Messaging apps have become a favorite channel for cybercriminals to deceive users. In recent weeks, The National Police and the Civil Guard have issued alerts about different fraud campaigns circulating through WhatsApp, all of them with a common denominator: identity theft and psychological pressure to obtain personal data or money.
From messages that pretend to be from hotels to one-time-view photos that hide extortion, scammers are perfecting their techniques to make the deception increasingly believable. The key lies in urgency and fear, two emotions that criminals exploit to make the victim act without thinking.
The most commonly used techniques by scammers
One of the most recent methods, according to the National Police, involves sending a photograph marked as view-only. Upon opening it, the sender accuses the victim of having viewed a private image and begins psychological pressure that may include threats of legal consequences. The goal is to sow fear in order to demand payment. that avoids a non-existent problem.
The Civil Guard, in collaboration with the National Cybersecurity Institute (INCIBE), has issued an alert regarding scams impersonating hotels and tourist accommodations. The criminals send a message with real reservation details—name, dates, reservation number—and warn that the stay will be canceled if a validation process is not completed via a fraudulent link. That fake website is designed to steal banking and personal data.
Another technique that is gaining ground, according to cybersecurity experts like Kaspersky, is the sending of malicious files from previously compromised WhatsApp accounts. These files masquerade as invoices, bank statements, or debt notices, and when opened, they install remote control software on the device. Trust in a known contact is the perfect bait so that the victim does not suspect anything.
Furthermore, identity theft using profile pictures remains a classic scam. Scammers download a contact's image, create an account with a different phone number, and impersonate that person to ask family and friends for money or information. The first message is usually innocent., as a notification of a change of number, so as not to raise suspicions.
Advice from authorities on how to avoid falling for scams
Both the National Police and the Civil Guard agree that prevention is the best defense. When faced with any unexpected message, the first thing to do is... Do not open links or download files from unknown senders. You should also not reply or provide personal or banking information, paying attention to the phone numbers that should not be answered.
If the message appears to be from a well-known company or service, the recommended course of action is Check the status of your booking or offer through official channelswhether it's the website or app where you made the purchase. Never use the number or link included in the suspicious message.
Experts also emphasize the importance of Configure WhatsApp's privacy settings to the maximumThis includes restricting who can see your profile picture, preventing strangers from adding you to groups, and enabling two-step verification. These measures make it harder for criminals to impersonate you or gain access to your account.
Another recurring recommendation is Be wary of any job offer or promotion that arrives via message and promises easy income in exchange for simple tasks. Scammers often pay small amounts upfront to gain trust and then ask for deposits to unlock supposed earnings.
What to do if you have already been a victim
If a link has been clicked or bank details provided, the first thing to do is contact the financial institution immediately to report the incident and review account activity. All evidence of fraud should also be kept: screenshots, phone numbers, links, and proof of any payments.
The authorities recommend file a complaint with the Security Forces And, if you need advice, call 017, INCIBE's Cybersecurity Helpline, a free and confidential service.
Furthermore, it is essential Block the sender and delete the conversation To prevent further attempts. If any remote control application, such as TeamViewer, has been installed, it should be uninstalled immediately, and all passwords for banking services and email should be changed.
Prevention remains the most effective tool. Stay calm, verify any suspicious messages, and don't let urgency take over. These are habits that can make the difference between becoming a victim of fraud and avoiding it. Authorities remind us that cybercriminals are constantly evolving, but caution and information are the best defense.
