It starts with a friendly message. A contact you know writes: “Hi! Please vote for my child in this contest. The main prize is a scholarship abroad. Thank you so much!” There is a link to a voting page. It looks harmless. It is not. Clicking that link and following the steps can hand your entire WhatsApp account to a criminal within minutes.
How the scam starts
The message arrives from someone on your own contact list — a friend, cousin, or family member. That is what makes it so convincing. But the sender’s account was probably already hijacked, and the criminal is now using it to reach you.
Cybersecurity firm Bitdefender, which has been tracking this campaign, found the messages asking people to vote for a child — sometimes named “Adeline” — supposedly the daughter of a close friend, with a scholarship abroad as the prize. The message always includes a link to a “voting” website.
Security researchers at Malwarebytes reported the same pattern in August 2026: compromised accounts sending voting requests tied to contests like a ballet performance, a dog competition, or a school event. The link does not lead to a real voting page. It redirects to a fake page that looks like WhatsApp — sometimes even using the legitimate wa.me domain.
How they steal your account
This is where the trap closes. The fake page asks for your phone number and then a six-digit code. Here is what is actually happening:
- The attacker types your phone number into a fresh WhatsApp installation on their own phone.
- WhatsApp sends a genuine six-digit verification code to your phone by SMS.
- You, thinking the code is needed to “validate your vote,” type it into the fake website.
- The attacker enters that code into their own WhatsApp — and takes over your account.
Your phone gets logged out. The criminal now reads your messages, sends messages as you, and sees your conversations in real time. There are no password-reset emails and no failed-login alerts, because no login happened on your side — you gave them the key.
A newer version skips the fake website entirely. The attacker asks you to open WhatsApp’s Linked Devices settings and enter a code they supply — or scan a code they send. Completing that flow adds the attacker’s phone as a linked device on your account, with the same power to read and send messages. Unless you check your linked devices list, you may not notice anything is wrong for a long time.
If you have not set up WhatsApp’s two-step verification PIN, the attacker can enable their own PIN after taking over — which can lock you out for about seven days.
What happens next
The attacker immediately turns your contact list into the next wave of victims. The same “vote for my child” message goes out to your friends and family, now from your number. Then come the money requests: “urgent” messages asking your contacts for emergency cash transfers through Easypaisa or JazzCash. Because the request comes from a trusted number and matches the way you normally talk, people fall for it.
Officials from the FIA’s Cyber Crime Wing in Gujranwala told Minute Mirror that most WhatsApp accounts are compromised this way: “Hackers trick users into sharing the verification code. Once they gain access, they start messaging contacts for urgent money.” The wing has recorded over 1,400 complaints of hacked WhatsApp accounts since July 1, and that only counts people who formally reported it.
What to do if your account is hijacked
Pakistan’s National Cyber Crime Investigation Agency (NCCIA) has issued clear recovery steps:
- Uninstall and reinstall WhatsApp on your phone.
- Enter your phone number to log in.
- Enter the six-digit code sent to you by SMS immediately.
- The moment you enter the code, the hacker’s session is logged out — WhatsApp can only be active on one phone at a time.
If the attacker turned on two-step verification and you do not know the PIN, you may have to wait up to seven days. The NCCIA says not to panic: once you have entered your SMS code, the hacker is already logged out, and during the waiting period no one can use the account or read its messages.
Report the incident to the NCCIA cybercrime helpline 1799, and warn your contacts through another channel (a phone call or a different app) so they ignore any money requests coming from your number.
How to protect yourself
- Never share your WhatsApp six-digit verification code with anyone. Not a friend, not a relative, not a courier company, not someone claiming to be from WhatsApp support. WhatsApp will never ask for it.
- Turn on two-step verification: WhatsApp → Settings → Account → Two-step verification → Enable. Set a PIN you will remember, and add an email address so you can reset it.
- Check your linked devices regularly: Settings → Linked Devices. Remove any device you do not recognize immediately.
- Call before you pay. If a contact asks for urgent money on WhatsApp, call them on their actual number first and confirm it is really them.
- Remember that NCCIA has warned banks, NADRA, the Army, and the FIA never contact citizens through WhatsApp calls — any such call asking for codes or information is fraudulent.
- Be suspicious of any “contest” that asks for codes or personal details. A real vote does not need your WhatsApp verification code.
For similar tricks that abuse OTP codes, read our guides on fake parcel delivery SMS scams and SIM swap fraud in Pakistan. If criminals are pressuring you through fake government messages too, see BISP 8171 SMS scams and fake buyer scams on OLX. Fake donation appeals spreading on the same apps are covered in our guide to fake charity donation scams in Pakistan.