“Hi Mom, my phone broke. This is my new number, please save it.” There’s nothing especially unusual about that message. Phones break, people lose them, and asking a parent for help getting home is hardly suspicious on its own. That gives a criminal pretending to be your child a plausible explanation for both the unfamiliar number and the request for money that follows.
The broken phone also explains why they supposedly can’t use their banking app. Each part of the story helps account for something you might otherwise question, until paying for a lift or covering an urgent bill feels like an ordinary favour. By then, you may be more worried about getting your child home than about checking who supplied the banking details.
This is the “new number” scam highlighted by cybersecurity company Integrity360 for Cybersecurity Awareness Month. It can work without anyone breaking into your bank account. You make the payment yourself, using your own phone, because someone has convinced you it’s going to help a person you love.
“They invent an emergency and count on the parent paying before anyone picks up the phone to check,” says Richard Ford, Integrity360’s group CTO. Checking means contacting your child separately, using a number you already know belongs to them. Asking the person in the suspicious chat to confirm their story gives the criminal another chance to keep you talking.
The banking app can work exactly as intended
SABRIC’s 2025 annual crime report records about R2.4 billion in digital banking client claims at participating banks, up 29.2% from 2024. It covers 110,074 reported investigations across several kinds of digital banking crime, so those numbers shouldn’t be presented as losses from this particular WhatsApp scam.
The report does explain why an impersonation deserves attention: much of the crime involved persuading customers to disclose information or authorise transactions, rather than attacking banking systems directly. A bank can correctly establish that you’re the person approving a payment without establishing that the person asking for it is your child. That leaves room for a convincing lie even when the app’s security checks are doing their job.
Criminals also borrow credibility from services we recognise, as with the scam using Google Sheets to steal crypto. In the WhatsApp scam, the borrowed identity belongs to someone you know. A familiar account can make a request seem trustworthy before you’ve checked who’s actually using it.
Sometimes it really is their number
An unfamiliar number gives you something to question. A stolen WhatsApp account removes that warning, because the request arrives from someone you already know. Criminals can take over an account by persuading its owner to hand over the six-digit registration code sent to their phone, then use it to impersonate them.
On your phone, the new request can appear in the same conversation as genuine messages you’ve exchanged before. Those old messages don’t authenticate the new one, and their presence doesn’t mean the criminal has automatically gained access to the account’s entire chat history. They do make the request look as though it belongs there.
If the request comes from a supposed replacement number, call your child on the number you already have saved. If it comes through their usual WhatsApp account, try an ordinary mobile call rather than calling that account through WhatsApp. When you can’t reach them, contact someone who can check on them independently, such as a friend they’re with. A different number supplied by the person asking for money doesn’t give you an independent check.
Hearing their voice doesn’t settle it
A voice note might once have seemed like a sensible way to confirm who was messaging. AI voice cloning makes that less dependable. The US Federal Trade Commission has warned that criminals can imitate a relative’s voice using a short recording taken from material posted online, so a familiar voice can be part of the impersonation too.
There’s no need to assume every suspicious message uses AI. A plain text conversation can be convincing enough, especially when public social media posts supply details about someone’s travel or work. AI gives criminals another way to support the story; it doesn’t make recognising your child’s voice a reliable substitute for contacting them yourself.
Ford recommends agreeing beforehand that urgent money requests will be checked through a separate channel. A family code word can help, provided you keep it private and don’t choose something a stranger could find on social media. It can also be exposed through a compromised conversation, so treat it as an additional check rather than a guarantee.
If you have reason to believe your child is in immediate danger, contact emergency services while trying to establish where they are. Checking on their safety doesn’t require you to pay an unverified caller.
If you’ve already sent the money
Call your bank’s fraud team immediately, using its official app or the number on your card, and ask whether the transfer can be stopped or the funds recovered. Keep the messages and payment details for the bank and a police report. Getting the money back isn’t guaranteed, and continuing the conversation with the person who took it can delay the call you need to make.
To reduce the risk of your own WhatsApp account being stolen, never share its registration code. Enable two-step verification under Settings, then Account, which adds a separate PIN to protect account registration. It won’t stop someone pretending to be you from another number, but it adds protection against taking over your genuine account.
If someone does take it over, follow WhatsApp’s recovery instructions and warn people through another channel straight away. Tell them to ignore money requests from the account while you’re recovering it. Waiting until you can send that warning on WhatsApp gives the person using your name more time to ask for money.