Is that message from a friend in trouble real or a hacked account scam?
You receive a WhatsApp, Facebook Messenger, or Instagram DM from someone on your contacts list. They explain they're stuck abroad, in hospital, in legal trouble, or facing an emergency — and ask you to send money urgently. Alternatively, they ask you to forward them a six-digit code that 'accidentally' arrived in your SMS — which is actually a two-factor authentication code that will give the scammer access to your own account.
Your contact's account has been compromised. The scammer now has access to their contact list, their past messages (for credibility), and sometimes their photos. They're working through the contacts systematically.
The verification-code variant is particularly damaging: forwarding the code hands the scammer your WhatsApp account, which they then use to message your contacts with the same scam. This is how the attack spreads rapidly.
🚩 Red flags to watch for
- ▶The message asks for money or a bank transfer urgently, often with a reason that prevents normal verification ('I can't call, my phone is broken/I'm in a meeting').
- ▶They ask you to forward a six-digit code that 'accidentally' came to your phone — this is your authentication code and should never be shared.
- ▶The writing style or tone is subtly different from your contact's usual communication.
- ▶The story changes or becomes inconsistent when you ask follow-up questions.
- ▶They're unwilling or unable to make a voice or video call.
✅ What to do
- 1Call your contact directly on their phone number before doing anything else. A real emergency will still exist after a 30-second voice call to verify.
- 2Never share a six-digit SMS code with anyone, even if they claim it was sent to you 'by mistake' — this is always an account takeover attempt.
- 3If your contact confirms they've been hacked: they should report it to the platform, revoke active sessions, change their password, and enable two-factor authentication.
- 4If you've already sent money: contact your bank or transfer service immediately about a recall, and report to Action Fraud or the FTC.
📣 Where to report (by country)
🇺🇸 United States
🇬🇧 United Kingdom
- Action Fraud
- Police Scotland — call 101
🇦🇺 Australia
🇨🇦 Canada
🌍 Everywhere else
- Contact your local police and your bank immediately
- If money was sent, ask your bank about a recall request — act within hours
Got a suspicious message right now?
Paste it into our free AI checker for an instant pattern analysis
No account needed · Free to try · Privacy-first
Check your message free →No tool is a guarantee. AI pattern detection is a guide, not a verdict — always use your own judgment.
Common questions
My friend confirmed it's them and they really do need help. How do I know for sure?
Ask a verification question that only the real person could answer — something from your shared history that wouldn't appear in their messages or profile. If they can't answer it convincingly, trust your instincts and verify by voice call.
I forwarded the six-digit code. What should I do now?
If it was your WhatsApp authentication code: re-register your WhatsApp immediately by reinstalling the app and entering your phone number — this kicks the scammer out of your account. Enable two-step verification in WhatsApp settings. Alert your contacts that they may have received a scam message from your account.