A message from a friend asks you to vote for their niece, or to forward a code “sent to you by mistake”. It is a scam: the friend’s account is already hijacked, and the code is yours. Here is how it works and how to stay safe.
What is happening
These scams reach phones by the hundreds every week. A message from a contact you trust — a friend, a relative — asks you to “vote for my niece”, to click a link, or to forward a six-digit code “sent to you by mistake”. The account writing to you is already hijacked, and the attacker is spreading from it to the whole contact list.
The recent breaches of large organisations — an employment agency, health-insurance payers, retailers — show how effective these techniques have become: scammers often already know your name, address or ID number, which makes the message look genuine. Knowing your details does not make a message real.
How the scam works
- The “vote” or prize link: it opens a fake WhatsApp or Google page that asks for your phone number and the code you then receive — handing your account to the attacker.
- The “code sent by mistake”: the attacker triggers a login to your account; WhatsApp texts you the six-digit code; the “friend” asks you to forward it. Share it, and they are in.
The right reflexes
- Never share a code received by SMS or WhatsApp — not even with a friend. No real service and no real friend needs it.
- Do not tap the link. Call the contact back on a known number to check — their account may be hijacked.
- Turn on two-step verification in WhatsApp (Settings → Account → Two-step verification), so a stolen code is not enough.
Check the link before you click
When a message contains a link and you are unsure, a professional, outside-in check lowers the risk: it follows the link to its real destination and tells you whether it is safe, suspicious or dangerous — without you ever tapping it. It is our friendly check, applied to a message you received.
Sources
How we choose, verify and write our analyses →
Stolen logins often start with a phishing message. Received a suspicious message (SMS, WhatsApp, social networks) or email? Check it before you click:
Worried your servers are exposed? Our team audits, patches and monitors Linux and cloud infrastructure 24/7.
Talk to an expert Our managed server services →
