“Several users have reported your WhatsApp account. Visit the official website (...) to verify it within 24 hours.” This is the message that thousands of people in Mexico are receiving on their cell phones. At first glance, it sounds like a legitimate warning... but in reality, it's a scam that can leave you without access to your WhatsApp account in a matter of minutes.
This is a new scam circulating via SMS that is already affecting users across the country. The trick is simple but very effective: they send you a fake message that looks official, ask you to verify your account via a link, and if you fall for it, the scammers can take complete control of your WhatsApp in no time.
Here's how the SMS scam to steal WhatsApp accounts works, step by step
It all starts with an SMS that arrives directly on your cell phone. The message says that “several users have reported your WhatsApp account” and that you need to verify it immediately to prevent it from being blocked. Sounds urgent, doesn't it? The message includes a link that takes you to a page that looks identical to the official WhatsApp site... but it's not.
Once you enter that fake site, you are asked to enter your phone number with the excuse of “verifying your account.” What follows is even more elaborate: the page shows you a “tutorial” that supposedly guides you through the verification process.
There, they explain, step by step, how to open the linked devices feature in your WhatsApp, select “link device,” and then use your phone number instead of the classic QR code. It seems legitimate, but that's where the trick lies.
What you are actually doing is authorizing scammers to connect another device to your account. Once you enter the code you receive via SMS, you give them full access to your chats, contacts, and groups. From that moment on, they can read your messages, impersonate you, and even ask your friends or family for money.
Why is this SMS scam so dangerous?
The most alarming thing about this campaign is that it doesn't need to install viruses, strange apps, or spyware. It's based on something much simpler (and more effective): tricking you into handing over access to your WhatsApp account yourself. This is called social engineering, and it works by playing on your trust or fear.
To give you an idea of how recent this scam is, the fake domain they are using (verification-ws[.]cc) was created on July 3, 2025. This confirms that it is a new campaign that is already active and spreading rapidly in Mexico.
The attackers don't leave anything to chance. They use obfuscation techniques in the fake site's code to make it very difficult to detect what is really happening behind the scenes: a silent theft of WhatsApp sessions.
Everything looks normal at first glance, but the site is designed to gain access to your account without you noticing. And there's more: the control panel used by these criminals (where they monitor stolen accounts) is in traditional Chinese, suggesting that they may be operating from places such as Hong Kong, Taiwan, or Macau.
Read more: Social Engineering + User Experience: The Hackers' Formula
How can you protect yourself from account theft via SMS on WhatsApp?
If you receive an SMS saying that your WhatsApp account has been reported or that you need to “verify” it, do not open the link. Delete the message immediately. It is a scam.
To keep your account secure, enable two-step verification in your WhatsApp settings. That way, even if someone gets your access code, they won't be able to log in without your PIN. It's also a good idea to check the devices linked to your account from time to time and log out of any you don't recognize.
Have you already fallen for the scam? Don't worry, but act quickly. Open the WhatsApp app, go to “Linked Devices” and close all active sessions. Then, enable two-factor verification and change your security PIN as soon as possible to regain control of your account.