← مقالات وأدلة عن الاحتيال والأمن السيبراني والخصوصية
WhatsApp on iPhone asking your contacts for money? The warning
Spanish police warn WhatsApp accounts on iPhones are messaging contacts for money without owners noticing. What is known, the theory and how to stay safe.
Spain's National Police warned on October 30, 2026 of a scam in which criminals temporarily use a person's WhatsApp account to ask friends and family for money — while the owner keeps using the app normally and never sees the messages. According to La Nación, people who reported it say they shared no codes or passwords, scanned no QR codes and authorized no access. Many used iPhones without the latest update, though police stress that does not prove the cause. On October 15, Spain's cybersecurity institute Incibe had reported a wave of queries about the same pattern, RTVC reported.
How does the scam work?
- Messages go out from the victim's real account to recent contacts.
- They describe an emergency and ask for an urgent transfer — Incibe's example was €980, to be "returned tomorrow," with a request for proof of payment.
- Money goes to an account or number in the message.
- Messages vanish from the owner's history; Excélsior reports attackers use "Delete for me."
Unlike the classic fake relative scam, the request comes from the real number, photo and chat history.
What is the technical explanation?
Nothing is officially confirmed. The leading theory comes from similar 2026 cases in Italy analyzed by forensic firm Forenser, summarized by Thailand's ThaiCERT: mostly iPhones on iOS 16, and a possible chain of two already-patched flaws, CVE-2025-43300 (Apple image processing) and CVE-2025-55177 (WhatsApp linked-device sync). Excélsior lists fixed versions as WhatsApp for iOS 2.25.21.73, WhatsApp for Mac 2.25.21.78 and iOS 16.7.12, and says WhatsApp notified fewer than 200 potentially affected users. No suspicious linked devices were found in the analyzed phones. If the theory holds, unpatched devices remain at risk.
Why does it work so well?
Incibe points to two triggers: urgency and trust. The message comes from someone you know, from their usual number, asking for an amount that seems reasonable to lend for a day. Asking for a receipt helps the criminal confirm payment quickly. Because the account owner sees nothing, the fraud can be repeated with several contacts before anyone notices. Police have not released the number of complaints, total losses or arrests, and have not attributed the scheme to any group. In Brazil, where WhatsApp is ubiquitous, the same request would most likely arrive as a Pix.
How to protect yourself
- Update iOS and WhatsApp now; older phones that no longer get updates deserve extra caution.
- Turn on two-step verification with a PIN.
- Check Linked Devices and remove anything unfamiliar.
- Before paying any money request sent by message, call the person by voice — even if it comes from their real number.
- Agree on a family "safe word" for emergencies.
If your account was used
- Warn contacts through another channel and keep screenshots.
- Update, re-verify your account with your number and set a PIN.
- If someone paid, contact the bank immediately and file a police report.
See also WhatsApp account takeover and the Radar.
المصدر
- La Nación (Aragón) — La Policía alerta de una estafa que pide dinero desde tu WhatsApp sin que pierdas el acceso (30/10/2026)
- RTVC — Alerta do Incibe: timo que suplanta contactos de WhatsApp en iPhone para estafar 980 euros (15/10/2026)
- ThaiCERT — iPhone users urged to update iOS and WhatsApp (maio/2026)
- Excélsior — Nueva estafa de WhatsApp suplanta tu cuenta y pide dinero a tus contactos (21/09/2026)