WhatsApp family impersonation scams targeting UK users in 2026

What is happening right now

Reports shared on online scam-awareness communities in late May 2026 show a clear pattern: fraudsters are lifting personal details, photographs, and family news from public Facebook profiles and using that information to impersonate real people on WhatsApp. The goal varies. In some cases the scammer builds a fake romantic or friendly relationship over months before pushing the victim towards cryptocurrency investments or “gold futures trading.” In others, no money is requested at all, at least not straight away, and the scammer appears to be gathering further intelligence or testing new victims.

Action Fraud, the UK’s national fraud reporting centre run by the City of London Police, urges anyone who suspects impersonation fraud to report it immediately rather than wait for a financial loss to occur. Impersonation is itself the first stage of the crime.

How scammers build a convincing false identity

The starting point is almost always a public social media profile. A Facebook account with an open privacy setting can expose a person’s full name, profile photos, cover photos, listed family members, hometown, recent life events (bereavements, house moves, new jobs), and a circle of friends whose details are equally visible.

Scammers extract this information and construct a convincing WhatsApp persona. They upload the real person’s photo as their profile picture, use the correct name, and open conversations with friends or relatives of the target by referencing real, verifiable details: a recent family bereavement, a shared memory, or a mutual connection. Because the details check out, the recipient has little reason to be suspicious at first contact.

The second step is typically to move the conversation from Facebook Messenger to WhatsApp. Messenger messages can be reviewed and flagged by Meta’s moderation systems; WhatsApp conversations are end-to-end encrypted and therefore harder for platforms to monitor proactively.

The slow-burn investment fraud pattern

One case discussed publicly in the r/Scams community illustrates how patient these scammers can be. A man had been in contact with a supposed woman for several months via WhatsApp, having initially connected on Facebook. During that time he shared significant personal information, exchanged photos and videos, and had voice and video calls. Only when a family member reviewed his messages did the scale of the manipulation become clear: he had downloaded a cryptocurrency application and set up a wallet, and had been considering investing several thousand pounds in a “gold futures trading” website.

This model is consistent with what the NCSC describes as “pig butchering” fraud: the scammer “fattens” the victim with trust and emotional investment before pushing them into a fraudulent financial product. The victim often resists intervention from family because they believe the relationship is genuine and do not want it to end.

Impersonation without a financial motive (yet)

A separate pattern involves no obvious financial request at all. In one reported case, a scammer created a WhatsApp account using a US-registered number and used details from a real person’s public Facebook page, including photos and knowledge of a recent family bereavement, to contact that person’s friends. One friend gave out her own phone number, believing she was speaking to someone she knew. The real person only found out when the friend raised it.

This type of contact may be a precursor to a later financial approach, a method of harvesting further phone numbers and personal data, or an attempt to establish credibility before a wider operation. Regardless of the motive, it constitutes impersonation and should be reported.

Why victims resist accepting the truth

Financial fraud specialists and anti-scam advisers consistently note that victims of long-running impersonation or romance-style fraud find it extremely difficult to accept they have been deceived. Months of conversation, emotional connection, and shared confidences create a genuine sense of relationship. When a family member intervenes and tries to block the scammer or remove the app, the victim may react with anger, insisting they “know it is a scam” and are “just playing along.” This denial is a recognised feature of the fraud, not a character flaw.

Citizens Advice recommends approaching the conversation without blame, focusing on the safety issue rather than the victim’s judgement. If there are concerns about a vulnerable adult, local authority adult social care services can be contacted for safeguarding advice.

How to report a WhatsApp impersonation scam in the UK

If you or someone you know has been targeted, take these steps:

1. Do not send any money. If no money has been transferred yet, the financial loss can still be prevented.
2. Report to Action Fraud online at actionfraud.police.uk or by calling 0300 123 2040. This is the official UK reporting route and creates a formal record that police can use.
3. Forward suspicious messages to 7726 (spells SPAM on a keypad). This is the UK short code operated by Ofcom for reporting scam texts and, on many networks, WhatsApp messages.
4. Report within WhatsApp. Open the chat, tap the contact name at the top, scroll down and select “Report.” WhatsApp will review the account and can suspend it.
5. Report to Facebook if the initial contact was made via Messenger. Use the “Find support or report” option on the profile. Meta can remove accounts that impersonate real individuals.
6. Alert the real person being impersonated so they can warn their own contacts and lock down their Facebook privacy settings.
7. If a crypto wallet or investment app was involved, contact your bank immediately. UK banks are required under the Contingent Reimbursement Model and, from 2024, under mandatory reimbursement rules administered by the Payment Systems Regulator to assess claims for authorised push payment fraud.

How to reduce the risk before it starts

The most direct preventive measure is to review Facebook privacy settings. Setting the profile photo, posts, friends list, and personal details to “Friends only” or “Only me” removes the raw material scammers rely on. The NCSC’s guidance on social media privacy covers this in detail for UK users.

For families with elderly or less digitally confident relatives, a brief conversation about the “call them back on a known number” rule is valuable: if anyone contacts you via a new number claiming to be someone you know, verify it by calling the person’s existing saved number before engaging further. This single step disrupts the impersonation model entirely.

WhatsApp also offers two-step verification (Settings, Account, Two-step verification) which prevents a scammer from taking over your actual account even if they obtain your SIM or verification code.

Related reading

For a broader overview of mobile fraud affecting UK consumers, visit the Mobile scams hub on this site. You may also find useful background in our article on SIM-swap fraud and how UK networks respond to it.