Since August 2026, police in Germany and Switzerland have been warning about a WhatsApp scam that does not come from strangers. It comes from people you know, written from their real accounts. Police in Zwickau alone counted twelve cases between mid-August and late September.
The scam targets private users. The pattern behind it, however, is the same one that cost a major European bank tens of millions of euros this year. Both cases show the same thing: a familiar name on the screen proves nothing.
How the scam works
- A message arrives from a real contact: please vote for Klara, the daughter of a friend, in a photo or dance competition. Other variants mention a sports poll or a young talent.
- The link opens a convincing voting page. To vote, you enter your phone number and confirm a WhatsApp login, either with a code or by scanning a QR code.
- What you have actually confirmed is the link between the attacker's device and your WhatsApp account. Security researchers call this "ghost pairing".
- You notice nothing. Your WhatsApp works as before. The attacker reads your chats and writes in your name.
- Your account now sends the Klara message to your contacts. Some of them also receive a fake emergency with a request for money.
Every victim becomes the trusted sender for the next round. This is why the scam spreads so fast.
Why the usual advice fails
For years, the standard advice was to check the sender. Unknown number, strange profile picture, odd spelling: be careful.
Here, the sender passes every check. The account is genuine, and so are the profile picture and the chat history going back years. Only the person typing is not. Any check that looks at the account itself cannot catch this attack.
How to protect yourself
- Never enter a WhatsApp code or scan a QR code because a website asks you to. Linking codes are only for connecting your own devices, such as your laptop.
- Check your linked devices today. In WhatsApp, open Settings → Linked devices and log out of every device you do not recognise.
- Verify unusual requests on a second channel. If a contact asks for money, a vote or a code, call the number you already have for them.
- Agree on a code word with your family. Voices can now be cloned with AI, so a phone call alone is no longer proof.
The same pattern in a bank: Fideuram
Banks are hit by the same pattern. On 23 February 2026, the chairman of Fideuram, the private-banking arm of Intesa Sanpaolo, received a WhatsApp message that appeared to come from group CEO Carlo Messina. It asked for urgent, confidential transfers for a foreign acquisition.
A phone call followed from a lawyer the chairman knew personally. The voice sounded right, but it had been cloned with AI, and the real lawyer had nothing to do with it. Forged documents arrived, including a power of attorney with Messina's apparent signature. About €95 million left the bank. Around €53 million has been recovered, and according to Reuters some €36 million is still missing.
One detail differs from the Klara scam. The fake Messina wrote from an unfamiliar number and explained it with the confidentiality of the deal. The Klara attackers do not even need that excuse, because they write from the real account.
In both cases, the name, the voice and the documents looked right, and none of them proved who was really on the other end.
Where Trusted Codes comes in
Trusted Codes does not stop an account takeover or a cloned voice. It makes both useless for the fraud that follows.
Colleagues and business partners who are connected in Trusted Codes see a shared code of three words in the app. It changes at a fixed interval; on Business plans you choose it, from six hours to 30 days. The secret behind it is kept in the device's protected storage, the Keychain on iOS and the Keystore on Android.
When an unusual request arrives, on WhatsApp, by phone or by email, you ask for the current code. The attacker may have a new number, a cloned voice, or even your colleague's real WhatsApp account. What the attacker does not have is your colleague's devices, and without them there is no code.
It is the family code word, made fit for business use:
- It rotates, so a word that was overheard or phished yesterday is worthless today.
- It works on every channel, including email. On Business plans you can also seal a message, and the recipient can compare it with the signed original.
- It leaves a trail. On Business plans, administrators see in the verification log who verified whom, and when. The words themselves are never stored.
In the Fideuram case, one question would have been enough: "What is our code?" Neither the fake CEO nor the cloned lawyer could have answered it.
What to do now
Check your linked devices in WhatsApp today. And before the next "urgent" request reaches your finance team, decide how you will verify it, because once the money has left, it is too late to start thinking about it.
Sources
- Polizeidirektion Zwickau, warning of 24 September 2026 (via verbraucherschutzforum.berlin)
- Kantonspolizei Zürich, cybercrimepolice.ch (via Beobachter)
- Reuters, 25 September 2026: AI messaging scam costs Italy's top bank Intesa millions (via Cybernews)
- Sky TG24, 25 September 2026: Truffa a Fideuram