picture. Castile and León has become the epicenter of this wave of cyber scams , with 82 complaints registered in just fifteen days and financial losses already exceeding €10.751. But the problem doesn't end there: the National Police have also confirmed incidents in Navarre, La Rioja, Alicante, and other parts of the country, with a pattern that is repeated with almost pinpoint accuracy.
In La Rioja, for example, the Cybercrime Unit (EDITE) and the Equipo@ team have investigated four cases located in Calahorra, Haro, and Logroño. In one of these cases, a victim lost up to €2.000. The investigation determined that the attacks targeted specific iPhone models with outdated versions of iOS, suggesting that the lack of security updates is one of the main vulnerabilities exploited by cybercriminals.
The most striking case, however, is that of the Valencian Community, and more specifically Alicante, where complaints have increased over the past month, although the incidence remains low for the time being. Authorities have sought to warn the public before the fraud becomes fully entrenched, emphasizing that prevention is the best defense.
This is how they trick you: the message that starts it all
Once the scammers gain access to the account, they launch a carefully planned social engineering campaign targeting the victim's trusted contacts. The typical message begins with phrases like "I need your help" or "My phone is broken ," followed by an explanation of the supposed need to buy a new device costing between €980 and €1.000. They then ask for an advance payment, claiming they can't make a transfer at that moment, and provide the IBAN of a supposed merchant or third party.
Although it may seem like a fairly basic scam, the technique is actually extremely effective because the message appears within a real conversation , using the person's real name and phone number. This leaves the recipient with no reason to suspect anything, especially when the request is integrated into a conversation that has been ongoing for months or even years. The amounts requested are usually between 950 and 1.000 euros, and the scammers avoid asking for a deposit in the victim's name to lend the deception an air of legitimacy.
The Civil Guard, which has also commented on this phenomenon, points out that in some cases account compromise occurs through a "zero-click" attack, which requires no user interaction. In other words, criminals exploit operating system vulnerabilities to access the account without the victim opening anything, clicking on any links, or scanning any QR codes.
How to protect yourself: the key recommendations from the authorities
Given this situation, both the National Police and the Civil Guard have issued a series of basic recommendations to try to stem the tide. The main measure is to keep your phone updated with the latest available security version , and not just the operating system, but also the WhatsApp application itself. In the case of iPhones, it is recommended to install at least iOS 18.7.8, since earlier versions have vulnerabilities related to these incidents.
But that's not all. They also advise enabling two-step verification on WhatsApp, checking the "Linked Devices" section periodically, and closing any unrecognized sessions. However, authorities warn that the absence of unknown devices should not be interpreted as proof that the account hasn't been compromised, since in many cases hacking occurs without any unusual sessions appearing in that section.
Another crucial point is to never share registration codes, SMS codes, two-step verification PINs, or QR codes with anyone, even if the request appears to be from a known contact. And if a family member or friend receives an urgent money request via WhatsApp, the recommendation is to always verify the request through another channel, such as a phone call or a regular text message.
The National Police also suggests disabling automatic file downloads in WhatsApp , an option that is enabled by default and can pose an additional risk if you receive a malicious file from an unknown contact. To do this, simply go to the app's settings, find the "Storage and data" section, and uncheck the automatic download options for mobile data, Wi-Fi, and data roaming.
The statistics don't lie: WhatsApp has become a magnet for scammers.
To give an idea of the scale of the problem, a recent study by the cybersecurity company Kaspersky, titled "The Great Messaging Heist," reveals that 46% of scams experienced by Spanish participants came via WhatsApp , while SMS or iMessage were present in 47,2% of cases. Telegram, meanwhile, lags considerably behind with 18,4%.
The same study indicates that cybercriminals often combine multiple channels to make their scams seem more believable. In fact, globally, 63% of the frauds analyzed are carried out using more than one channel before the victim realizes what is happening. A conversation might begin with an SMS and then continue through a messaging app, making the entire process appear much more legitimate.
Another striking statistic is that 32% of Spanish victims suffered attempted scams in which criminals impersonated a well-known brand. And here, artificial intelligence plays an increasingly important role: 48,8% of those surveyed believe that AI was involved in some way in the scam they experienced, and 47,2% identified messages they believe were generated using these tools. The conclusion is clear: scams are becoming increasingly difficult to distinguish from legitimate communication, so it's crucial to be extra cautious.
The National Police have confirmed that victims of this new wave of scams often don't realize they've been deceived until their contacts call them to ask if they really need money. In many cases, the victim only finds out later that a fake message has been circulating in their name, which further exacerbates their sense of vulnerability and helplessness. If you find yourself in this situation, the first thing you should do is warn your contacts through another channel to ignore any requests for money, and then go to the police to report the WhatsApp scams.
If you're worried about becoming the next victim, a combination of security updates, two-step verification, and a healthy skepticism toward any unexpected financial requests can save you a lot of trouble. Scammers exploit every vulnerability, so prevention is the only truly effective weapon against this new wave of attacks, which has already claimed its first victims in several regions.
