WhatsApp Account Takeover Scam: New Fraud Method Starting from Marketplace Apps

A new fraud method detected in Spain targets sellers on marketplace apps like Wallapop and Vinted. Scammers pose as buyers, move conversations to WhatsApp, trick victims into sharing verification codes, and take over their accounts to impersonate them and request money from their contacts.

How the Scam Works

This fraud operates through the following steps:

Initial Contact: Scammers approach sellers on marketplace apps like Wallapop, Vinted, and Milanuncios. They pose as buyers and often agree to the asking price without negotiation to build trust.
Moving to WhatsApp: Early in the conversation, the scammer suggests continuing on WhatsApp. When the victim agrees, they share their phone number.
Account Takeover: Using the victim's number, the scammer attempts to register the victim's WhatsApp account from another device. WhatsApp sends a verification code via SMS, which the scammer tricks the victim into revealing.
Impersonation and Fraud: Once the scammer has the code, they gain full control of the victim's account and lock out the original device. They then impersonate the victim by contacting their family, friends, and acquaintances claiming to need urgent financial assistance.

Warning Signs

Buyers who immediately agree to your asking price without negotiation
Pressure to move conversations to WhatsApp or other platforms quickly
Requests for authentication codes, OTPs, or one-time passwords
Unexpected messages from known contacts requesting urgent money transfers

Prevention Tips

Keep all marketplace transactions within the official app platform until completion
Never share authentication codes, OTPs, or verification codes with anyone
If a contact requests money urgently, verify their identity through another communication method
Monitor your devices for unexpected login notifications and change passwords immediately if you see any
Report suspicious activity on WhatsApp to official support immediately
Enable two-factor authentication on all accounts when available

Where to Report

Spain: Guardia Civil (Spanish Civil Guard) Japan: National Police Agency Cybercrime Consultation Hotline, Consumer Affairs Agency Consumer Hotline General: Local law enforcement or cybersecurity authorities in your country