INCIBE warns of two scams that take over WhatsApp accounts to ask their contacts for money

What happened

On 21 October 2026, INCIBE (Spain's National Cybersecurity Institute) published a high-importance warning about a new WhatsApp scam. A message arrives from a known contact asking you to vote for a relative or acquaintance in a supposed dance contest, with a link to a fraudulent page.

That page asks for your phone number and shows a code to enter in WhatsApp. As INCIBE explains, "that code does not register a vote": it is the one that authorises linking an external device to the victim's account. From then on, the attackers can write to the victim's contacts pretending to be them, to ask for money or to keep spreading the fake contest.

A week earlier, on 14 October, INCIBE had published another high-importance warning: WhatsApp accounts on outdated iPhones being used to ask their owner's contacts for money.

What we know

• Why the contest works: the message comes from the account of someone you know who has already fallen for it. As INCIBE puts it, a message coming from their usual number "does not guarantee that they wrote it".
• The iPhone case: according to INCIBE, the people affected "still have access to WhatsApp and don't see those messages in their history". The messages ask for an urgent transfer with a promise to pay it back the next day; in the warning's examples, for 980 and 970 euros, although INCIBE notes that "the amounts and excuses may vary".
• iOS versions: in the cases INCIBE has handled, iPhones running versions earlier than iOS 18 predominate, with some cases of iOS 26 earlier than 26.7. That doesn't mean all users of those versions are affected.

What we don't know yet

INCIBE gives no figures for affected accounts or money lost, and doesn't say who is behind it. In the iPhone case, the warning doesn't explain how the attackers send the messages; it does note that, in the cases it handled, updating iOS was not always enough on its own.

Why it matters

Both warnings point to the same goal: using a real account to ask for money from people who trust it. No unknown number or badly written message is needed; the message comes from the usual number, with the usual photo. And in the contest, the decisive step is taken by the victim, who enters a code thinking they are voting.

What it means for an SME

In many small companies, WhatsApp is just another work channel: with clients, with suppliers and within the team. That's why a hijacked account isn't just a personal problem:

• if the manager's account falls, the attackers can ask the person in admin for an "urgent" transfer that seems to come from their boss;
• if an employee's account falls, they can write to clients and suppliers on behalf of the company;
• a dance contest is exactly the kind of message that gets forwarded in a work group "as a favour".

It's the same mechanism as CEO fraud (in Spanish), but over WhatsApp instead of email.

What your company should do this week

1. Turn on WhatsApp two-step verification (PIN and recovery email, as INCIBE recommends) on work phones, starting with the manager and whoever handles payments.
2. Review the linked devices on those accounts and log out any session you don't recognise.
3. Update iPhones and WhatsApp, and turn on automatic updates.
4. Set a rule for the whole team: no request for money or a change of bank account that arrives over WhatsApp is acted on without a confirmation call to the known number. And WhatsApp codes are never shared, not to vote or for any other reason.
5. If someone has already fallen for it: log out unknown sessions, warn contacts through another channel and, if money has been sent, call the bank immediately and report it to the police. INCIBE offers free help on 017.

Recognising this kind of scam in time is exactly what we work on in our phishing training.