Spain holiday warning: Authorities warn UK holidaymakers over surge in 'chain thefts of WhatsApp accounts' - how to avoid the scam

UK holidaymakers have been issued a Spain travel warning over a surge of “chain thefts of WhatsApp accounts”. Spain's National Institute of Cybersecurity (Incibe) is urging holidaymakers to be vigilant.

Sur in English reports that the warning from the authorities comes after a man contacted authorities concerned after he had lost access to his account. According to his testimony, he received a message one day from his son telling him he had had a problem with his WhatsApp account and that he was going to send him a code by SMS which he needed him to provide. 

After receiving the code, the man sent it to his son via WhatsApp, immediately and without thinking, so he could resolve the alleged incident. Within minutes, it was himself who lost access to his account.

He tried to activate it again, was able to insert the first code requested, but was subsequently asked for a second verification code that never arrived on his phone. He then phoned his son for help and discovered that the same thing had happened to him, so it was not his son who had asked for the code.

The man had been a victim of a "chain" account theft. The next day, one of his contacts received a message from his account asking him for money because he was in financial trouble.

Incibe has issued guidance to prevent UK holidaymakers falling prey to the scam. It gives a series of guidelines for possible similar cases. 

The first thing to do is to try to activate the account again. If this cannot be done, it is likely because it has been stolen by cybercriminals who have set up the double authentication factor to prevent anyone from recovering it.

If this is the case, and if the account cannot be recovered, Incibe advises that any contacts should be notified of what has happened, since as it is a fraud that occurs in a chain, they could be affected. In addition, you should contact WhatsApp support via email at [email protected] and let them know what has happened.

If you are unable to recover your account after this last step, you should contact the application's data protection officer. If you are still unable to recover your account after the above steps then it is advised to go to the Spanish Data Protection Agency to report it. In the event of any damage, threat or harm, evidence should be gathered and a complaint filed with police. Once the account has been recovered, as a preventive measure to avoid this type of scam, Incibe advises activating two-factor authentication.