The Hi Mum / Hi Dad scam, OTP-relay account hijacks, fake bank alerts, and the investment-group push — the verification rules that defeat every WhatsApp scam pattern.
Last reviewed: 21 May 2026 · ScamSupport research
WhatsApp is now one of the main channels for scams aimed at UK residents. It is free, encrypted, and reaches people through a name they trust rather than an unknown number — which is exactly what makes it effective. The scams fall into a handful of recognisable types. This guide covers the four that matter most, how to lock your account down, and what to do if you have been targeted.
This is the most common WhatsApp scam in the UK. A message arrives from an unknown number: “Hi Mum, I’ve lost my phone — this is my new number.” Once you reply, an urgent problem appears: a bill that must be paid today, a payment that won’t go through on the “new phone”, money needed right now. You are asked to transfer it to “a friend’s account” to help.
It works because it targets parents, exploits genuine worry, and the “lost my phone, new number” story conveniently explains both the unfamiliar number and the slightly-off tone of the messages.
The defence: any message that combines “I’ve lost my phone / this is my new number” with a request for money is a scam until proven otherwise. Do not transfer anything on the strength of a text. Call the person on their known number, or ask a question only the real person could answer. If the “new number” story is real, they will not mind you checking.
When WhatsApp is installed on a new phone, it sends a six-digit verification code by SMS. Whoever enters that code controls the account. That single fact drives the second major scam.
It usually arrives from a contact whose own account has already been hijacked: “Sorry, I accidentally sent you my code — can you forward it back to me?” Sometimes it is dressed up as a message from “WhatsApp support”. The code they are asking for is the one that just landed on your phone — because they are trying to register your account on their device. The moment you forward it, you are locked out and they are in.
They then use your account to run “Hi Mum” and code-relay scams against your entire contact list. That is how the scam spreads from person to person.
The rule: your WhatsApp six-digit code is never to be shared with anyone, for any reason. WhatsApp will never ask you for it, and no genuine friend needs it.
You are added to a WhatsApp group, or messaged directly, about an “exclusive” trading or crypto group — often with fake endorsements from well-known names. (Martin Lewis, among others, has repeatedly stated he does not appear in any adverts; any investment pitch using his face is fake.)
The group is populated with fake “members” posting fake profit screenshots to manufacture FOMO. A “mentor” or “analyst” then guides you onto a platform that shows fake gains and blocks any attempt to withdraw.
The rule: nobody legitimate recruits investors through a random WhatsApp add. Leave the group and do not engage. Our WhatsApp investment-group scam guide covers this pattern in full.
These are messages forwarded to you by real friends who were themselves fooled: a “free £500 supermarket voucher”, a fake parcel-delivery text, a fake “your bank account is at risk” alert. They spread because they arrive from someone you trust, not a stranger.
The rule: a forwarded message has not been verified by the person who forwarded it. Treat brand giveaways and urgent “act now” alerts on WhatsApp as false until you have checked them on the brand’s official website — reached by typing the address yourself, never through the link in the message.
Four settings defeat almost all of the above. They take a couple of minutes:
Phone numbers and names are widely available from data breaches, leaked contact lists and social media. A 'Hi Mum' message that uses your name is using cheaply-obtained data, not proof that it is genuine.
No. A six-digit code that arrives on your phone is for registering your own WhatsApp account. Forwarding it hands your account to whoever asked. Your friend's account has almost certainly been hijacked and is being used to spread the scam.
No. Knowing your name proves nothing — that information is easy to obtain. Verify by calling the person on their known number or asking something only the real person could answer. Never transfer money on the strength of a message alone.
Possibly. Contact your bank's fraud line immediately. Many victims of authorised-push-payment fraud are entitled to reimbursement under the UK rules — ask your bank directly and report it to Report Fraud.
No. Encryption stops others reading your messages in transit; it does nothing about who is sending them. A scam message is delivered just as securely as a real one. Encryption and scam-safety are different things.
Being added is not itself harmful. The danger begins if you engage — replying, clicking links, or following the group onto an investment platform. Leave the group, do not interact, and report it.
Reviewed by ScamSupport research, 21 May 2026. Sources: Which? WhatsApp scam guidance; Action Fraud; WhatsApp two-step-verification guidance; Report Fraud (reportfraud.police.uk).
When accessing sensitive accounts online, use NordVPN to encrypt your connection and protect against interception.
Affiliate disclosure: as a NordVPN partner, ScamSupport may earn a commission if you sign up via this link — this doesn't change our recommendation or the price you pay. Full affiliate policy →
Get NordVPN Protection