A friend asks you to 'vote for my friend' on WhatsApp - and it quietly steals your account

A message arrives from a contact you trust. Could you vote for their niece in a dance competition, or their dog in a cute-pet contest? There's a link. It looks harmless, and it comes from a real friend - which is exactly why this one works.

Malwarebytes and Forbes both flagged the campaign this week. Here's the mechanics: your friend's account was already taken over, so the "vote for my friend" plea is coming from a stranger using their name. The link leads to a page dressed up to look like WhatsApp, and at some point it asks you to open your WhatsApp, go to Linked Devices, and type in a six-digit code. That code doesn't cast a vote. It authorises the scammer's phone as a linked device on your account - no password required. Once they're in, they can read your chats, message your contacts as you, and send the same "vote for my friend" bait onward. Researchers have seen it dressed up as ballet, best dog, and school prizes, and the links often ride on the genuine wa.me address to look legitimate.

The single rule that defeats it: a six-digit WhatsApp code is the key to your account, and no contest ever needs it. Never type one into a website or hand it to anyone, even if the request seems to come from someone you know. Turn on two-step verification (Settings > Account > Two-step verification) so a PIN protects the account too, and open Settings > Linked Devices now and again to log out anything you don't recognise.

Because this scam works on trust rather than a software flaw, spotting the pattern is the real protection - and it's worth mentioning to family who chat on WhatsApp. If a hijacked account leaves you cleaning up elsewhere, Tendvane's Privacy & accounts check shows which of your logins have surfaced in known data leaks so you know where to change passwords first.