The Civil Guard has been unusually explicit about this scam, warning the public on its official Twitter feed. Cybercriminals aren’t chasing bank details in a hidden way; they aim for something more direct and urgent that anyone can fall for, especially on mobile devices common in Canada and the United States.
At the heart of this fraud is the attacker’s goal to steal access to a WhatsApp account by exploiting a six‑digit verification code. That code is not a random number; it is WhatsApp’s standard two‑step verification mechanism meant to confirm ownership of a phone number, so the crooks can install the account on another device. Once a person’s number is linked to a new device, the attacker effectively gains control over that WhatsApp profile and everything tied to it, including message history, groups, and contacts.
When someone’s WhatsApp is prompted to be verified on a new device, the app requests those six digits to ensure there is no unauthorized access. This moment is precisely where careful users must pause. If a stranger attempts to move a WhatsApp account to a different device, the verification step is the moment of risk, because the attacker is trying to coax the user into handing over the code.
In practice, the scam plays out with a message from the attacker that reads something like a mistaken SMS: “Hello. I’m sorry I accidentally sent a 6‑digit code via SMS, could you please send it to me? It’s urgent.” The plan is simple but effective: obtain the code and then take over the account. The risk is no longer theoretical once the code lands in the wrong hands, and the attacker can access chats, groups, and contact lists from their own device.
As the Civil Guard emphasizes, this request should be ignored. Sharing the six‑digit code with anyone is a direct invitation for unauthorized access. If a person or service asks for this code, resist—because giving it away hands control of the account to a third party. The consequence is that the attacker can manage the account on another device and gain visibility into all conversations and connections, effectively compromising personal and family communication networks.