Lorraine Williamson
A growing scam in Spain is targeting WhatsApp users through what appears to be a harmless video call. The National Cybersecurity Institute (INCIBE) has issued a stark warning after a user reported losing access to their WhatsApp account within minutes of such a call.
The incident began when the user answered a video call from someone in their contact list, only to see a black screen. When they questioned it, the caller claimed their camera wasn’t working properly and suggested screen sharing to help diagnose the issue.
What followed was a textbook case of digital manipulation. During the screen-sharing session, a WhatsApp verification code — sent via SMS — appeared briefly at the top of the screen. That single moment was all the scammer needed. With access to the code, they were able to hijack the account instantly.
From hacked account to financial fraud
Soon after, the situation escalated. Friends and family began receiving urgent messages from the compromised WhatsApp account. Some were asked to send money via Bizum, while others were asked to forward verification codes they’d just received. The hacker, now posing as the victim, was exploiting personal trust to trick others into handing over sensitive data or making payments. It’s a scam that multiplies — spreading from one account to several in a matter of hours.
Realising what had happened, the victim contacted INCIBE again for support. The cyber experts confirmed the scam is part of a wider trend and laid out a series of recovery steps.
What victims should do
First, users are urged to notify all their contacts as quickly as possible, warning them not to respond to messages sent from the compromised number. They should also inform the original caller — likely the scammer’s previous victim — so they can take precautions too.
Reinstalling WhatsApp may prompt the app to send a new verification code. However, users should be aware that a waiting period of 9 to 11 hours may apply. If access isn’t restored, they should contact WhatsApp’s support team via email. Should that prove unsuccessful, the next step is to reach out to WhatsApp’s data protection officer.
If a resolution still hasn’t been reached after one month, victims are advised to file a formal complaint with Spain’s Data Protection Agency (AEPD). In parallel, they should gather all available evidence — including screenshots, message records and timestamps — and present it to the National Police or Guardia Civil, as this is legally classified as identity theft.
How to protect yourself
To reduce the risk of falling victim to similar scams, cybersecurity professionals recommend activating WhatsApp’s two-step verification feature — an added layer of security that requires a second passcode when logging in from a new device.
Users should never share their screen during calls unless absolutely sure of who they’re speaking with. And under no circumstances should they reveal or forward any SMS verification codes, even to close friends or family. These codes are strictly personal and are the gateway to account access.
If you’ve been scammed
For those who may have unknowingly sent money during one of these scams, quick action is essential. Victims should contact their bank immediately and explain the situation. In some cases, the bank may be able to reverse the payment. If not, the matter can be escalated to the Bank of Spain through a formal complaint process.
Additionally, anyone affected should contact INCIBE through the 017 helpline, which offers free and confidential guidance every day of the year between 8.00 am and 11.00 pm.
Rising threat in a connected Spain
WhatsApp remains the dominant messaging app in Spain, used by millions to communicate with friends, family, and colleagues. But with its popularity comes vulnerability. As digital scammers become more sophisticated, even the most tech-savvy users are at risk.
This latest scam plays not just on technology, but on trust. A simple black screen, a request to share a display, and a few seconds of inattention can lead to financial loss and the violation of digital privacy.
Stay alert, share awareness
As Spain faces a rise in cybercrime, the message from INCIBE is clear: stay vigilant, question unusual behaviour, and never share personal codes — no matter how familiar the request seems. The best defence is information. And if something feels off, trust your instincts and seek help.
Millions of scam calls blocked