WhatsApp vote scam: two tricks – and two ways back
The Federal Office for Cybersecurity recorded more than 50 reports of the scam in October. Why a familiar sender is no protection, and why the type of access determines the countermeasures.
The request sounds harmless: someone from your own contact list needs a vote in a competition. Behind it, however, there can be an attack on the WhatsApp account. On 27 October 2026 the Federal Office for Cybersecurity (BACS) warned of a renewed wave of such messages. By its own account, it received more than 50 reports of this practice in the current month.
The figure describes reports to the federal agency, not all attacks in Switzerland. A success rate or a representative total of damages cannot be derived from it. What is confirmed is the observed scam: the perpetrators exploit trust between acquaintances and get those they message to activate security functions themselves for a foreign access.
The familiar contact may already have been taken over
According to BACS, the lure messages come from accounts that have already been compromised. They refer to an alleged school or dance competition and create time pressure. The name in the address book is therefore no proof that the known person is actually writing. Even a kindly worded request is no technical security guarantee.
The link leads to a fake voting page. There the attack paths diverge. In the first variant, users are asked to enter their phone number and then an SMS code. In fact, this is the six-digit WhatsApp registration code. It does not confirm a competition vote, but can enable the account to be set up on another device.
In the second variant, users are asked to scan a QR code with the WhatsApp "Linked devices" function. The function is legitimate, for example for use on one's own computer. On the fraudulent page, however, it connects the account to a device belonging to the attackers. The user's own phone may continue to work normally. A failure to lose the account is therefore no all-clear.
Not every access exposes all old chats
The distinction also affects the consequences. BACS warns generally about access to messages and media. WhatsApp, by contrast, specifies that a mere re-registration on a new device does not automatically make earlier conversations readable: messages are stored on the previous device. This statement about re-registration is no all-clear for an additionally linked device.
A blanket claim that every stolen SMS code necessarily opens the entire chat history would therefore go too far. Identity misuse remains relevant: further contacts can be approached under the familiar name. Which data became accessible in an individual case cannot be determined from the mere description of the scam.
What is described is therefore not a proven break of encryption, but a misuse of registration and linking functions. That matters for classification: a technically encrypted conversation does not protect against someone admitting the wrong participant to their own account. The federal warning also does not prove that all messages containing competition links are fraudulent.
What to do when you suspect a problem
Anyone who can still open the app should check the signed-in devices under "Linked devices" and log out unknown entries. This is exactly the step BACS recommends for the QR variant. What matters is the connection that actually exists – not merely deleting the fraudulent message or closing the browser window.
After a foreign re-registration, the official recovery path runs via your own phone number and a new registration code in the WhatsApp app. According to the provider, other signed-in devices are logged out after re-registration with this code. An unknown two-step verification PIN can nevertheless trigger a waiting period of seven days. Precisely then, the code received must not be passed on to supposed helpers.
Contacts should be warned at the same time by phone, SMS or another independent channel. A query in the possibly compromised chat does not reliably confirm the sender's identity. As a precaution, the federal government recommends two-step verification. It complements protection; deliberately approved links to foreign devices do not become a safe action because of it.
For Swiss users, the most important boundary is thus not between known and unknown names, but between a message and the permission it requests. A vote in a competition needs no WhatsApp registration code and no connection to one's own account. Anyone who respects this boundary breaks the chain before their own contacts become targets too.
Sources
- BACS: Weekly review 43, renewed wave of fake WhatsApp votes, 27 October 2026
- WhatsApp: Recovering a compromised account
- WhatsApp: Registration and two-step verification
- BACS: Earlier warning about the voting scam, 26 May 2026
- Header image: microsiervos, WhatsApp, Wikimedia Commons
- Header image licence: CC BY 2.0
- Article image: Helar Lukats, Whatsapp texting, Wikimedia Commons
- Article image licence: CC BY-SA 4.0
