How accounts get taken over
Most takeovers start with a code. Your friend received a message - often from an already-hijacked account of someone they trust - asking them to "forward the 6-digit code you just got, I sent it to you by mistake". That code was the login confirmation for their own WhatsApp or Telegram. Seconds later the attacker owns the account, sets their own two-step PIN, and starts messaging every contact in it.
From the outside nothing changed: same avatar, same name, same shared history, same number at the top of the screen. Spam blockers and caller-ID apps are useless here by definition - there is no bad number to recognise.
Red flags in the conversation
- Money, urgently, by transfer to an account you don't know - or gift cards, or crypto.
- Reasons not to call. "I'm in a meeting, can't talk" - a takeover cannot survive a voice call.
- A change in tone. Slightly-off phrasing, unusual formality, no shared-memory details.
- Any request to forward a code. This is never legitimate - it is the takeover spreading to you.
What to do, step by step
- Don't send anything yet. Not money, not codes, not card photos.
- Call your friend's actual phone number. Not a WhatsApp call to the same chat - a regular call to the number saved in your contacts. The attacker owns the account, not the phone. Thirty seconds of a real voice settles everything. This is out-of-band verification: checking through a channel the attacker does not control.
- No answer? Ask something only your friend would know - not answerable from their photos and posts. Evasion equals scam.
- Confirmed a takeover? Tell them to re-register the app (a fresh SMS login kicks the attacker out) and to switch on two-step verification. Warn mutual friends through other channels - the scammer is messaging them right now.
If you already paid
Contact your bank immediately and request a recall - the first hours are decisive. Report the fraud to the police and to the messenger's support (in-app: report the chat). Keep screenshots of the whole conversation, including the payment details you were given.
Make the check a one-tap habit
The whole defence is one move: reach the real person on the number you saved, outside the compromised chat. Wcall makes that move a button: when a message claims to be someone you know, tap Check - Wcall contacts that person on their saved number, with a push to their Wcall app or an SMS code. They confirm from their actual phone, or you stop the conversation.
Get Wcall for Android
Frequently asked questions
It's their real account. How can it be a scam?
The account was taken over - usually via a stolen login code. Everything visible is genuine except the person typing. That is why the check has to leave the chat: call the saved number.
Someone asked me to forward a 6-digit code. What is it?
The login code for your account. Forwarding it hands your WhatsApp or Telegram to the attacker, who then runs this same scam on your contacts. Never forward codes - no real situation requires it.
Is this related to the "Hi Mum" scam?
Same family: an impostor borrowing a trusted identity. The "Hi Mum" version uses a new number and a story; this version uses a stolen real account. Both die to the same check - see the "Hi Mum" scam guide.
