WhatsApp, phone calls and text messages impersonating the Social Security to obtain bank details

An identity theft campaign posing as the Social Security has been detected (see image above), which is being carried out in a coordinated manner via WhatsApp, telephone calls and text messages as part of the same scam.

How is it done?

The campaign begins with a WhatsApp message mentioning alleged assistance offered by Social Security. The victim then receives a phone call reinforcing the story, stating that they need to provide an account number in order to make the payment. Finally, a text message is sent containing a fraudulent link, asking the recipient to enter their bank details. All of this is part of the same scam, designed to build trust through multiple channels.

Who is it aimed at?

This type of fraud is mainly aimed at people who are expecting to receive financial benefits from the Social Security.

Why?

The main aim is to obtain sensitive financial information, such as account numbers, in order to commit further fraud, make unauthorised transfers or even sell the data on the black market.

What do we recommend?

We recommend that you do not provide personal or banking details via unofficial channels. Social Security never asks for bank details via WhatsApp, phone calls or text messages. If you receive any communication promising financial assistance, you should check directly with the organisation that usually provides such assistance, such as the INSS or, in the case of unemployment, the SEPE. Furthermore, we recommend that you do not click on links received via text message or instant messaging without first verifying their authenticity.

How can you tell if a message is fraudulent?

Some clear warning signs include: messages that create a sense of urgency, grammatical errors, links that do not match the official domain, and requests for sensitive information via insecure channels.

Recommendations and resources

If in doubt, call the official Social Security telephone numbers to check whether the communication is genuine or not. Further information is also available on the website of the National Cybersecurity Institute (INCIBE).