In this guide · 7 sections
- 01What SPF reported on 28 September 2026
- 02Why business WhatsApp numbers are attractive targets
- 03Protect your WhatsApp account in 10 minutes
- 04How to verify a payment request before you pay
- 05If your business number is hijacked: what to do and tell customers
- 06Do it yourself or get help?
- 07Frequently asked questions
Short answer
SPF says scammers are using compromised WhatsApp accounts to ask the account owner's contacts for money via PayNow QR codes. Turn on two-step verification, check Linked devices regularly, and confirm any payment request on a second channel before paying.
What SPF reported on 28 September 2026
The SPF advisory of 28 September 2026 describes a variant of social media impersonation scams that uses compromised WhatsApp accounts. Since September 2026, at least eight cases had been reported, with total losses of at least S$18,000.
In the cases described, scammers gained access to students' WhatsApp accounts and messaged their parents. Posing as the student, they claimed the child had been picked for a youth exchange programme or an AI course and needed to pay to secure a place. Victims received consent forms carrying the names and logos of schools and government agencies, were told fees would be subsidised and refunded, and were asked to pay by PayNow QR code. Some were then asked for a second payment because the first had supposedly gone through incorrectly.
| Scam step (per SPF) | Why it works | Business version of the same trick |
|---|---|---|
| Real account is hijacked | The message comes from a saved, trusted contact | Your sales or owner number messages customers |
| Urgent reason to pay | A limited place or deadline | "Deposit needed today to hold the slot" |
| Official-looking documents | Logos of schools and agencies | A fake invoice or quotation with your logo |
| PayNow QR code | Fast, final and familiar | "New" PayNow QR or bank account for this order |
| Second payment request | "The first one failed, it will be refunded" | "Wrong reference, please pay again" |
The victims only realised after checking with their children or getting alerts from their banks. The lesson for businesses is that a message from a known number is no longer proof of who is typing.
Why business WhatsApp numbers are attractive targets
Many small businesses in Singapore run sales, bookings and supplier chats on one WhatsApp or WhatsApp Business number. That number sits in hundreds of customers' contact lists, and customers are used to receiving payment details on it. If a scammer controls it, every one of those contacts is a potential victim, and the payment goes to the scammer's account, not yours.
The reverse also happens: a supplier's or a staff member's account is hijacked, and your finance person receives a believable request to pay a "new" account. Our guide to corporate bank account scam safeguards covers payment controls on the bank side.
Protect your WhatsApp account in 10 minutes
SPF's advisory lists two settings, and WhatsApp's own help pages add a few more. Do these on every phone that runs a business number, including staff phones used for customer chats.
Turn on two-step verification
Go to Settings, then Account, then Two-step verification, and set a 6-digit PIN. Add a recovery email so you are not locked out if you forget it. Keep the PIN in your password manager, not in a chat.
Check Linked devices and log out unknown ones
Go to Settings, then Linked devices. Log out any WhatsApp Web, Desktop or tablet session you do not recognise. WhatsApp's linked devices article says the Business app allows up to four linked devices plus one phone.
Keep push notifications on
WhatsApp notifies the phone when a new device is linked or someone tries to register your number. Those alerts are your early warning; do not mute them.
Lock the SIM with your telco
Recovery depends on receiving the SMS code on the same number. Ask your telco about a SIM PIN and port-out protection so the number cannot be moved to another SIM easily.
Install ScamShield on staff phones
SPF recommends the ScamShield app to block scam calls and filter suspicious SMS. It reduces the phishing messages that lead to code theft.
Our step-by-step guide to setting up MFA on business accounts covers the email and social accounts that are usually attacked next.
How to verify a payment request before you pay
SPF's advice is to verify unusual requests for money directly and to confirm programmes or payment requests through official channels before paying. In a business setting, that becomes a short rule everyone can follow:
Before paying any WhatsApp request
If you are asked to scan a PayNow QR code, the banking app normally shows the name of the account it pays. If that name is a person or company you do not expect, stop and call.
If your business number is hijacked: what to do and tell customers
Speed matters, because the scammer is messaging your contacts while you read this. WhatsApp's compromised account article says re-registering your number with the 6-digit code automatically logs out all other devices. Changing a password does not remove the attacker.
Re-register WhatsApp on your own phone
Open WhatsApp, log back in with your number and enter the SMS code. If it asks for a two-step PIN you never set, WhatsApp says to wait 7 days and try again; the attacker is still logged out once you enter the code.
Warn customers on other channels
Post on your website, Instagram and Facebook, and email recent customers: "Our WhatsApp was compromised on [date]. We will never ask you to pay a new account. Do not pay any request sent between [times]."
Ask anyone who paid to call their bank
SPF advises victims to contact their bank immediately to report and block fraudulent transactions, then lodge a police report.
Lodge a police report and keep evidence
Screenshot the scam messages your contacts received, with timestamps. Report online or call the Police Hotline at 1800-255-0000; the ScamShield Helpline is 1799.
Secure the rest of your accounts
Check the email address and Facebook account tied to your WhatsApp Business profile, turn on two-step verification and review linked devices.
Our full recovery guide for hacked WhatsApp and social media accounts covers Facebook, Instagram and banned numbers. If the attack came through Telegram, see the Telegram account takeover guide.
Do it yourself or get help?
Turning on two-step verification and checking linked devices takes minutes and you can do it today. A written payment-verification rule for staff costs nothing and blocks most of these scams.
IT Sorted is a Singapore-based team of developers with over 10 years of experience. If your number or email has already been taken over, Hacked Email Recovery (S$290) helps you regain access and lock things down. Security Awareness Training (S$390) walks your staff through code-sharing, impersonation and payment-verification scenarios like the ones in SPF's advisory.
Frequently asked questions
SPF warned about scammers using compromised WhatsApp accounts to impersonate students and ask their parents to pay for fake youth exchange programmes or AI courses by PayNow QR code. At least eight cases with losses of at least S$18,000 had been reported since September 2026. SPF advised two-step verification, checking linked devices and verifying payment requests directly.
Usually by tricking the owner into sharing the 6-digit registration code sent by SMS, often with a fake message from a friend, courier or platform. With that code they register your number on their phone. Two-step verification adds a PIN they also need, which is why SPF and WhatsApp both recommend turning it on.
WhatsApp says messages are end-to-end encrypted and stored on your device, so someone re-registering your account on a new phone cannot read your past conversations. They can, however, message your contacts and groups as you, and they may see new messages that arrive while they control the account.
No. WhatsApp says the only way to remove someone who has taken over your account is to re-register it with the 6-digit code sent to your number. That logs out every other device. After that, set a two-step verification PIN with a recovery email and review your linked devices.
That depends on the facts and is a legal question, so get advice. In practice, help the customer quickly: confirm in writing that your account was compromised, share the time window, and tell them to contact their bank and lodge a police report at once. Keep your own evidence and police report number for any later claim.