WhatsApp Account Hijacking Scams Surge in Navarra, Spain; Outdated Security Updates Blamed

How the Scam Works

Police in Spain's Navarra region report a sophisticated WhatsApp account hijacking scheme. Victims find their accounts compromised while remaining unaware of the theft. The distinctive feature is that victims retain full access to their own app—they can send and receive messages normally—while simultaneously, a third party can send messages from the same account without triggering the victim's removal from the session.

Why the Scam Succeeds

Once an account is hijacked, perpetrators send money transfer requests to the victim's contacts (family, friends, and acquaintances). Recipients see messages arriving from a familiar phone number and stored contact name, making the request appear trustworthy. Because previous conversation history appears in the same chat thread, authenticity seems assured. Fraudulent messages never appear on the victim's device, so victims may remain unaware of the abuse for an extended period.

Root Cause: Outdated Security

The attacks exploit security vulnerabilities in outdated mobile operating system patches and older versions of the WhatsApp application itself. Importantly, investigation reveals victims never provided registration codes, PINs, scanned QR codes, or voluntarily linked their WhatsApp to another person—meaning attackers gained access purely through technical exploitation of unpatched security flaws.

Warning Signs and Detection

Because victims often don't immediately detect this fraud, vigilance is essential:

• Periodically check WhatsApp's "Linked Devices" feature for unfamiliar sessions (though the absence of unknown devices does not guarantee account safety) • Be alert if family or friends report receiving unsolicited money requests from you • Notice any unusual account behavior or unexpected access patterns

Prevention Measures

These steps significantly reduce hijacking risk:

1. Keep Mobile OS Updated: Install the latest security patches compatible with your device
2. Update WhatsApp: Always run the most current app version
3. Enable Two-Step Verification: Activate WhatsApp's two-step verification feature in settings
4. Regularly Check Linked Devices: Review and close any unrecognized sessions in the "Linked Devices" section
5. Protect Verification Information: Never share SMS codes, QR codes, registration codes, or verification codes with anyone

If You Become a Victim

Take these steps immediately:

1. Alert Your Contacts: Use alternative communication methods (phone calls, in-person contact) to warn family, friends, and colleagues that money requests via your WhatsApp may be fraudulent
2. Report to WhatsApp: File a hijacking report through WhatsApp's official support channels
3. File a Police Report: Contact local police to file a formal complaint and create an official record of the fraud attempt

These actions help prevent further financial losses and establish documentation for investigation.