A WhatsApp phishing scam tricks users into entering a six-digit code that links an attacker’s device. Learn how it works, what attackers can access, and how to protect your account.
Table of Contents
What Happened?
The message may ask you to vote for a friend, child, pet, or contestant. It often appears to come from someone you know.
However, that person’s WhatsApp account may already be under an attacker’s control.
Clicking the voting link opens a page that appears connected to WhatsApp. The page then asks you to enter a six-digit code.
Entering that code can approve a new device linked to your WhatsApp account. The attacker can then use WhatsApp from that device.
Attackers can use private chats and personal details to impersonate you or target your contacts. Information leaked elsewhere can make their messages more believable.
Many people do not know their information was leaked until suspicious messages appear. Automatic monitoring can help you notice problems earlier.
Futureproof monitors your data for leaks 24/7 and helps you reduce scam risks with simple, clear steps.
Who Was Targeted and What Could Attackers Access?
Malwarebytes Labs said it continues to receive reports about the fake voting messages. However, the researchers did not share a total number of victims.
Any WhatsApp user receiving one of these requests could be targeted.
After linking a device, attackers may be able to:
- Read your WhatsApp conversations
- Send messages from your account
- Collect personal information from your chats
- Pretend to be you when contacting friends and relatives
- Send more fake voting links to your contacts
- Request money using a fake emergency
The report did not list every type of personal information attackers collected.
Futureproof scans your data for leaks and shows exactly how to close security gaps — before scammers find them first.
Check my safetyHow the Six-Digit Code Gives Attackers Access
WhatsApp allows you to connect several devices to one account. This feature is called device linking.
Normally, you open the Linked Devices section and scan a QR code. You may also confirm the connection using your phone number and a one-time code.
Attackers misuse the second option.
First, they send a voting request from an account that has already been taken over. The familiar name makes the message seem trustworthy.
Next, the link sends you to a fake voting or verification page. Some pages may also use the legitimate wa.me web address.
The page then asks you to enter a six-digit code. However, the code is actually approving the attacker’s device.
Once connected, the attacker may continue reading and sending messages until you remove the unknown device.
The attack does not require your password. It also avoids the password reset messages that might normally warn you.
At Futureproof, Kevin explains digital safety in simple words, with clear tips and zero fluff. He holds a degree in information technology and studies fraud trends to keep his tips up-to-date.
In his free time, Kevin plays with his cat, enjoys board-game nights, and hunts for New York’s best cinnamon rolls.
