WhatsApp video call scam: how it works and how to protect yourself

Recently, a highly sophisticated scam has surged, using WhatsApp video calls as bait to steal accounts, empty bank accounts, and solicit money from the victim's contacts. Although WhatsApp has significantly strengthened its privacy features, cybercriminals rely on social engineering and exploiting trust to gain easy access to our phones.

This scam is especially dangerous because it usually starts with a call from someone who seems trustworthy : a supposed bank technician, Meta support, or even worse, a friend or family member whose number has already been hacked. From there, the excuse to get you to share your screen during a video call is as simple as it is effective, and as soon as you fall for it, you lose control of your WhatsApp account and, often, your money.

What is the WhatsApp video call scam and why is it causing so much concern?

This scam involves a WhatsApp video call where you're asked to share your screen under various pretexts: a technical problem, a camera malfunction, or a supposed urgent matter. Once they see what's on your phone, they can capture verification codes, passwords, messages, and banking information.

What's unsettling is that it's not always strange or international numbers . In many cases, the caller is a real contact whose WhatsApp account has already been compromised. This creates a huge amount of trust: you see their name and photo, you believe it's them, and you let your guard down without thinking twice.

Cybersecurity authorities and companies such as ESET or the National Cybersecurity Institute (INCIBE) have issued formal warnings, because this method not only allows you to take over a WhatsApp account, but also to extend the scam to dozens of contacts, many of them family and friends.

According to recent data, Meta has removed millions of WhatsApp accounts linked to fraudulent activities , including organized scam centers. This gives an idea of ​​the scale of the problem and the extent to which this type of crime has become professionalized.

How the video call scam works step by step

Although there are slight variations, the scam usually follows a very similar pattern in almost all cases . The criminals combine a video call, an urgent problem, and the screen-sharing option to gain control of the victim's device and account.

1. First call: suspicious video call

It all starts with a WhatsApp video call that arrives unexpectedly . It might come from an unknown number or, worse, from the number of a trusted contact that has already been impersonated. The attacker introduces themselves as:

• Bank employee who calls about a strange charge or a suspicious transaction.
• Meta or WhatsApp technical support which claims to detect a security flaw or a camera error.
• Family member or friend with an urgent problemwho needs immediate help and appeals to your goodwill.

In many cases, the attacker turns off the camera or displays a completely black or blurry image . The typical excuse is that the camera isn't working, that it's in a dimly lit place, or that they're "messing with the phone's settings" and that's why the image isn't clear.

2. Creation of the urgent problem

The next step is to create a sense of urgency and worry in the victim. The scammer introduces a supposed problem that requires immediate action, leaving no time to think calmly.

• Un unauthorized charge on the card or in the bank account.
• Un strange access attempt to the WhatsApp account or to online banking.
• Un prize pending confirmation that is about to expire.
• La possible service suspension from WhatsApp or the bank itself if something isn't done "right now".

With this climate of nerves and haste, the cybercriminal insists that he is there to "help you solve it in a moment" , and that you only need to follow a few simple steps from your mobile phone.

3. Request to share screen (and sometimes remote access apps)

The key to the scam is getting the victim to activate the screen sharing function during the video call . On WhatsApp, this option allows you to show everything that happens on your phone live: notifications, messages, codes, apps , etc.

In some more advanced variations, the scammer guides the victim to install remote control applications like AnyDesk or TeamViewer. They offer excuses such as "this way I can help you better from here" or "it's the official support tool." If this remote access is granted, the criminal can control the phone almost as if they had it in their hand.

In any case, whether using screen sharing or remote apps, the result is the same: the attacker sees everything that appears on your mobile in real time , including SMS messages, WhatsApp pop-up notifications, emails, and banking data.

4. Theft of WhatsApp verification code

While the victim is sharing their screen, the attacker attempts to register the WhatsApp account on another device . To do this, they request WhatsApp to send an SMS with the infamous six-digit verification code.

The SMS arrives on the victim's phone, and because the screen is being shared, the message content is visible to the attacker . Sometimes the person doesn't even need to open the message: the pop-up notification displaying the code at the top is enough.

In other cases, the scammer directly asks the victim to read the code or forward it "to confirm their identity ," claiming it's a routine procedure from the bank or technical support. If the victim is nervous and trusts them, they hand it over without thinking.

Once the attacker enters that code on their own device, they gain control of the WhatsApp account . The session is automatically closed on the original phone, leaving the victim locked out and unsure of what has happened.

5. Access to data, accounts and theft of money

With screen sharing or a remote access app, the attacker often goes beyond WhatsApp . If the victim allows it, they may ask for:

• Open the bank's app or online banking to “check for suspicious movements”.
• Enter passwords or security PIN, which are recorded.
• Confirm transactions Bizum, transfers or other payments under deception.

In some advanced incidents, the installation of keylogger malware (keystroke recorders) has been detected , which allows attackers to continue stealing data even after the call.

With all that information, they can empty accounts, move money to other accounts or wallets , and of course, use the stolen WhatsApp account to continue expanding their network of victims.

What do criminals do once they've stolen your WhatsApp?

Once they gain control of the account, cybercriminals don't just snoop through your chats. Within minutes, they begin exploiting your identity and contacts to extract money and continue spreading the fraud.

Using your identity to request money (Bizum and transfers)

One of the most common tactics involves sending messages to your contacts pretending to be you . The typical message usually appeals to urgency and trust: "Hey, can you send me a quick Bizum payment? I'm having a problem and I'll pay you back later," or similar variations.

There have also been cases where, from the stolen account, the scammer asks contacts to forward an SMS code they just received, claiming it's due to a mistake or a routine procedure. With that code, they can repeat the process and hijack more accounts.

The effect is devastating, because your friends and family don't suspect someone they talk to every day . They see your name and photo, they trust you, and in many cases, they end up sending money or providing new sensitive information.

Chain of fraudulent video calls

In some frauds detected by INCIBE, the pattern is repeated in a "snowball" mode: the attacker, already inside your account, starts making video calls to your contacts using the same excuse of technical problems or urgent help.

The person receiving the call thinks it's you, so they're very likely to agree to share their screen or give out personal information . This creates a chain of victims: first you're robbed, then your contacts, and from there the reach can be enormous.

Change of security parameters and blocking of the legitimate owner

When criminals gain control of an account, one of their first moves is to strengthen security… for themselves . They can:

• Modify the email associated with account recovery.
• Turn on XNUMX-Step Verification with a PIN that only they know.
• Change privacy settings to make it harder for others to suspect.

In this way, even if the victim tries to regain access, they encounter an additional obstacle: they need a PIN that they never set , because the attackers have put it there to buy time and continue committing fraud.

Real cases and significant economic losses

This type of scam isn't theoretical. Real cases with significant losses have been documented in various countries . For example, forums like Reddit feature the case of a woman in Brazil who lost around 3.000 reais after supposedly helping a friend with an online purchase problem. The friend had already been hacked, and her identity was used to deceive her through a screen-sharing video call.

An even more serious case was reported in Hong Kong, with losses exceeding five million dollars . The attacker impersonated a telecommunications company employee offering assistance in canceling a service. During the video call, the victim shared their screen, accessed their bank accounts, and provided passwords and verification codes that ended up in the hands of the criminals.

These examples illustrate just how devastating the combination of social engineering and video calls can be , both for your wallet and your privacy.

Alerts and recommendations from the Police, INCIBE and cybersecurity experts

In response to the increase in cases, various official institutions and security companies have published very clear warnings about this type of fraud and have explained how to recognize and avoid it.

The National Police warning

The National Police, through their official TikTok account, has explained the modus operandi of these scammers in simple terms . They emphasize that the criminals impersonate WhatsApp technical support, claim that the camera isn't working properly, and ask the user to press the screen share button to "fix" it.

The recommendation is clear: WhatsApp does not contact users via video call to resolve technical issues , nor does it request screen sharing or verification codes. Any call that claims otherwise is suspicious and should be hung up immediately.

INCIBE Press Releases and Guide

The National Cybersecurity Institute has detected multiple incidents of this type through its helpline, 017. In one of the reported cases, a user lost access to their WhatsApp account after a video call in which only a black screen was visible . After sharing their own screenshot, the verification SMS appeared, and the attacker took control of the account.

INCIBE details the steps to react: quickly notify contacts, try to reinstall WhatsApp and regain access , contact the application's support and even, if things drag on, go to WhatsApp's Data Protection Officer and, ultimately, to the Spanish Data Protection Agency.

The agency also insists on gathering all possible evidence (messages, screenshots, bank statements) and filing a complaint with the State Security Forces , as this is a clear crime of identity theft and, in many cases, financial fraud.

Essential tips from ESET and other experts

Specialized companies like ESET highlight several key points that any user should have memorized to reduce the risk of falling into the trap.

• Do not share your screen with strangers nor with supposed technicians who call unexpectedly.
• Do not share codes or passwords by phone, video call or messaging.
• Be wary of any situation that generates panic or haste for taking decisions.
• Check for bank or technical alerts contacting the entity directly through its official channels.
• Activate two-step verification on WhatsApp to put an additional barrier against attackers.

How to avoid falling for scams: practical guidelines

The best defense against these types of scams is to combine common sense, healthy skepticism, and some basic technical measures . You don't need to be a computer expert to protect yourself quite well against these tactics.

Do not share your screen in “weird” video calls

Golden rule: never share your screen on a video call if you're not absolutely sure who you're talking to and why . If you can't even see the other person's face, you should be extremely suspicious.

Even with friends, family, or coworkers, it's a good idea to get into the habit of asking first : "Why do you need me to share my screen?" And if the reason isn't clear or you don't see it as necessary, refuse without hesitation. It's okay to seem suspicious; what is a problem is that you could lose your bank account or your savings.

Confirm the identity of known contacts

When the call comes from someone you know well, the scam becomes more subtle. In these cases, it's helpful to have questions or details ready that only that person would know the answer to ("What was the name of the restaurant we ate at the other day?", for example).

Another highly recommended option is to contact them through a different channel : call them on a regular phone, send a text message or email, or use another messaging app. If your friend is truly in trouble, they'll confirm it that way; if they don't respond or say they don't know what you're talking about, it's almost certain their account has been compromised.

Do not share verification codes under any circumstances

Verification codes received via SMS, whether from WhatsApp, your bank, or other services, are personal and non-transferable . No reputable company will ask for them via call, text message, or video call unless you initiated the verification process yourself.

If someone asks you for that code claiming it's to "verify your account," "cancel a charge," or any other excuse, the correct thing to do is hang up. If you're still unsure, call the bank or official support yourself . You should only enter the code yourself in the corresponding app or website; never give it to someone else.

Avoid using remote access applications if a third party requests them.

Remote control apps aren't inherently bad, but in the wrong hands they become a complete gateway to your device . If someone you don't know asks you to install one of these tools, the wisest course of action is to refuse outright.

In the banking sector and with reputable support services, they won't require you to install that kind of software just to resolve a basic issue. If you hear names like AnyDesk, TeamViewer, or similar programs mentioned by a supposed technician who calls you unexpectedly, be suspicious.

Check any alarmist or overly urgent messages.

A classic sign of social engineering is the use of fear and urgency. Messages like “ you have to do this now or you’ll lose your account ” should set off all your red flags.

Before acting, pause, take a breath, and do your own research : open your bank's app or WhatsApp, check for official notifications, or call the customer service numbers listed on their websites. If everything seems normal, you know the call was a scam.

Activate two-step verification on WhatsApp

WhatsApp offers a very useful feature called two-step verification . It involves setting a six-digit PIN that the app will ask for when someone tries to register your number on a new device, even if they have the verification SMS.

To activate it, simply go to Settings > Account > Two-step verification, follow the instructions, and choose a PIN you'll remember. This way, even if an attacker obtains the SMS code by looking at your screen , they won't be able to access your account without that second factor.

What to do if you've already fallen for the WhatsApp video call scam

If you suspect your WhatsApp account has been stolen or that you shared more than you should have during a video call, it's crucial to act quickly to minimize damage and try to break the chain of deception.

1. Notify your contacts of what has happened

As soon as you realize you can no longer access your WhatsApp, or you see strange activity, try contacting your family, friends, and groups through other channels (calls, SMS, email, social media) to warn them that your account may have been compromised.

Ask them to ignore any messages, money requests, or codes that come from your number until further notice. The sooner they know, the less likely they are to become victims themselves.

2. Reinstall WhatsApp and try to regain access

The next step is to uninstall and reinstall the WhatsApp application on your mobile phone. When you log in again with your phone number, the app will send another verification code via SMS, and in many cases this is enough to regain control of your account.

You may see a message indicating that you should wait several hours (for example, between 9 and 11) before trying again. In that case, wait the indicated time and try again later. In the meantime, keep your contacts informed that your account is still being recovered.

3. Contact WhatsApp support

If reinstalling doesn't solve the problem, or if you suspect someone has activated two-step verification with an unknown PIN , you'll need to contact WhatsApp support directly. You can report account theft through the app's help center or its official website.

In some cases it will be necessary to contact WhatsApp's Data Protection Officer and, if there is no response or solution within a month, a complaint can be filed with the Spanish Data Protection Agency, alleging a violation of the right to recover the account.

4. Review bank transactions and block products if necessary

If you accessed your online banking or provided financial information during the video call, it's a good idea to thoroughly review your accounts, cards, and associated services . Check for any unusual transactions, payments you don't recognize, or transfers you don't remember making.

At the slightest suspicion, the wisest course of action is to contact your bank immediately , block cards if necessary, change passwords, and activate additional security measures (two-factor authentication, transaction limits, etc.).

5. Save evidence and report it

Finally, don't forget that this is a crime. It's important to gather as much information as possible : screenshots of the conversation, call logs, emails, bank statements, and any other data that could serve as evidence.

With all this information, go to the State Security Forces (National Police, Civil Guard, or regional police) and file a report for identity theft and, if there are financial losses, for fraud. The more reports filed, the easier it will be for the authorities to identify patterns and prosecute these groups.

The WhatsApp video call scam demonstrates just how dangerous social engineering can be compared to a technical glitch : it doesn't require breaching complex systems, simply getting the victim to act hastily and with blind trust for a few minutes. Maintaining a cautious attitude, being wary of unusual requests, protecting accounts with two-step verification, and knowing how to react if something goes wrong are now habits as essential as setting a password on your phone; ultimately, the best defense is combining technology with a healthy dose of skepticism when faced with what we see on our screens.