Two-Stage Fraud Targeting Children: Account Hijacking and Unauthorized Charges via SMS Codes

How the Scam Works

This fraud begins with contact via social media. Scammers establish trust through friendly messages before systematically requesting personal information.

Stage One: WhatsApp Account Hijacking

In this case, the scammer contacted an 11-year-old girl through Instagram. After establishing initial rapport, the scammer suggested continuing the conversation on WhatsApp. When the girl provided her phone number, the scammer claimed a six-digit verification code was needed to create a WhatsApp account. The explanation seemed plausible, so the girl sent the code received via SMS.

Using the phone number and verification code, the scammer transferred the girl's WhatsApp profile to their own device, hijacking the account. The original owner lost all access.

Stage Two: Exploiting Contacts for Unauthorized Purchases

From the hijacked WhatsApp account, the scammer contacted the girl's contacts. A 10-year-old girl believed she was communicating with her friend. When the scammer requested her SMS verification code (used for mobile billing authorization), she sent it, assuming it was from someone she trusted.

The scammer used this code to authorize purchases on Apple Store and PlayStation Store, with charges appearing on the victim's phone bill.

Detection of Fraud

The 10-year-old's family discovered the fraud only when receiving purchase confirmation SMS messages. Total damages reached several hundred euros, which the parents had to cover since the phone contract was registered to them.

Warning Signs

• Unsolicited Contact: Not every friendly message from a social media stranger is genuine. Be suspicious of new profiles with minimal information.
• Code Requests: Legitimate service providers never ask users to share verification codes. Such codes are personal authentication tools.
• Compromised Account Indicators: Even messages from known contacts may indicate a hijacked account if the writing style or requests seem unusual. Verify directly through video call or in-person.
• Impersonation of Peers: Scammers targeting children often pose as peers, though they may also impersonate adults or official services.

Prevention Strategies

For Children

• Avoid private conversations with strangers on social media
• Never share codes, phone numbers, passwords, or sensitive data—even if the request appears to come from a friend
• Consult parents or trusted adults immediately if uncertain
• Verify sender identity before clicking links or responding to requests

For Parents

• Enable notifications for SMS authentication and app purchases on child devices
• Review phone bills regularly for unauthorized charges
• Reinforce the rule that real friends never ask for verification codes
• Provide age-appropriate education on password management and two-factor authentication

Reporting

If you encounter this fraud or suspect account hijacking, report it immediately to local police. Also notify affected service providers (Apple, Google, PlayStation, etc.), as unauthorized purchases may be reversed.