WhatsApp Hijack Scam: The Script and the Call That Stops It

A WhatsApp hijack scam is when a scammer takes over a real person’s WhatsApp account, usually by tricking them into handing over a six-digit code or scanning a QR code, and then messages that person’s contacts asking for money. The request arrives from the right name, the right photo and the real chat history, so the only check that works is a phone call to a number you already have. Singapore police say at least 128 people have fallen for it since September 2026, losing at least S$249,000.

How big is the WhatsApp hijack scam right now?

Big, and growing fast across Asia. Here is what police have published in 2026:

• Singapore, since September 2026: at least 128 cases and at least S$249,000 lost, according to the Singapore Police Force’s 21 October 2026 advisory. Scammers asked for loans, citing problems with bank transfers or having “reached maximum transfer limits”.
• Singapore, first half of 2026: 391 cases of impersonation through compromised WhatsApp accounts, or 66.6% of all social media impersonation cases, per the SPF Mid-Year Scam and Cybercrime Brief 2026. Social media impersonation losses rose 71.3%, from S$2.2 million to S$3.9 million. One honest caveat from the same brief: a single crypto case of about S$2.1 million drove much of that jump.
• Hong Kong, January to July 2026: police handled 1,993 WhatsApp hijacking cases, up 170% year on year, with HK$146.3 million in reported losses, RTHK reported on 31 August 2026.
• Malaysia: Bukit Aman’s Commercial Crime Investigation Department has warned that scammers hack WhatsApp or Telegram accounts and message contacts for loans, often to a bank account in someone else’s name, The Sun reported.

Victims usually find out the same way. They check with the real account owner, and the owner has no idea.

Takeaway: two in three Singapore social media impersonation cases in early 2026 came from a hijacked WhatsApp account, not a fake one.

How is this different from the “guess who” call or a wrong-number text?

We have covered two cousins of this scam. In the “guess who” fake friend call scam, a stranger rings from an unknown number and waits for you to supply a name. In the wrong-number text scam, a stranger pretends to have messaged you by accident and builds a friendship over weeks. The hijack skips the stranger stage entirely.

The slow, long-con version of chat-based fraud is covered in our pig-butchering scam guide.

Takeaway: with a hijack, checking the name, photo or old messages proves nothing. Only a voice call to a number you already had does.

The WhatsApp hijack scam script, stage by stage

The examples below are short and invented, built from patterns in police warnings. They are here so you recognise the shape, not to be copied. Names are made up.

Stage 1: the takeover lure

EXAMPLE (from a saved contact, “Auntie Mei”): Hi dear, my friend’s girl is in a dance competition. Can help vote for her? Just one click [link]

Red flag: a voting or prize page that asks for your phone number, a code or a QR scan. Singapore police described exactly this in a February 2026 advisory: entering the OTP or scanning the QR code links the scammer’s device to your WhatsApp.

Do instead: don’t open the link. Reply “I’ll call you” and ring Auntie Mei. If she didn’t send it, her account is already taken.

Stage 2: the code request

EXAMPLE: Sorry ah, I accidentally sent a 6-digit code to your number. Can you forward it to me? Urgent.

Red flag: nobody can “accidentally” send you a WhatsApp code. The scammer typed your number into WhatsApp, which sent the code to you. SPF’s May 2026 advisory said this trick alone hit at least 52 people in five weeks. Its advice is blunt: never give up WhatsApp OTPs.

Do instead: don’t reply with the code, ever. Turn on two-step verification now (steps below).

Stage 3: the money ask to contacts

EXAMPLE (from “Daniel”, a real friend’s account): Bro you free? My bank transfer limit hit already. Can help me pay this first? I return you tonight. [QR code]

EXAMPLE (from “Jia Hui”, your daughter’s account): Ma, I got selected for an AI exchange programme! Need to pay the deposit today to keep my place.

Red flag: money to an account or QR code that is not in your friend’s name. Police note these requests often point to payment providers or third-party accounts. The student version is real too: SPF’s 28 September 2026 advisory describes fake consent forms with school and agency logos.

Do instead: reply “Let me call you” and call the number you have saved, or their home or office line. For a school programme, call the school.

Stage 4: pressure and urgency

EXAMPLE: Cannot talk now, in a meeting. Just send pls, 10 min only. Don’t tell Mum first ok.

Red flag: they refuse a call, ask for secrecy or set a deadline. A real friend can spare 20 seconds on the phone.

Do instead: wait. If they won’t take a call, the answer is no. Ask a question only the real person would know, out loud, on a call.

Stage 5: the follow-up and second ask

EXAMPLE: Aiyo the first one didn’t go through, the system processed it wrong. Can send again? Will return both.

Red flag: “it failed, pay again”, or a second, bigger loan. SPF says some victims were asked for further transfers after the first. Meanwhile the hijacked account keeps sending the stage 1 link to everyone else.

Do instead: stop. Call your bank if you paid anything (see below), and warn the real owner through another channel.

Takeaway: every stage has the same exit. Say “I’ll call you”, then actually call.

What we found: how the lure changed in eight months

On 30 October 2026 we read every Singapore Police Force advisory on hijacked WhatsApp accounts published in 2026 that we could find, plus the mid-year brief. The cover story changes. The engine doesn’t.

1. 10 Feb 2026: “vote for a friend’s child” in a dance contest; fake voting page asks for an OTP or QR scan. No losses reported yet.
2. 8 May 2026: “I sent a code to you by accident”; at least 52 cases and S$46,000 lost since 1 April.
3. 28 Sep 2026: hijacked student accounts ask parents to pay for a “youth exchange” or AI course; at least eight cases, S$18,000.
4. 21 Oct 2026: “transfer limit reached, help me pay”; at least 128 cases, S$249,000 since September.

Hong Kong police describe a parallel route: fake SMS messages warning your account will be suspended, with a link that exposes the account, per RTHK.

Takeaway: expect a new story next month. The tells stay the same: a code, a link, a QR, then money to a stranger’s account.

The “verify with a call” rule

One rule covers almost everything: no money moves on a chat message alone. Use this checklist when a contact asks for money on WhatsApp.

Call a number you saved before this chat, not one sent inside it. A voice note is not a call. Hong Kong police give the same advice: call to verify any contact who unexpectedly asks for money, as The Standard reported.

Takeaway: if they won’t take a call, you won’t send money. That one habit kills the whole script.

If your WhatsApp account was hijacked

Act fast. The scammer is messaging your contacts right now.

1. Log back in on your own phone. Open WhatsApp, register your number again and enter the new SMS code. Singapore’s Cyber Security Agency explains this logs the scammer out.
2. If you’re asked for a PIN you never set, the scammer has turned on two-step verification. CSA says you may have to wait 7 days before you can sign in without it. Keep trying from your phone; don’t pay anyone who offers to “fix” it.
3. Warn your contacts by SMS, a call or another app: “My WhatsApp was hacked. Do not send money or codes.”
4. Remove unknown linked devices: Settings > Linked Devices, per the SPF advisory.
5. Turn on two-step verification: Settings > Account > Two-step verification > Enable. WhatsApp’s own security page says to set a secret PIN “and never share it with anyone”.
6. Report it to police, especially if anyone sent money in your name.

Takeaway: logging back in, removing linked devices and setting a PIN takes five minutes. Do it before you do anything else.

If you already sent money

Minutes matter. Banks can sometimes stop a transfer that has not been cashed out.

1. Call your bank’s fraud line now and ask them to block the transaction and your card or account if needed. Our guide to blocking online banking fast shows where the kill switch is.
2. Call your national scam line (table below) and make a police report.
3. Keep everything: screenshots, the QR code, the account number, times and amounts.
4. Ignore anyone offering to get the money back for a fee. That is a second scam; see how recovery scams work.

Malaysia is blunt about speed. “The faster the victim calls 997, the faster” Bank Negara can block stolen funds, Communications Minister Fahmi Fadzil said, per Malay Mail. For a step-by-step plan after any scam, use our scam help tool.

Takeaway: bank first, scam line second, screenshots third. Never pay a “recovery agent”.

Protect your family in 10 minutes

• Sit with parents and teens and turn on two-step verification on every phone.
• Check Settings > Linked Devices together and log out anything unfamiliar.
• Agree one family rule out loud: “No money without a call.”
• Tell older relatives that a code request from a friend is always a scam.
• Test yourselves with our two-minute scam quiz.

Takeaway: the cheapest protection is a family rule everyone has heard before the message arrives.

FAQ

How do scammers hijack a WhatsApp account?

Mostly by getting you to hand over the six-digit verification code, or to scan a QR code or enter a code on a fake voting page. That lets them register or link your account on their device. Singapore and Hong Kong police both describe these routes in 2026 advisories.

My friend messaged me on WhatsApp asking for money. Is it a scam?

It might be, even though it’s their real account. Call them on a number you already have before sending anything. If they can’t or won’t talk, don’t pay.

Is a WhatsApp verification code request from a friend ever genuine?

No. A code sent to your phone is for your account only. Nobody else needs it, and sharing it can hand over your account.

Can I get my WhatsApp account back after it’s hacked?

Usually, yes. Re-register your number on your own phone and enter the new SMS code. If the scammer set a two-step PIN, Singapore’s CSA says you may need to wait 7 days.

I paid a scammer pretending to be my friend. Will I get the money back?

There is no guarantee. Your best chance is calling your bank and your national scam line immediately, then making a police report. Ignore anyone who promises recovery for a fee.

HotStakes is an independent directory. Some links on this site are affiliate links; we may earn a commission at no cost to you, and it never changes our rankings. Gambling involves risk — only play with money you can afford to lose, and if it stops being fun, seek help. This article is general information, not legal advice. Read our full disclaimer.