← مقالات وأدلة عن الاحتيال والأمن السيبراني والخصوصية

WhatsApp cloning and fake relative scams in Brazil: protection and law

Account cloning and “new number” fake relative scams: how WhatsApp fraud works in Brazil, what Law 15,397/2026 changed and how to protect yourself.

2026-10-26

"Hi Mum, I changed my number. Can you send me a Pix right away?" With a relative's photo on the profile, this short message drives one of Brazil's most common scams. The fake relative scam and WhatsApp account cloning are a constant presence in police reports.

The numbers

According to Febraban, the WhatsApp scam was the most reported fraud among bank customers in 2024, with about 153,000 cases (Agência Brasil). In the first half of 2025, reports fell 9.9% to 73,000 while other scams surged (IstoÉ Dinheiro). Overall, Brazil recorded 2,261,055 fraud (estelionato) cases in 2025, up 429.8% from 2018, according to the Brazilian Public Security Yearbook (Brasil 61).

How the scams work

Account cloning: criminals invent a pretext to obtain the six-digit SMS code and register the victim's account on another device. Variants include SIM swaps and phishing links that hijack WhatsApp Web sessions (Exame).
Fake relative / "new number": no hacking needed. The fraudster creates a new account with a family member's photo, claims an emergency and asks for a Pix, often to a third party's account (O Antagonista).

A third family of scams uses WhatsApp to impersonate shops, banks or service providers, asking for personal data, sending fake payment slips or offering loans. The pattern is always the same: urgency, a request for a transfer and an account in someone else's name. That last element matters, because the receiving accounts are usually mule accounts opened with leaked data or rented out by their holders. A March 2026 survey by the Brazilian Public Security Forum estimated that 15.8% of Brazilians aged 16 or older, about 26.3 million people, had fallen for a scam or lost money online or by phone in the previous year (Brasil 61).

What the law says

Since 2021, Brazil's Penal Code has had a specific provision for electronic fraud carried out through social networks and phone contacts (Aos Fatos). Law 15,397/2026, signed on 4 May 2026, created an aggravated form of electronic fraud for scams that rely on cloning a device such as a phone or computer, punishable by four to eight years in prison, and made lending a bank account to move criminal proceeds a crime (Finsiders).

How to protect yourself

Never share WhatsApp's six-digit code.
Turn on two-step verification and avoid obvious PINs.
Limit your profile photo to contacts.
Verify any money request by calling the person's known number.
Agree on a family code word for emergencies.
Check "Linked devices" regularly.

If you were scammed

Warn your contacts through another channel, reinstall WhatsApp to regain control, ask your bank immediately to open a Pix refund claim (MED) and file a police report with screenshots and receipts.