A WhatsApp message appears to come from a friend, child or colleague who urgently needs money. The name and profile photo look familiar, and the message may be in an existing conversation. Yet the account may have been compromised. Before transferring money or sharing a login code, call the person through another trusted route and confirm the request.
The strongest evidence is not the account’s display name but independent confirmation from the person you know. A message from a familiar account can be fraudulent after an account takeover.
- Stop acting on unexpected requests for money, credentials or device access.
- Verify the identity through a separate trusted channel.
- Contact the bank immediately if funds or credentials may be exposed.
- Keep records and use official reporting routes.
- Singapore: ScamShield and 1799 for scam checks.
How account takeover can begin
An attacker may attempt to register another person’s WhatsApp number and persuade them to reveal the one-time verification code. Another route involves unauthorised linked devices. Once the account is controlled, messages can be sent to people who already trust its owner.
Why friends are easier to deceive
The victim is not receiving an unknown sales pitch. They are receiving what looks like a familiar person’s urgent request. The story may involve a failed bank transfer, a daily limit, a school payment or a family emergency. Emotional responsibility replaces normal verification.
The two-channel rule
If money is requested through WhatsApp, confirm by calling the person through a number you already know or speaking face-to-face. Do not simply ask a question in the same potentially compromised account; the attacker may answer it. If you cannot verify, do not transfer.
Illustrative case: a fake school programme fee
A parent receives a message appearing to come from their child, requesting payment for an AI programme and showing a school-branded consent form. The parent contacts the child directly and asks the school using its official contact. This fictional exercise mirrors a scam pattern warned about by Singapore Police, but does not describe a specific victim.
What the police reported in 2026
Singapore Police warned on 21 October 2026 about at least 128 cases since September with at least S$249,000 in losses from compromised WhatsApp accounts used to request loans or assistance. Police advised two-step verification, checking linked devices and confirming unusual requests directly with the real contact.
What to do immediately if you have already responded
Stop sending money, sharing codes or following instructions from the suspicious contact. Open your bank’s official app on a trusted device or call its verified fraud hotline. Tell the bank exactly what you transferred, what information you shared and whether you approved a login or payment. Ask what emergency protections are available. Save transaction references and messages for a police report. Recovery cannot be guaranteed, but prompt action can limit further harm.
How to recognise the underlying manipulation
The scam begins with a plausible claim, then creates urgency or emotional pressure, and finally asks you to cross a trust boundary: paying a stranger, disclosing a secret, or granting access to a device. Separate the claim from the evidence. A familiar name, polished design, accurate personal information or realistic conversation can all appear in a fraudulent interaction. Independent verification means leaving the original channel and contacting the real person or institution through a route you already trust.
A family practice exercise
Discuss a fictional message that requests an urgent transfer. Ask three questions: who is asking, what exactly would leave our control, and how can we verify the claim without using the sender’s instructions? Repeat with a different story but the same underlying request. The goal is not to memorise every scam phrase. It is to make a short verification routine automatic before money, passwords, identity documents or devices are exposed.
Frequently asked questions
Can the sender look genuine?
Yes. Names, photographs, phone displays and documents can be copied or misrepresented. Verify identity independently before acting.
What if the message knows personal details?
Correct personal details do not prove the sender has authority. Do not disclose more information or follow instructions solely on that basis.
Should I reply to test the person?
A reply in the same compromised or unverified channel may reach the scammer. Use a separate known telephone number or official contact.
What if I have already sent money?
Contact your bank immediately using its official fraud route, preserve transaction details and report through the appropriate official channels.
Can a small initial payment prove legitimacy?
No. A limited payment or convincing demonstration does not prove that later promises are real or that the counterparty is trustworthy.
Is reporting worthwhile if I am uncertain?
Yes. An official scam-checking service can help assess suspicious contact. For Singapore, ScamShield offers guidance and the 1799 helpline.
What if a caller threatens legal consequences?
End the unsolicited conversation and verify directly with the relevant authority using independently obtained details. Do not transfer money because of threats.
How can I protect older relatives and students?
Agree on a simple rule: no unexpected transfer or credential disclosure without independent confirmation. Practise it without blame.
Related eduKate guides
- How a Government Official Impersonation Call Works
- How a Romance Scam Builds Trust Before Asking for Money
- How a Fake Tech Support Pop-Up and Malware Scam Works
- Fake parcel delivery texts
- WhatsApp job task scams
- Fake investment apps
- Online shopping scams
Official sources and editorial note
This guide is based on official Singapore scam guidance and ScamShield. Examples are hypothetical and clearly labelled; they are not claims about particular individuals. Procedures and statistics can change. Readers outside Singapore should use their own official bank, regulator and police reporting channels. This article is general education, not a guarantee of recovery.