The ‘son in distress’ fraud, impersonations and silent account hijacking lead scams on WhatsApp

With more than 3 billion users worldwide, WhatsApp is one of the most popular messaging applications, something that cybercriminals seek to exploit, either by using this service as the main channel to distribute their scams or as a final channel to commit fraud.

WhatsApp has become one of the main vectors of digital fraud during 2025as reported by Check Point Software, since it concentrates some of the most widespread and effective scams, which exploit the trust, urgency and immediacy of instant messaging.

One of them is known as ‘son in distress’ fraud, in which victims receive a message from an unknown phone number in which the cybercriminal impersonates a son or daughter.

The message asks for urgent help, usually financial, and takes advantage of emotional pressure to get many victims to act without verifying the real identity of the sender.

More innovative is the technique of ‘Ghost Pairing’ or silent hijacking of WhatsApp accounts. With it, as Check Point experts explain, cybercriminals manage to link the victim’s WhatsApp account to another device without having to steal the SIM or password.

Through previous deception, they get the person to provide verification codes, which allows them to take control of the account and later use it to deceive their contacts.

Impersonations of official organizations and large brands and digital platforms have also managed to deceive WhatsApp users this year. These campaigns send messages that pretend to come from organizations such as the DGT, warning of pending fines or administrative incidents, or from well-known companies such as Amazon, reporting alleged problems with orders, blocked accounts or suspicious charges.

The final objective is usually the theft of credentials or control of the WhatsApp account to extend the fraud to other contacts.

Sometimes, the scam does not arrive in a message received on WhatsApp, but rather it begins on a legitimate platform, such as Facebook or TikTok, with a publication that serves as a hook to bring the fraud to the messaging application.

This is a pattern that has been observed in more sophisticated campaigns. Check Point Research has recently identified a massive phishing campaign that used Google Classroom as an initial hook.

Cybercriminals sent fake invitations from this legitimate platform and, once trust was established, redirected victims to contact them via WhatsApp, where the fraud took place.

“This year we have seen how very different scams share the same pattern: bring the conversation to WhatsApp to remove the user from more controlled environments and increase the chances of success”, commented the technical director of Check Point Software for Spain and Portugal, to Eusebio Nieva.

Tips to avoid falling into a scam

Check Point reminds us that no legitimate entity requests personal data, verification codes or urgent payments through WhatsApp. To reduce the risk of falling for this type of fraud, they advise always being wary of unexpected messages, even when they appear to come from known contacts or from brands and official organizations.

They urge you to verify the sender’s identity through an alternative channel – such as calling from another phone or searching the internet – before taking any action.and avoid clicking on links received by WhatsApp without having previously verified their legitimacy.

You must also keep applications updated and activate additional security options available on the platform.