PROJECT: EXTREMELY URGENT PUBLIC WARNING - WHATSAPP REGISTRATION CODE SCAM

Isabel Spies
4 days ago
5 min read

PLEASE SHARE THIS PUBLIC DOCUMENT

This is a classic social engineering phishing attack targeting WhatsApp's verification process,

which has been surging in South Africa in 2025, owing to the app's massive popularity (over 28.8 million users,

or 93.9% of active social media users).

Scammers exploit the trust people have in the platform and their contacts, turning a simple SMS notification

into a gateway for account takeover. Here's a step-by-step breakdown based on reports from cybersecurity experts,

telecom providers like MTN, and real victim accounts:

MODUS OPERANDI:

1. SCAMMER INITIATES THE ATTACK:

The hacker obtains your phone number (often from data breaches, public WhatsApp groups, or bought on the dark web).
They download WhatsApp on their device, enter your number, and request a verification code.
WhatsApp immediately sends you a legitimate 6-digit SMS code and a push notification (like the one in your screenshot) warning that a registration attempt is underway.

2. THE PHISHING HOOK:

Before you can react, the scammer contacts you via WhatsApp, SMS, email, or even a phone call, impersonating someone you know (e.g., a friend, family member, colleague, or even "WhatsApp support").
Common excuses include:
- "I accidentally requested a code to your number—can you forward it to me so I can finish my login?"
- "This is my new number; send me the code to verify."
- - More elaborate lures like "I'm entering a contest/voting for something—reply with the code you just got" or "It's a delivery/Zoom PIN sent by mistake."
In South Africa, variants often tie into local contexts, like fake "investment opportunities" or "job recruitment" schemes promising quick money.

3. YOU SHARE THE CODE - THE CRITICAL MISTAKE:

If you reply with the code, the scammer enters it on their device.
This logs them into your WhatsApp account, often kicking you out (you'll see "Account in use on another device").
They can then:
- Access all your chats, groups, contacts, photos, and status updates.
- Impersonate you to scam your network—e.g., "I'm stuck and need R500 urgently; send via EFT" or forward more codes to hijack others' accounts.
- Change settings: Enable Two-Step Verification with their own PIN, update your backup email, or alter group admin rights to lock you out further.
- In advanced cases, they might use your account for broader fraud, like spam, extortion, or linking to malware via shared links.

4. WHY IT IS HARD TO SPOT:

The notification looks official, and the follow-up message feels urgent or personal.
Scammers may use voice deepfakes (AI-generated audio/video) or spoof caller IDs to seem legit.
In SA, SIM swap fraud (where hackers port your number to their SIM) amplifies this, especially if you're travelling or not monitoring your account.
Victims often lose access mid-flight or during busy times, as one report described.

This scam is not "hacking" in the technical sense—no zero-day exploits or encryption breaks.

It is pure manipulation, costing victims time, money (via fraudulent transfers), and stress.

In 2025, it is evolved with AI for more convincing impersonations, per cybersecurity analyses.

WHAT YOU MUST DO TO PREVENT IT:

Prevention is straightforward and relies on vigilance and basic settings. Follow these steps immediately:

1. NEVER SHARE VERIFICATION CODES:

Treat any SMS code like your PIN or password.
WhatsApp explicitly states: "Do not share your verification code with others."
If someone asks, it is a scam—block and report them.

2. ENABLE TOW-STEP VERIFICATION (2FA):

This adds a 6-digit PIN you create, required for logins or re-registrations (even if they have your SMS code).
- Go to WhatsApp > Settings > Account > Two-step verification > Enable.
- Set a PIN and add a recovery email.
This blocks hackers from fully taking over, even with the code.

3. USE APP LOCK AND BIOMETRICS:

Lock WhatsApp with your fingerprint, face ID, or device PIN.
- Settings > Privacy > Screen Lock > Enable (set to 1 minute for security).
- This prevents physical access hacks if your phone is stolen.

4. MONITOR LINKED DEVICES:

Scammers might link your account via WhatsApp Web without logging you out.
- Settings > Linked Devices > Check and log out unknowns.
- Regularly review for suspicious activity.

5. GENERAL BEST PRACTICES:

Download Only from Official Stores:
- Avoid fake "WhatsApp Gold" APKs or links promising features—these install malware.
Update Everything:
- Keep WhatsApp, your OS, and apps patched for security fixes.
Spot Red Flags:
- Unsolicited codes? Urgent money requests from "friends"? Typos or odd phrasing?
- Block, report (in WhatsApp: Tap chat > Report), and alert contacts.
Protect Your SIM:
- Use a PIN with your carrier (e.g., MTN/Vodacom) to block swaps.
- Monitor for unauthorised changes.
If Hacked:
- Uninstall/reinstall WhatsApp, use email recovery (if set), or contact support via the app.
- Change passwords for linked accounts (email, banking).
- Report to the SAPS cybercrime unit or your telco.

By enabling 2FA today, you are 99% safer—scammers move on to easier targets.

Share this with your family and friends.

SA's high WhatsApp reliance makes us prime victims, but awareness stops the chain.

Stay safe!

PREVIOUS WARNING SSS PROJECTS:

Specialised Security Services invites the public to the Mike Bolhuis Daily Projects WhatsApp Channel.

This channel is important in delivering insights into the latest crime trends, awareness, warnings and the exposure of criminals.

How to Join the WhatsApp Channel:

1. Make sure you have the latest version of WhatsApp on your device.

2. Click on the link below to join the Mike Bolhuis Daily Projects WhatsApp Channel:

- https://whatsapp.com/channel/0029VarjftF8PgsI4pODE929

3. Follow the prompts to join the channel.

4. Make sure you click on "Follow", then click on the "bell"-icon (🔔)

CONTACT MR MIKE BOLHUIS FOR SAFETY AND SECURITY MEASURES, PROTECTION, OR AN INVESTIGATION IF NEEDED.

ALL INFORMATION RECEIVED WILL BE TREATED IN THE STRICTEST CONFIDENTIALITY AND EVERY IDENTITY WILL BE PROTECTED.

Regards,

Mike Bolhuis

Specialist Investigators into

Serious Violent, Serious Economic Crimes & Serious Cybercrimes

PSIRA Reg. 1590364/421949

Mobile: +27 82 447 6116

E-mail: mike@mikebolhuis.co.za

Fax: 086 585 4924

Follow us on Facebook to view our projects -

https://www.facebook.com/MikeBolhuisOfficial

EXTREMELY IMPORTANT: All potential clients need to be aware that owing to the nature of our work as specialist investigators there are people who have been caught on the wrong side of the law - who are trying to discredit me - Mike Bolhuis and my organisation Specialised Security Services - to get themselves off the hook. This retaliation happens on social media and creates doubt about our integrity and ability. Doubt created on social media platforms is both unwarranted and untrue. We strongly recommend that you make up your minds concerning me and our organisation only after considering all the factual information - to the exclusion of hearsay and assumptions. Furthermore, you are welcome to address your concerns directly with me should you still be unsatisfied with your conclusions. While the internet provides a lot of valuable information, it is also a platform that distributes a lot of false information. The distribution of false information, fake news, slander and hate speech constitutes a crime that can be prosecuted by law. Your own research discretion and discernment are imperative when choosing what and what not to believe.

STANDARD RULES APPLY: Upon appointment, we require a formal mandate with detailed instructions. Please take note that should you not make use of our services – you may not under any circumstance use my name or the name of my organisation as a means to achieve whatever end.

POPI ACT 4 of 2013 South Africa: Mike Bolhuis' "Specialised Security Services" falls under Section 6 of the act. Read more here: https://mikebh.link/fntdpv

SSS TASK TEAM:

https://mikebh.link/2fkmx6

Our mailing address is:

Mike Bolhuis Specialised Security Services

PO Box 15075 Lynn East

Pretoria, Gauteng 0039

South Africa

Add us to your address book

THIS PUBLIC DOCUMENT WAS INTENDED TO BE SHARED, PLEASE DO SO.