A friend, a colleague or your aunt writes: could you quickly vote for a girl who can win a dance course? The link leads to a voting page that asks for your mobile number and then a code. If you go along with it, you link your own WhatsApp account to the criminals’ device. German police crime prevention (ProPK) warned about the scam on 17 September 2026, the Austrian consumer platform Watchlist Internet a day earlier.
How the scam works
The criminals exploit the option to link additional devices, which WhatsApp offers for WhatsApp Web on a computer, for example. Through the voting page they get you to approve their device. Watchlist Internet and the police describe the sequence like this:
- The message.
A hijacked account sends a request to all its contacts. Watchlist Internet quotes the opening, in translation: “Hi! Could you quickly vote for Eliska?” The message goes on to say the girl is a friend’s daughter and can win a free dance course.
- The voting page.
The link leads to a page offering a choice between two young dancers. According to Watchlist, it names a real ballet school in Prague as the organiser, which has nothing to do with the trap.
- The mobile number.
To vote, you are asked to enter your phone number. According to the police, this triggers device linking in the background.
- The code or QR code.
The police describe a code that appears in your app and that you are asked to enter on the page. Watchlist Internet saw an eight-digit code with linking instructions and, as an alternative, a QR code. Supposedly this prevents multiple votes.
- The takeover.
Once the criminals’ device is paired, it keeps writing in your name: new voting requests to your contacts and requests for money.
ProPK sums up the consequence, in translation: “From then on, the criminals can read your chats and send messages in your name.” Watchlist Internet writes that the trap was already circulating about a year ago and is now being pushed more heavily again, with changing children’s names and schools.If you only tapped the link and entered nothing, nothing has been paired according to the police description, because the link is only created with the code. Close the page and let your contact know through another channel.
Why the message looks so credible
It comes from the number of someone you know. Watchlist Internet points out that this is technically true: the criminals use that person’s hijacked account. The profile picture, the name and the previous chat history are genuine. The request is small and friendly, and few people refuse to help a child in a contest.
The police write that in a stressful day a moment of inattention is enough to click a link you would otherwise have recognised as harmful straight away. Anyone who tapped the link wanted to do an acquaintance a favour.
How to recognise the fake vote
The clearest sign is a request for a code or to scan a QR code. A vote does not need access to your messenger. Watchlist Internet lists further features:
- Linking as a condition. No genuine contest makes pairing with WhatsApp a requirement for casting a vote.
- Fresh domain. According to Watchlist, the page’s domain had been registered two days before its warning.
- AI images. In the current wave the dancers are AI-generated. In last year’s version, according to Watchlist, real photos were still used.
- Dead links. Links on the voting page lead nowhere.
You can check the age of a domain yourself without opening the page: enter the address in the shop check. The check is built for online shops, but for a voting page it also shows how long the domain has existed and whether it is on a warning list. A domain that is only a few days old does not fit a contest run by a school with a history. What lies behind such pages technically is explained in the glossary under phishing.
Code entered: what to do now
First log out unknown devices, then secure the account and warn your contacts. The steps come from the warnings by the police and the German consumer advice centres:
- Check linked devices.
The consumer advice centres describe the route like this: on an iPhone, tap Settings or your profile picture, on Android the three dots, and then “Linked devices”. Tap every device you do not recognise and then “Log out”.
- Turn on two-step verification.
The police advise this. According to the German Federal Office for Information Security (BSI), you find the feature under Settings, Account, “Two-step verification”. There you choose a method of protection and set it up.
- Warn your contacts.
The police advise informing your contacts through another channel, such as a call or text, that messages from your account may not be from you.
- Secure evidence.
Take screenshots of the voting message, the page and the messages sent in your name. How to secure them is under Securing evidence.
- Report it to the police.
Watchlist Internet recommends this. Your state’s online police station is listed under Reporting offices.
If you can no longer get into your account
Then a new registration helps. WhatsApp describes logging back in with your phone number and entering the six-digit code you receive by text or phone call. After that, all devices logged into your account are logged out automatically. If the app asks for a PIN you do not know, the criminals may have set up two-step verification themselves. WhatsApp then advises waiting seven days and trying again.
WhatsApp also writes that changing your password does not remove anyone from your account. Two-step verification protects an account you still have access to. Try to recover the account before you report it to WhatsApp. According to WhatsApp, a report can lead to the account being banned and you losing your data.
What the sources agree on and where they complement each other
On 3 October 2026 we put the ProPK warning, the Watchlist Internet report and the WhatsApp Help Center pages on linked devices and account recovery side by side. All of them agree on two points: you never pass on codes, and you have to warn your contacts yourself. On the remedies they complement each other.
- First measure. The police name checking the linked devices and logging out unknown ones as the first measure. This works as long as you can still use your account yourself.
- Recovery and police report. Watchlist Internet refers to WhatsApp’s recovery instructions and advises reporting to the police.
- Full takeover. WhatsApp writes that changing your password does not remove anyone from your account. After re-registering with the text code, all other devices are logged out.
- Number of victims. None of the sources gives a figure. So we do not give one either.
A contact asks you for money
Call the person on the number you already know, and do not transfer anything before you have spoken to them. That is the police’s advice. The request for money is the second part of the scam. Watchlist Internet documents a message from a hijacked account, in translation: “Hello, could you lend me 670 euros?I urgently need to go to the dentist and I’m having problems with my card. I’ll pay you back tonight.” The payment was to be made by instant transfer to the dentist’s supposed account.
A call is better here than asking back in the chat. In the chat the criminals answer; on the phone the person who owns the number picks up. Watchlist Internet notes that a dentist’s bill can usually be paid a few days later. Paying on the spot is more than unusual. Once money has gone by bank transfer, according to Watchlist, it is practically gone.
Before you pay an IBAN from a chat, match it against reported fraud cases in the IBAN check. A hit is a clear signal to stop. No hit only means this account has not been reported to us yet. The check does not replace calling your contact. If you have already transferred money, the next steps are under Money transferred.
What the scam has in common with the grandparent scam and “Hello Mum”
The pattern is the same: someone poses as a trusted person and urgently asks for money. The German consumer advice centre writes, in translation: “The grandchild trick has become the daughter trick or son trick.” With “Hello Mum”, strangers get in touch from a new number and claim to be a child who has lost their phone.
According to the consumer advice centre, such reports have become rare (as of July 2026), which does not mean they no longer happen. The voting scam closes a gap that “Hello Mum” had: the request for money no longer comes from an unknown number but from a real contact’s account. The advice stays the same. Speak to the person through the channel you already knew before you pay.
