Fake voting links hijack WhatsApp accounts: over 50 reports in October – Switzerland's NCSC warns

According to the NCSC, the attack always begins the same way: with a WhatsApp message from someone in your own contacts. That account has already been hijacked, and its real owner often knows nothing about it. The message appeals to your willingness to help and reads roughly like this: could you please vote for my friend's daughter, her name is Sophie, it only takes a minute, but hurry, voting closes soon. Because the sender is trusted and time is supposedly short, many recipients click the link that comes with it. To get around security filters, the NCSC says, the scammers constantly change the addresses behind these links and use a large number of different domains.

The link leads to a professionally faked website that simulates a school or dance competition. To cast your supposed vote, the scammers rely on one of two methods. In the first, the page asks for your mobile number and then for a code sent to you by text message. That code is in fact WhatsApp's official six-digit registration code. If you type it into the page, the scammers activate your account on their own device – and you are thrown out of your own WhatsApp.

In the second method, the page displays a QR code and asks you to scan it in WhatsApp using the «Linked devices» feature. That is the legitimate function you use to set up WhatsApp Web on a computer. The scan links your account to the criminals' system without your knowledge. The NCSC calls this variant particularly dangerous because you stay logged in and may not even realise that your account is being read and misused in parallel.

If the attack succeeds, the scammers have full control, according to the NCSC: access to chat histories, groups, shared photos and sensitive information. Next, the same voting message goes out to your entire address book. Every successful takeover thus delivers dozens of new targets – this chain reaction, the NCSC says, is what is currently making the scam spread so rapidly.

The NCSC's figures are clear: in October 2026 alone, it received more than 50 reports of this type of scam, many of which, according to the NCSC, were successful. The centre speaks of another significant increase in stolen or compromised WhatsApp accounts and notes that the method appears to be working and becoming more widespread.

It is not new. As early as 26 May 2026, the NCSC described the same scam with the same two traps in its weekly review 21 – then with the example sentence «please vote for my friend's daughter» and a girl called Sofia. According to the NCSC, the messages were circulating in several languages, often Italian or German; in the reported cases the instruction to scan the QR code was in Italian. The NCSC gave no figures at the time.

Zurich cantonal police also document the development on cybercrimepolice.ch. On 9 September 2026 they published the case «Fake dance vote leads to access to the WhatsApp account» (in German): a request to vote for a young dancer, a page showing candidates, photos and vote counts, and for «verification» a QR code that in reality links the account to a device belonging to the scammers. By the time we checked on 30 October 2026, 46 people affected had come forward there. On 12 October 2026 came the case «Hijacked WhatsApp accounts: scammers send links or demand money», which shows what happens with the hijacked accounts afterwards.

Hijacking WhatsApp accounts as such has an even longer history. In August 2023, the NCSC warned of a variant via voicemail (Combox): the attackers registered the target's number as their own in WhatsApp and – if the code did not go to the email address on file – had it read out to them by phone call at night. Because nobody answered, the code ended up on voicemail – which, for many victims, was still protected by the default PIN, such as the last four digits of the phone number. What is new about the current wave is therefore not the goal but the scale and the bait: instead of technical tricks, a friendly request for a vote is enough today.

For scammers, a hijacked WhatsApp account is above all one thing: a trusted sender. Zurich cantonal police describe how recipients cannot easily tell that an account has been taken over, because the messages appear in the existing chat history and both the phone number and the profile of the known person remain unchanged. Only the person behind it is someone else.

According to cybercrimepolice.ch, the scammers exploit this trust in three ways. First, they send further links to fake websites in order to take over the contacts' accounts too – that is the chain reaction the NCSC describes. Second, they start personal conversations and, in the course of them, ask for a money transfer under a pretext. Third, they post demands for money directly in the WhatsApp status of the hijacked account to reach several contacts at once; the reason, amount and payment method vary.

Then there is access to everything stored in the account. The NCSC lists chat histories, groups, shared photos and sensitive information; in May it also reported cases in which hijacked accounts were used to spread disinformation in group chats or launch further scams. With the QR trick this is particularly delicate: because you stay logged in, the surveillance runs quietly in the background until you discover the unknown link and end it.

The first warning sign is the request itself. The NCSC advises being wary of requests to vote in competitions sent through messaging apps as a matter of principle – even if they come from someone you know. That is precisely the trick: the message comes from a genuine contact whose account has already been taken over. Time pressure («voting closes soon», «takes less than a minute») should strengthen your suspicion, not dispel it.

The second warning sign is what happens on the website. A genuine vote needs neither your mobile number nor a code sent to you by text message. If a page asks for exactly that, the code is WhatsApp's registration code – there is no other six-digit code you receive after entering your number. The same applies to any request to scan a QR code «with WhatsApp» or via «Linked devices»: that feature connects a device to your account, nothing else. It has nothing to do with casting a vote.

If in doubt, follow the NCSC's advice: contact the sender another way, for example by phone, and ask whether the message really came from them. Often that is how they first learn that their account has been hijacked – so let them know that such messages are being sent in their name. WhatsApp itself sums up the most important protection in a single sentence on its security page: set up a secret PIN and never share it with anyone to prevent someone from stealing your account, WhatsApp writes.

The most effective measure is two-step verification. According to the NCSC, you will find it in WhatsApp under Settings > Account > Two-step verification. Switching it on secures your account with a PIN of your own choosing in addition to the text-message code – according to WhatsApp, this protects you even if someone gets hold of your one-time passcode. The NCSC writes that this simple step makes it much harder for scammers to take over your account. According to the WhatsApp blog of 25 August 2026, the feature has since been strengthened: instead of a six-digit PIN, you can now set a longer password with letters, numbers and special characters. How to build a password like that and still remember it is in (→ Create a strong password – and what is actually secure in 2026) – and «123456», WhatsApp says explicitly, is not an option.

Then there are passkeys. According to the same blog post, more than one billion people on WhatsApp use a passkey to log in with their fingerprint, face or screen lock – with no codes or PINs. Since August 2026 you can store more than one passkey per account, for example if you use both Android and iOS. WhatsApp gives the path as Settings > Account > Passkeys. What a passkey is and why it leaves phishing pages empty-handed is explained using Google as the example in (→ Set up 2-Step Verification on your Google Account – prompts, app, key or passkey) – the principle is the same on WhatsApp.

Second, «Linked devices»: according to the NCSC, use this feature only to set up WhatsApp Web on your own, trusted devices – such as your own laptop. Do not scan QR codes from unfamiliar websites, whatever reason is given there. Also take a regular look at the list under Settings > Linked devices: every device you know should be there, and no other.

Third, the code: according to the NCSC, never share the six-digit WhatsApp verification code with anyone and never enter it on a website. It belongs only in the WhatsApp app on your own phone. And fourth, voicemail: change your voicemail PIN if it is still set to the default. Back in 2023 the NCSC already advised changing all default passwords and treating PIN codes like passwords – otherwise attackers can simply have the code read out to them at night.

First, your contacts. According to the NCSC, let them know straight away through another channel – an ordinary text message, a phone call or email – that your account has been hacked, and warn them not to click on links in messages that appear to come from you. The faster this happens, the fewer new victims your account brings the scammers.

Then the account. With the QR trick you still have access to the app: according to the NCSC, go straight to Settings > Linked devices, tap any devices you don't recognise and select «Log out». With the text-message trick you have been logged out of the app: register your phone number again on your smartphone. You will receive a new six-digit code by text message, and entering it, the NCSC says, automatically logs the scammers out. If the attackers have meanwhile set up their own PIN for two-step verification, you will have to wait seven days before you can log back in without it – but according to the NCSC, the scammers will be logged out of your account during this time too. Your past conversations, WhatsApp says, are safe on your phone and cannot be read by anyone trying to access your account.

Finally, the authorities. Zurich cantonal police advise filing a report at your local police station after calling ahead. If you have already transferred money in response to a request from a hijacked account, contact your bank or payment provider immediately and ask them to check whether the payment can be recalled. And if you use the same password anywhere else, change it everywhere.

DealsScout's take: it is no accident that the scammers want a code rather than a password. WhatsApp does not ask for a password when you set it up – proof that the number is yours comes via the text-message code. An account without two-step verification or a passkey is therefore only as secure as that one text message, and that can be obtained with a friendly request for a vote. Two-step verification changes the game because the PIN or password exists only in your head and never travels by text message. The same logic applies to your email account, through which almost every other login can be reset: how to secure it with a second factor is shown in (→ Set up 2-Step Verification on your Google Account – prompts, app, key or passkey). A VPN, incidentally, does not help here – it encrypts the route your data takes, not your decision to type a code into someone else's website (→ What is a VPN? How the virtual private network works).