WhatsApp Profile Cloning and Contact Impersonation Scam
Fraudsters copy a WhatsApp user's profile picture and display name to create a near-identical account, then message the victim's contacts from a different phone number to solicit money or personal information.
Part of: Profile Cloning & Impersonation Scams
Last reviewed: 7 June 2026
WhatsApp displays a user's profile picture and display name alongside their phone number in contacts lists. However, anyone can set any profile photo and name — there is no verification of identity beyond the registered phone number. Scammers exploit this by creating a new WhatsApp account with a different number but copying the profile picture and name of a known person to impersonate them.
Unlike account hijacking, profile cloning does not require access to the original account. Publicly visible profile pictures — those viewable by 'Everyone' in WhatsApp settings — provide all the material needed to build a convincing clone. The attacker registers a new SIM card, creates a WhatsApp account, and sets the stolen profile photo and display name.
The victim's contacts, seeing a familiar face and name in their phone app, may not immediately realise the message is from a different number — especially if they have not added the original person's phone number with strict attention to the exact digits.
How this scam works on the WhatsApp brand
A cloned WhatsApp account contacts the victim's family members, friends, or colleagues from an unfamiliar phone number. Because WhatsApp shows the display name and profile photo prominently — and the phone number may not be visible at first glance — the recipient may assume it is a familiar person messaging from a new number.
The opening message typically explains the new number: 'Hi, it is [name] — I dropped my phone and this is my temporary number'. From there, the attacker builds toward a financial request: a bank transfer, a gift card purchase, or a cryptocurrency payment to help with an 'emergency'.
Because WhatsApp's presence allows back-and-forth conversation, the attacker can sustain the deception for longer than a one-shot phishing email, adapting their script as the target asks questions.
Common red flags
- A message from an unfamiliar phone number claims to be a known contact with a new number
- The profile picture and name match a contact you know, but the phone number is different
- The new-number explanation is paired quickly with a financial request
- The contact avoids voice or video calls to prevent voice recognition
- Replies from the 'new number' seem slightly out of character for the person
- The person is reachable on their original number, contradicting the 'dropped phone' story
How to protect yourself
- Restrict your WhatsApp profile picture visibility to 'My Contacts' in Settings > Privacy > Profile Photo
- Verify any new-number message by calling the person on their original number before responding to requests
- Teach family members about this scam — it often targets older relatives who may be less familiar with how impersonation works
- Add contacts with their full phone number and country code so you can compare numbers precisely
- Enable WhatsApp's two-step verification to protect your own account from being used in the same way
How to report it
- Report the cloning account within WhatsApp: open the chat, tap the contact name, and select 'Report'
- Alert the real person through their original number so they can warn their other contacts
- Report to Action Fraud at actionfraud.police.uk (UK) or the FTC at reportfraud.ftc.gov (US)
- If money was sent, contact your bank immediately and file a fraud report
Frequently asked questions
Why do these scams often specifically target older relatives?
Older relatives may be less familiar with how easy it is to copy a profile photo and display name, and may respond quickly to what looks like a family emergency. Talking to older or less tech-familiar relatives about this pattern in advance can meaningfully reduce their risk.
How is this different from someone hijacking my actual WhatsApp account?
Profile cloning uses a completely separate account on a different phone number — it doesn't require any access to your real account or password. This means changing your own password or enabling extra security does not stop someone else from cloning your public profile photo and name.
What should I say if I identify a cloning attempt targeting my contacts?
Let the affected contact know clearly that the message did not come from you, and suggest they block and report the cloned number. Posting a warning through a channel other than WhatsApp, like a text or social media post, can also help reach people quickly.
Does WhatsApp verify that a profile photo belongs to the registered user?
No. Any WhatsApp user can set any image as their profile photo. There is no identity verification linking the profile picture to the registered phone number. This is why restricting your profile photo visibility to 'My Contacts' in WhatsApp privacy settings reduces your exposure to profile cloning.
How can I tell if someone is messaging me from a cloned account rather than a genuine new number?
Call the person on their original number immediately. Most people are reachable on their original number unless the phone is genuinely broken or stolen. If the original number is unreachable, ask the new number a question only the real person would know. Be extremely cautious about any financial request before confirming identity.
Can I stop someone from cloning my WhatsApp profile?
The most effective step is restricting your profile picture to 'My Contacts' only in WhatsApp Settings > Privacy. This prevents strangers from downloading your photo for use in a clone. You cannot prevent someone who already knows your profile picture from using it, but limiting visibility significantly reduces the opportunity.