Synthetic Identity Fraud on WhatsApp
Fraudsters use fabricated WhatsApp identities — often impersonating banks, government agencies, or known contacts — to harvest personal data and extract money from victims who believe they are communicating with a trusted source.
Part of: Synthetic Identity Fraud
Last reviewed: 1 June 2026
WhatsApp's end-to-end encryption and phone-number-based identity system create a false sense of security that synthetic identity fraudsters exploit. A scammer who obtains a victim's phone number can register a WhatsApp account with a profile photo and display name mimicking a bank employee, tax authority representative, or even a personal contact.
Because many users associate a familiar-sounding display name with a trusted source, they lower their guard and share sensitive information they would normally withhold from strangers. The platform's widespread use for family and business communication makes these impersonations particularly effective.
How this scam works on WhatsApp
A synthetic WhatsApp identity typically begins with a message claiming urgent action is needed — a tax refund requires confirmation, a bank account is about to be suspended, or a parcel cannot be delivered without address verification. The account's profile photo uses a real organisation's logo or a photo of an employee found on LinkedIn.
Once the victim engages, they are asked to confirm identity details 'for security purposes': national ID number, date of birth, or mother's maiden name. These details are then used to open fraudulent accounts elsewhere or are sold on dark-web marketplaces.
Group-based variants add the victim to a WhatsApp group apparently populated by satisfied customers or colleagues, with accomplice accounts providing fabricated testimonials to build legitimacy before a financial request is made.
Common red flags
- Unexpected WhatsApp message from a number not saved in your contacts claiming to be a bank or agency
- Urgent request to confirm identity details 'before your account is suspended'
- Profile photo using an official organisation logo rather than a real person's face
- Message grammar or phrasing that does not match previous communications from the claimed sender
- Request to click an external link to verify your identity on a website
- Group added without consent where members immediately ask personal or financial questions
- Caller ID on a voice call that does not match the saved number for the claimed organisation
How to protect yourself
- Contact any organisation claiming to reach you via WhatsApp through their official number — found on their website, not provided in the message
- Enable WhatsApp's two-step verification to protect your own account from takeover
- Never share one-time PINs, passwords, or ID documents via WhatsApp regardless of who appears to be asking
- Set your profile photo and 'Last seen' visibility to contacts only in WhatsApp Privacy settings
- Be sceptical of any group addition where you do not know the administrator
- Report and block unknown numbers immediately after a suspicious contact attempt
How to report it
- Open the chat, tap the contact name, scroll down and select 'Report' then 'Report [name]' within WhatsApp
- Forward suspicious messages to your national fraud hotline — many accept WhatsApp forwards directly
- Report impersonation of a financial institution to the institution's fraud team and to your financial regulator
Frequently asked questions
Why do fraudsters prefer WhatsApp for synthetic identity scams?
WhatsApp's phone-number-based identity system and encrypted messages mean there is no visible email header or domain to inspect. A display name and profile photo are the only identity signals most users check, making impersonation straightforward for a prepared fraudster.