Is a message from your friend's real WhatsApp account real?
It is really their number and really their account, and that still proves nothing. When an account is taken over, the real account sends the message. The ask is what to read, not the sender.
Two messages. One difference.
Illustrative example of the pattern, not a real message someone received.
Illustrative example of the pattern, not a real message someone received.
The one difference
The first asks how you are. The second asks you to read a code back or move money. Same number, same voice, only the ask changed.
It is really their number. Doesn't that settle it?
No. An account takeover means the real account sends the message, so "it is really them" and "it is really their number" can both be true and still tell you nothing. Read the ask, not the sender.
Does this really happen?
Yes. Anthropic's September 2026 threat report documents criminals taking over victims' WhatsApp accounts using a platform of automated headless browsers, so a message really can come from their own account.
Why would a real friend ask me to read back a code?
They would not. A code sent to your phone is yours to enter; reading it back hands someone else a way into an account. Treat any "read me the code" as a reason to stop.
How do I check it is really them?
Reach them on a different channel you already have, a phone call or another app, and ask. Do not reply on the same thread, and do not act on urgency alone.
What to do
- Do not read back or forward any code. A code sent to you is yours to enter, never to hand to a person.
- Reach your friend on a different channel, a call or another app, before you do anything.
- If money is involved, confirm the account out loud with them first. Criminals push you to not call for a reason.
Common questions
Can someone really message me from my friend's own WhatsApp?
Yes. If their account was taken over, the messages come from their real number and account. That is why the sender look cannot settle it, and the ask can.
My friend says they were locked out and need the code I received. Is that real?
Treat it as a reason to stop. A code that arrives on your phone is for you to enter, not to read back. Call them on a number you already have to check.
They asked me to send money to a new account urgently. What should I do?
Slow down and confirm by voice on a channel you trust. Urgency and "do not call" are the pressure, not the proof.
Not sure about a message?
Check a message you are not sure about
Detection runs 100% locally on your device. We store nothing.
Related reading
Source: Anthropic, "Detecting and countering misuse of AI: September 2026"