Cybercriminals exploiting moms in latest WhatsApp scam - Hypertext

It is estimated that South Africans lost R2.4 billion in digital banking crime during 2025, with social engineering being a key way that people were exploited.

WhatsApp scams in particular proved popular among cybercriminals, and as Integrity360 points out, the “Hi Mom, my phone broke” scam is a perfect example of this.

With October being Cybersecurity Awareness Month globally, the organisation wants to highlight the dangers of social engineering, and how it leverages emotional connection in order to gain access to sensitive information.

When it comes to the Hi Mom scam, the criminal will ask receivers to save the new number. “Most parents save the number without thinking twice. The second message asks for money. The banking app won’t work on the new phone, or there’s a lift to pay for and no other way . By the time anyone thinks to check, the money sits in a stranger’s account and the child’s phone was working all along,” Integrity360 highlights in a release to Hypertext.

“A criminal has no need to hack anything when a parent will open the banking app for them. The whole trick runs on ten minutes of panic. They invent an emergency and count on the parent paying before anyone picks up the phone to check,” adds Richard Ford, Group CTO at Integrity360.

There is another version of this social engineering exploit that the company points out, where criminals take over a genuine WhatsApp account by talking its owner into sharing the six-digit registration code that WhatsApp sends via SMS. From there, they message everyone in the list, from a number and profile photo the family already trusts.

“Your daughter’s name and photo sit at the top of the chat, with years of family messages underneath. Parents trust that thread completely, and whoever has taken over the account inherits all of that trust,” says Ford.

When it comes to either version of this scam, Integrity360 advises taking one simple precaution – call the person. Speaking to the person directly, or someone who is close to them is seen as an easy way to verify whether it is indeed a scam or not.

That said, Ford also notes that AI-powered voice cloning is causing a problem too, and that families should come up with a special code or phrase for instances just like this.

“Set a family rule now, while nobody is panicking. Any request for money gets confirmed by a call you make to a number you already trust, however urgent it sounds. Some families add a code word only they know. A child who really is stranded will understand why you want to hear them first. If you can’t reach them, wait until someone else has confirmed it,” he says.

“Voice cloning means ‘it sounded just like him’ has stopped being a safe test. A code word is the one thing a criminal can’t lift from a voice note or a video posted online,” Ford continues.

The Group CTO also shares some other solid cybersecurity hygiene. Here, he says people should never the WhatsApp registration code with anyone, and that they should always have the two-factor authentication active on their account. He also says that people should warn all, or as many as possible, contacts when their WhatsApp account has been compromised.

“If your WhatsApp account has been compromised, warn your contacts through another channel so they don’t fall for the same scam, and tell the family any attempt, even if nobody paid. Whoever tried it on you is working through a whole list,” he concludes.

With WhatsApp being one of the most used applications on smartphones these days, taking the proper precautions when messaging with others is essential, especially if you don’t want to be a victim of one of these kinds of social engineering scams.

[Image – Photo by Philip Oroni on Unsplash ]

Get the tech news you want to read. Take our reader survey and tell us how we can help you better.