Fake WhatsApp votes: how a trusted message can take over an account

On October 27, 2026, Cybermalveillance.gouv.fr published an alert about a phishing campaign mainly distributed through WhatsApp. The message asks the recipient to support someone in a fake contest, often presented as a dance competition or a scholarship vote. It appears to come from a known contact, which lowers suspicion: the relationship feels familiar and the request looks like a small favor.

The official page says the campaign is intensifying through a snowball effect. Already compromised accounts are used to send the same message to new contacts. The alert was updated on November 3, 2026. This establishes that Cybermalveillance.gouv.fr is tracking a campaign, but it does not establish a victim count, a list of targeted companies or that every circulating message means the sender’s account has been compromised.

The link in the message opens a fake voting page. The victim is asked to enter the phone number associated with their WhatsApp account. This is not needed to record a vote: it triggers a registration or device-linking process that can generate a code.

The fraudulent page then asks the victim to enter that code in the account settings, presenting it as a way to confirm participation. In reality, the code allows the attacker to add a new device to the account. Cybermalveillance.gouv.fr therefore describes a takeover obtained by abusing a legitimate WhatsApp registration workflow, rather than a demonstrated flaw in message encryption.

The scenario works because it combines three elements: a trusted contact whose account may already be compromised, a short action that looks like a favor and a technical code whose purpose is hidden. Receiving the code on your own phone does not make the request legitimate; it only means that a registration process was triggered for the number.

• A message from a known contact that contains an unusual or urgent request.
• A voting page that asks for a phone number.
• A request to enter or share a code received by SMS, phone call or WhatsApp.
• An instruction to change a setting or add a device to “validate” the vote.

Cybermalveillance.gouv.fr says a compromised account can be used to impersonate the victim and resend the scam to saved contacts. The attacker may also ask relatives for money, exploit personal data in the account or block the victim’s access, sometimes demanding a ransom.

Those are possible consequences, not proof of what happened in a specific case. Receiving the message does not prove that the sender’s account is compromised. Entering a phone number alone does not establish a takeover either; the critical point is whether a code was shared or used and whether an unknown device appears in the account. The Cybermalveillance.gouv.fr page also provides no public statistic that measures the campaign.

Small businesses often use WhatsApp to coordinate a team, exchange with customers or handle an urgent situation. A compromised personal account can therefore become a relationship-based entry point: colleagues recognize the name and may respond to a money request, a link or a fake instruction.

The risk is not limited to the messaging app. Impersonation can trigger a fraudulent transfer, expose business conversations or consume time during recovery. It can also damage trust in legitimate messages sent from the number. At the same time, a compromised WhatsApp account does not automatically provide access to the company’s information system: the impact depends on usage, linked devices and the information reachable from that account.

An organization should treat the incident as a compromise of both an account and a trusted communication channel, while separately checking business accounts, devices and any financial action requested during the incident.

Do not click the link or enter your number on the page. If the message appears to come from a colleague, verify it through a known separate channel: call the usual number, use an existing email address or ask the team directly. Do not use the potentially hijacked WhatsApp account for that verification.

Tell the contact that their account appears to be used to distribute a scam. An organization can also remind people of a simple rule: never give a login or registration code to another person, even when the request appears to come from a relative or colleague.

• Keep the message and URL for internal analysis without forwarding them.
• Report or block the account and content using the available controls.
• Check the linked devices on your own account and remove anything unfamiliar.
• Warn people who may receive the same request.

WhatsApp’s Help Center recommends registering the same phone number again with the six-digit code received by SMS or phone call. That registration automatically logs other connected devices out of the account. WhatsApp says this disconnects anyone using the account, even if the attacker enabled two-step verification.

A two-step verification PIN or password may then be requested. If the victim does not know it, the Help Center says a seven-day wait may be needed before that step can be reset. Recovery therefore depends on receiving the code on the associated number; without the SIM card or control of that number, that issue must be handled with the mobile operator first.

After recovery, review linked devices, recovery details and security settings. Warn contacts through another channel because messages sent during the takeover may have been written by the attacker. Verify financial requests and other sensitive instructions separately.

The first check is human: learn to recognize an unusual request even when it comes from a known contact. The second is technical: review linked devices regularly and enable two-step verification. The third is organizational: define another channel to confirm money requests, changes to account details or code-sharing requests.

WhatsApp says two-step verification adds protection when the number is registered again. It does not replace caution around codes and it does not turn a message from a known contact into proof of authenticity. The most useful protection is therefore the combination of an enabled setting, a device review and an independent confirmation process.

To verify that the measure is actually in place, ask each person to show where linked devices and two-step verification are found, without asking for the code or password itself. Useful awareness checks an action, not a secret.

• Never share a registration code or password.
• Enable two-step verification with a recovery email address you control.
• Review linked devices regularly and remove anything unrecognized.
• Confirm money requests or account changes through another channel.