WhatsApp users lost a share of the $2.1 billion that Americans reported losing to social media scams in 2025, with the messaging app ranking as the second-costliest platform behind Facebook, according to the Federal Trade Commission. The scams arriving in chat threads have grown more organized, more automated, and harder to trace across apps. The breakdown below covers the most common WhatsApp scam types, the mechanics behind each one, and the specific red flags that Meta and federal regulators say expose them before money changes hands.
Key Takeaways
- The FTC reported that nearly 30% of people who lost money to a scam in 2025 said it started on social media, with losses reaching $2.1 billion.
- WhatsApp ranked as the second most costly social-media platform for scam losses in 2025, behind Facebook.
- WhatsApp detected and banned over 6.8 million accounts linked to criminal scam centers in the first six months of the year, according to Meta.
- Investment scams drove the largest losses, at $1.1 billion, more than half of all money lost to social-media scams.
- The FBI’s Internet Crime Complaint Center logged $20.877 billion in total reported losses across 1,008,597 complaints in 2025, a 26% rise.
- AI-related fraud generated 22,364 complaints filed with the IC3 in 2025, the first year the report tracked that category.
How WhatsApp Scams Work
Meta banned over 6.8 million scam-center accounts on WhatsApp in the first six months of the year, and its enforcement data describes a funnel in which scams start with a text or dating-app message, then move to social media and private messengers, and finally to a payment or crypto platform. Scammers cycle victims through many different platforms so that any one service has only a limited view into the entire scam, which makes the fraud harder to detect. The message you receive on WhatsApp is usually one link in a longer chain.
That chain is now run at industrial scale. Meta attributes the most prolific scam campaigns to criminal scam centers, often fueled by forced labour and operated by organized crime primarily in Southeast Asia, which run many campaigns at once, from cryptocurrency investments to pyramid schemes. A single center can push fake-job, fake-investment, and romance scripts simultaneously, then route every target toward the same payout method.
By the numbers: The FBI’s Internet Crime Complaint Center recorded $20.877 billion in reported losses across 1,008,597 complaints in 2025, a 26% increase, with an average loss of $20,699 per complaint. Cryptocurrency appeared as a descriptor on 181,565 of those complaints, the channel most scam funnels end at.
The understanding that matters for readers is structural. A WhatsApp message that seems harmless on its own (a wrong-number greeting, a job offer, a friendly investor) is frequently the entry point to a sequence that ends on a platform with no fraud reversal. Recognising the funnel early is the difference between leaving a chat and wiring funds.
Investment and Pig Butchering Scams
Investment scams cost victims more than any other category, with the FTC attributing $1.1 billion in losses to investment fraud that started on social media, more than half of the social-media total. These scams often began with an ad or post offering a program to teach you how to invest, while other scammers posed as friendly advisers or created WhatsApp groups full of “successful investors” sharing fake testimonials. The WhatsApp group of cheerful, profitable strangers is the genre’s signature.
The long-game version is known as pig butchering. The scammer builds a relationship over days or weeks, then guides the target toward a fake trading platform that shows a growing balance. When victims try to withdraw, scammers tell them they will be charged taxes and fees as a final attempt to exploit money before the scammers disappear with all of the victim funds. The withdrawal wall, not the deposit, is where the trap closes.
What “pig butchering” means: The term describes a long-con investment scam in which the fraudster “fattens” the victim with attention and small fake gains before the final extraction. Most run through crypto platforms, which is why cryptocurrency appeared as a descriptor on 181,565 IC3 complaints in 2025.
Older adults carry the heaviest exposure. People over the age of 60 filed 201,266 complaints with the IC3 in 2025 and reported $7.7 billion in losses, the most of any age group. The FBI notes that victims of investment fraud, specifically those involving cryptocurrency, reported the most losses of any crime category. Crypto-related security losses are a recurring pattern in our cryptocurrency breach statistics, where the same withdrawal-fee mechanic appears across exchange and wallet fraud.
| Social-media scam type (2025) | Reported losses |
|---|---|
| Investment scams | $1.1 billion |
| All other social-media scams combined | $1.0 billion |
Source: Federal Trade Commission, April 2026
Job and Task Scams
In a Cambodia scam center that Meta and OpenAI jointly disrupted, scammers used ChatGPT to generate the initial text message containing a link to a WhatsApp chat, then directed the target to Telegram and assigned them a task of liking videos on TikTok. Job and task scams like this one lure targets with the promise of easy money for trivial work, and they increasingly start with an AI-written opener. The “job” looks like microwork; the structure is a trap.
The trust-building step is deliberate. Scammers showed targets how much they had supposedly “earned” in theory before asking them to deposit money into a crypto account as the next task. The fabricated earnings balance makes the eventual deposit feel like an investment in money already made. That same pig-butchering trust ramp powers task scams and romance scams alike.
The single common denominator across these schemes is simple. Meta names the recurring red flag plainly: there is always a catch, and you have to pay upfront to get promised returns or earnings. A legitimate employer does not require a deposit before paying you. If a “job” sourced through WhatsApp asks for money to unlock earnings, it is a scam regardless of how polished the conversation feels.
Impersonation and Hi Mum Scams
AI-related fraud reached 22,364 complaints filed with the FBI’s IC3 in 2025, and on WhatsApp, the impersonation version surfaces most visibly through the “Hi Mum” and “Hi Dad” format, in which a message claims to come from a family member who has lost their phone. The sender, posing as a child or relative, asks the target to transfer money to cover an urgent bill or a replacement handset. The emotional urgency is the weapon; the unfamiliar number is the tell.
Meta’s guidance treats verification as the countermeasure. If someone claims to be a friend or family member, Meta advises contacting that person directly using another method of communication, such as calling the phone number you already know is theirs, before acting on the request. A 30-second call to a known number defeats the entire script.
Why it matters: Impersonation works because it short-circuits scepticism with relationship and urgency at once. The reliable defence is to refuse any money request that arrives from an unverified channel, since AI voice cloning now makes spotting a fake by ear much harder. That verify-on-another-channel rule holds even when the message sounds exactly right.
These scams also overlap with voice-based fraud, where attackers move a WhatsApp thread to a call to add pressure. The escalation patterns mirror those documented in our voice phishing data, where urgency and authority cues do most of the work.
Romance Scams on WhatsApp
Romance scams thrive on private messaging because the conversation can run for months out of public view. The FTC reported that nearly 60% of people who lost money to a romance scam in 2025 said it started on a social-media platform before moving to a private channel. WhatsApp is a frequent next step once the scammer wants privacy, away from any platform that might flag the account.
The romance frame is often a delivery vehicle for an investment scam. After the relationship is established, the conversation turns to a “safe” trading platform or a crypto opportunity the partner claims to use. That handoff is why romance and pig-butchering losses overlap so heavily in regulator data, and why the same withdrawal-fee wall closes both. The romantic story is the wrapper; the crypto deposit is the payload.
Shopping and Fake-Shop Scams
Shopping scams are the most reported social-media scam type, even though they cost less per victim than investment fraud. More than 40% of people who lost money to a social-media scam reported ordering something they saw in a social-media ad, the FTC found. On WhatsApp, the pattern usually involves a “shop” that takes payment by bank transfer or crypto and then either ships nothing or disappears.
The FTC’s prevention advice is concrete. Before you buy, the FTC recommends checking out the company by searching online for its name plus “scam” or “complaint.” A storefront that exists only inside a WhatsApp chat, with no traceable business behind it, fails that search test almost every time. The payment method is the other tell, because a seller insisting on irreversible payment rails is steering you away from any chargeback protection.
Account Takeover and Verification-Code Theft
WhatsApp now warns users about suspicious device-linking requests, the tactic behind account-takeover scams, after Meta took down 10.9 million scam-center accounts across Facebook and Instagram last year. These scams target the account itself, usually by tricking the owner into surrendering a six-digit verification code or approving a linking request. Once an attacker controls the account, they impersonate the victim to their entire contact list, which turns one compromise into dozens of fresh targets.
Meta has built a specific defence against the linking version of this attack. WhatsApp now alerts users when behavioral signals suggest a linking request might be suspicious, showing where the request is coming from and warning that it could be a scam. The alert exists because device-linking theft scales so efficiently across contact lists.
Never share a verification code: A WhatsApp verification code or a device-linking approval is the master key to your account and every contact in it. No legitimate contact, support agent, or “account recovery” service ever needs it. Treat any request for that code, however urgent or official it sounds, as a confirmed scam and end the conversation.
How to Spot a WhatsApp Scam
Meta promotes a short three-step test for spotting a scam: PAUSE, QUESTION, VERIFY: take time before responding, question whether a request asks you to send money, gift cards, or PIN codes or offers unrealistically high pay for a few hours of work, and verify any claimed friend or family member through a separate channel. With the average IC3 fraud complaint costing $20,699 in 2025, the question stage is where most scams fall apart if you actually ask it.
A handful of signals recur across every scam type in this breakdown. The table below maps the common red flags to the scam types they expose.
| Red flag | What it signals |
|---|---|
| Message from an unknown number with an urgent money request | Impersonation or “Hi Mum” scam |
| Pay a fee, tax, or deposit to unlock earnings or a withdrawal | Pig butchering, job, or task scam |
| A WhatsApp group of strangers showing investment profits | Investment scam |
| Request for a six-digit code or device-linking approval | Account takeover |
| Seller insists on bank transfer or crypto only | Shopping or fake-shop scam |
Source: Meta and FTC guidance, 2025-2026
The strongest single test cuts across all of them. The FTC’s core guidance is to never let someone you met on social media direct your investment decisions and to tighten your privacy settings, so scammers have less to work with. If a chat is pushing you toward an irreversible payment, the answer is to stop, not to clarify. General threat patterns and prevention benchmarks sit in our cybersecurity threat data.
What Meta Is Doing About It
Meta has scaled enforcement sharply, yet the residual risk persists. Meta removed over 159 million scam ads last year, 92% of them before anyone reported them, and took down 10.9 million Facebook and Instagram accounts associated with criminal scam centers. A joint operation with global law enforcement led to Meta investigators disabling over 150,000 accounts tied to scam-center networks in Southeast Asia. The takedown numbers are large precisely because the threat is large.
The lesson for users is one of proportion, not reassurance. WhatsApp banned over 6.8 million scam-center accounts in the first six months of the year. Even at that scale of enforcement, the FTC still logged record social-media scam losses for 2025, which tells users that platform defence reduces exposure without removing the need for personal scepticism.
Can you get scammed just by answering a WhatsApp message?
Replying to a single message does not transfer money or compromise your account on its own, so a one-word reply is low risk. The danger begins when a reply opens a conversation that escalates toward a money request, a fee, or a verification code. Scammers also use any reply as a signal that the number is active, which can increase follow-up contact. The safer move with an unknown sender is to not engage and to report the chat.
What should I do if I have been scammed on WhatsApp?
Move on the money before anything else. Contact your bank or card provider immediately to attempt to stop or reverse the transfer, since speed determines whether funds can be recovered. Report the scam to the relevant authority, which the FTC directs to ReportFraud.ftc.gov in the United States, and block the contact inside WhatsApp. Preserve screenshots of the conversation and any payment details as evidence, because reporting helps law enforcement trace the wider scam network.
Conclusion
WhatsApp scams are best understood as one stage of a coordinated funnel rather than isolated messages, with the FTC tracking $2.1 billion in social-media scam losses and the FBI’s IC3 logging $20.877 billion across all internet crime in 2025. The common types (investment and pig butchering, job and task scams, impersonation, romance, shopping, and account takeover) share one tell that Meta names directly: a demand to pay upfront for a promised return. Readers most exposed are those moving money on the strength of a chat alone, and older adults in particular, who carried $7.7 billion of last year’s reported losses.
The trajectory points toward more automation on the attacker side, with AI already writing the opening messages, and more behavioural defence on the platform side. The durable protection remains the slowest and simplest step: pause before paying, question any fee, and verify any request through a channel you already trust.
