In October 2026 alone the FOCS received over 50 reports of WhatsApp accounts hijacked through fake voting requests sent by known contacts. How the scam works, why it also concerns business numbers and which settings to check today.
"Hi, please vote for my friend's daughter, her name is Sofia, it will take less than a minute." A message like this, sent by someone in your contacts, is the start of a scam described by the Federal Office for Cyber Security (FOCS) in its week 43 review, published on 27 October 2026. In October alone the FOCS received over 50 reports of WhatsApp accounts stolen or tampered with in this way, many of them successfully.
The method is not new: the FOCS had already described it in its week 21 review in May 2026. The current rise in cases shows that it works. For SMEs in Ticino, which often use WhatsApp with customers, suppliers and teams on site, this is not only a private matter.
How the scam works
The message always comes from a known contact whose account has already been compromised. The link leads to a professionally faked website staging a school or dance contest. To get past security filters, the scammers use many different domains that change constantly. There are two variants for the supposed vote.
The SMS code
The site asks for the mobile number and then for the code received by SMS. In reality this is the official six-digit WhatsApp registration code. Entering it allows the scammers to activate the account on another phone.
The QR code
Alternatively the site shows a QR code to scan with the WhatsApp "Linked devices" function. This is a legitimate function, the one used by WhatsApp Web: scanning links the account to the criminals' system. According to the FOCS, in some cases the victim does not even notice that the account has been compromised.
The consequences: chain reaction and access to data
Once in control, the scammers can read chat histories, groups, shared photos and confidential information, and send the same message to all of the victim's contacts. This chain reaction explains the current spread.
For a company the consequences go further than for a private person:
- a number used with customers becomes a credible channel for further scams, for example payment or data requests in the company's name;
- chats often contain personal data of customers and staff, documents, photos of work and addresses;
- if a work phone is shared or not assigned to a specific person, the takeover can go unnoticed for a long time.
If access to these chats is likely to result in a high risk for the persons concerned, the Federal Act on Data Protection (FADP, Art. 24) requires the controller to notify the data security breach to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible.
What to set on company phones today
The FOCS recommendations apply to every phone with WhatsApp or WhatsApp Business used for work:
- Turn on two-step verification with a personal PIN: Settings > Account > Two-step verification. According to the FOCS this simple measure makes a takeover much harder. The procedure is also described in the WhatsApp Help Center.
- Never share the six-digit WhatsApp code with anyone and never enter it on a website.
- Use "Linked devices" only for your own trusted devices, such as the work laptop, and do not scan QR codes from unknown websites. It is worth checking the list of linked devices regularly.
- Be wary of requests to vote or enter contests via messaging, even from known senders, and check through another channel, such as a phone call.
On the organisational side, an SME should also know which business numbers use WhatsApp, who is responsible for each phone, where the PIN is recorded and who informs customers and staff if an account is compromised. These are the same organisational gaps highlighted by the "SME Cybersecurity 2026" study. For other business logins, the FOCS classification presented in our article on the five authentication levels applies.
If the account has already been hijacked
- Warn your contacts immediately through another channel and ask them not to click on links received in your name.
- QR variant: if you still have access to the app, go to Settings > Linked devices, tap any unknown entries and choose "Log out".
- SMS variant: if you have been logged out, register again with your own number; entering the new six-digit SMS code logs the scammers out. If they have meanwhile set their own two-step verification PIN, you must wait seven days before you can log in without that PIN; during that time the account is also locked for them. WhatsApp describes the procedure on its page on recovering a compromised account.
- Assess which customer or staff data were in the chats and whether a notification to the FDPIC is needed.
Our approach
ElaraTeq Sagl develops and runs websites and applications for SMEs and public bodies in Ticino and helps put business logins in order: account inventory, multi-factor authentication, internal rules on data and tools, as also described in our article on AI at work. For a review you can contact us.
Sources
- FOCS, Week 43: Scammers once again hijack WhatsApp accounts with fake requests to vote, 27 October 2026
- FOCS, Week 21 review on WhatsApp accounts hijacked through fake contests, 26 May 2026
- Fedlex, Federal Act on Data Protection (FADP), SR 235.1, Art. 24
- WhatsApp Help Center: How to manage two-step verification settings; About linked devices; How to recover a compromised account
