WhatsApp scam using children's dance contest to steal accounts in Spain
The National Cybersecurity Institute warns of fraud impersonating a dance contest to gain access to WhatsApp accounts and impersonate victims.
New WhatsApp scam using fake dance contest
A WhatsApp scam is currently circulating in Spain using a supposed children's dance contest as bait. According to El Confidencial, the message asks users to vote for a girl named Eliska, with a link that apparently redirects to the voting page. The sender presents themselves as a known contact, which facilitates users trusting the request. The cybercriminals' actual aim is to gain access to the victim's WhatsApp account to impersonate their identity.
The typical fraudulent message includes a phrase such as: "Can I ask you a small favour? Could you vote for Eliska? She's the daughter of some friends of mine. The first prize is a free dance class." The National Cybersecurity Institute (INCIBE) has confirmed that the criminals exploit trust between family members and friends. There is also a variant of the fraud that mentions another supposed contestant named Sophie.
Upon accessing the link, the victim sees a webpage that simulates a children's voting page. The page displays photographs of two girls who allegedly compete to win a ballet class at an academy in Prague. To "participate in the vote", the page requests a telephone number and displays a code accompanied by instructions to enter it into WhatsApp. However, that code has no legitimate voting function.
INCIBE explains that the code allows linking an external device to the WhatsApp account via an authentication function within the application itself. Cybercriminals can thus access an active session without the victim necessarily losing access from their regular phone. Once inside, they can impersonate the victim, send messages to their contacts and use their identity to perpetrate new scams.
A dangerous characteristic of this fraud is that the message can come from someone saved in the contacts list. Receiving the request from a family member or friend does not guarantee it is legitimate. INCIBE specialists recommend not opening suspicious links, not entering WhatsApp verification codes, and verifying any unexpected request through another means, especially if it asks to participate in contests or provide personal information.
If a person has followed the instructions from the false vote, they should immediately review the devices linked to their WhatsApp account and close any unknown sessions. It is also advisable to activate two-step verification, inform contacts about the potential compromise, and change passwords for services that may have been affected. INCIBE offers free advice through telephone 017 for those who suspect they have been victims of this or other digital scams.
Source: El Confidencial