[REVISION HISTORY]

WhatsApp identity theft and evolving digital fraud

Updated 38 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-25 12:59 UTC → 2026-10-26 05:11 UTC · added ~~removed~~

The landscape of digital fraud continues to evolve, with authorities in Spain, Argentina, Colombia, Mexico, Germany, Austria, Portugal, Italy, the Netherlands, and Australia reporting diverse cybercrime tactics. In Spain, the National Police and Civil Guard have noted a surge in WhatsApp identity theft through ‘zero-click’ attacks on outdated iPhones. Cybersecurity experts have identified a dangerous zero-click vulnerability affecting users on iOS 16, allowing attackers to hijack accounts without any user interaction to request urgent money transfers. In Portugal, the Public Security Police (PSP) has warned of account cloning and spoofing where victims continue using the app normally while criminals invisibly send fraudulent messages to contacts. A recurring method involves ‘ghost pairing’ scams, where attackers use hacked accounts to send seemingly harmless requests, such as voting for children named ‘Sophie’, ‘Eliska’, or ‘Franziska’ in contests. These schemes direct users to links that prompt them to enter codes via the ‘Linked Devices’ function, granting attackers full access. Researchers at Gen Digital have identified this ‘GhostPairing’ tactic, noting that attackers often use deceptive messages claiming to have found a photo of the recipient to lure users to fraudulent pages mimicking Facebook. Recent reports highlight a resurgence of these tactics across Europe. In Italy and San Marino, authorities have alerted the public to the ‘ballerina scam’, where victims are invited to vote for dancers in fake competitions. ~~Similarly, a coordinated phishing campaign involving ‘ghost pairing’ has been identified by organizations such as Spain’s INCIBE and Bitdefender, targeting users in~~ In Spain, ~~Belgium, Germany,~~ the Guardia Civil, National Police, and ~~France. These campaigns use malicious~~ OCU have issued specific warnings regarding a fraudulent voting scheme using names like ‘Eliska’ or ‘Sophie’. When victims click these links and enter a code to ~~redirect victims~~ ‘link a device’, criminals gain full session access to ~~fraudulent websites that mimic voting platforms, ultimately tricking~~ impersonate the victim and request money. Experts advise users ~~into providing device-linking~~ to never enter such codes ~~that allow attackers~~ and to ~~authorize parallel sessions on their accounts.~~ immediately check ‘Linked Devices’ settings to terminate unrecognized sessions.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.