- Incibe warns of a campaign that uses real WhatsApp accounts on iPhones to request urgent transfers.
- The messages request 980 euros, promise to return them the next day, and ask for proof of payment, although the amount and excuse may vary.
- The victims continue using WhatsApp and do not see the messages, because the criminals hide them with 'delete only for me' from a linked device.
- It is recommended to notify via another method, check linked devices, update iOS and WhatsApp, activate two-step verification, and contact the bank if payment has been made.
The National Cybersecurity Institute (Incibe) has issued a warning about a type of fraud affecting WhatsApp users on iPhones. In the detected cases, criminals manage to send messages from the victim's real account requesting money from their contacts, while the account holder continues using the application normally and does not see these conversations.
The recurring financial demand in the scams is for an urgent transfer of 980 euros , although Incibe warns that the amount and the pretext may change. The messages are sent to family and friends, exploiting the trust placed in an acquaintance and seeking payment without prior verification.
How the scam works
According to the technology center, in recent days there has been a surge in inquiries from users whose contacts have received messages sent from their WhatsApp accounts. The affected individuals did not send these requests, and the messages do not appear in their chat history.
Cybercriminals request a transfer to resolve a supposed emergency and provide a bank account for payment. In reported cases, they promise to return the money the next day and request proof of payment, which lends an air of legitimacy to the transaction.
The trick is especially dangerous because it doesn't require the victim to click a link, scan a QR code, or download a file. It's a zero-click attack in which attackers exploit a series of vulnerabilities in iOS and WhatsApp, particularly on iPhones with versions prior to iOS 16.7.12 and with the messaging app not updated.
Once inside, the scammers use the 'delete only for me' function from a linked device. This makes the message disappear from the account holder's screen, but it remains visible to the recipient. Therefore, the victim can continue using WhatsApp without realizing that someone is impersonating them in front of others.
This type of scam differs from classic "family member in distress" scams because it doesn't originate from an unknown number or require the victim to share a verification code. The criminals rely on social engineering and exploit feelings of urgency, fear, and trust to trigger quick decisions.
Warning signs and recommendations
WhatsApp has also warned that requests for money from a known contact may indicate that your account has been compromised. The platform recommends verifying the sender's identity via a call or video call before responding to any unexpected financial requests.
Incibe reminds users of the importance of keeping both their iPhones and the WhatsApp application up to date. It also advises enabling two-step verification with a personal PIN in the application settings and regularly reviewing what personal information is exposed online.
To avoid falling into this trap, the basic rule is never to send money just because the message comes from a familiar chat. In the case of an urgent request, it's best to call the person or verify their identity in person before making any payment.
It's also advisable not to share verification codes, passwords, or bank details, and to be wary of links received via messaging. Experts emphasize that prevention involves updating your operating system and applications, as well as securing your WhatsApp account with advanced security measures.
What to do if you suspect someone is using your account
If you suspect someone is using your account, you should act immediately without waiting to see who sent the messages. The first step is to notify your contacts by phone call, SMS, or email —not WhatsApp—and ask them not to transfer any money.
Next, check the linked devices in WhatsApp settings and close any unrecognized sessions. Incibe also recommends uninstalling and reinstalling WhatsApp to reset device registration and linking, as well as enabling two-step verification with your own PIN.
It's important to save screenshots, phone numbers, messages, and any bank statements as evidence. Those affected can file a report with the National Police or the Civil Guard , even if they haven't suffered any financial losses.
If money has already been sent, you must contact your bank immediately and explain that it is a fraudulent transfer . The bank should activate the available blocking or recovery measures. Speed is crucial, because once the transfer has been made, recovery is not guaranteed.
Where to ask for help
If you have any questions, Incibe's Cybersecurity Helpline is available at 017. You can also contact them via WhatsApp at 900 116 117 and via Telegram at @INCIBE017.
The messages typically request a transfer of €980, promise to return the money the next day, and ask for proof of payment, although the amount and the excuse may vary. The urgency and the trust placed in the supposed sender are designed to get the recipient to pay without verifying the request, so caution and verification through another channel are the best ways to protect yourself.
