Glossary
What is WhatsApp phishing?
WhatsApp phishing is a social engineering attack sent through WhatsApp messages.
- Also known as
- Chat app phishing, messaging scam
- Channel
- WhatsApp chats, voice notes and calls
- Typical goal
- Payments, verification codes, bank details
- Related term
- Smishing
How it works
A new number,
a familiar name.
- 01
Borrow an identity
The attacker uses a colleague’s or manager’s name and profile photo, or takes over a real account.
- 02
Start casually
“Hi, are you free?” or “New number, save this one.” The tone is informal and personal.
- 03
Make the ask
Buy gift cards, pay a supplier, change salary bank details or share the code that just arrived.
- 04
Move fast
Chat feels urgent and private, so people act before checking with anyone else.
Simulated examples
Two chats that
want a favour.
“HR Payroll” · unknown number
Salary account update
Please send your new bank details before Friday’s payroll run, or your salary may be delayed.
- HR doesn’t normally use this channel
- Asks for bank details in chat
- Payroll deadline pressure
Questions buyers ask
Frequently asked questions.
How do I know if a WhatsApp message is a scam?
Be wary of unknown numbers using a familiar name, requests for money or codes, and pressure to act quickly or secretly. Verify by calling the person on a number you already have.
Why do scammers ask for a WhatsApp verification code?
The code can let them register your number on their device and take over your account, which they then use to target your contacts.
How do I report WhatsApp phishing at work?
Take a screenshot and report it through your organisation’s reporting process or to your security team. Don’t reply or tap any links.
Let’s connect the dots
See the human risk.
Change what happens next.
Bring your awareness program, your reporting workflow, or the question your current metrics cannot answer.
Book a demo