Spanish authorities warn of rising WhatsApp fraud and zero-click attacks

Spanish law enforcement agencies, including the Guardia Civil and the National Police, have issued warnings regarding a surge in WhatsApp fraud targeting users in regions such as Huelva and Galicia.

In Huelva, authorities identified over 50 cases of “zero-click” fraud affecting iPhone users with outdated operating systems, specifically iOS 16.7.12 and earlier. This method is particularly dangerous because it requires no interaction from the victim, such as clicking links or scanning QR codes. Attackers gain illegitimate access to conversations, allowing them to send fraudulent messages from the victim's real number within existing chat threads. This enables them to request urgent money transfers from friends and family by exploiting established trust.

In Galicia, the National Police reported a significant increase in complaints following a similar pattern where criminals impersonate victims to contact their acquaintances. In many instances, the legitimate user maintains access to the app while the attacker simultaneously sends messages from the same account. These fraudulent requests often include bank account details, sometimes from foreign entities.

Authorities recommend that users keep their mobile operating systems and applications updated to the latest security versions, enable two-step verification, and remain suspicious of any urgent requests for money or recovery codes, even if they appear to come from known contacts.