Scammers on Messaging Apps: How to Keep Your Account and Money Safe

Scams on messaging apps have long since moved beyond “Nigerian letters” full of spelling mistakes. Today, these are carefully crafted schemes in which everything looks plausible: a familiar phone number, a bank logo, and a link that’s almost identical to the real one. Let’s break down the most common scams and what to do to avoid losing your account and money.

The Main Rule

Almost all of these schemes boil down to one thing: they rush you. “Urgent,” “only today,” “your account will be blocked in an hour.” The rush makes you stop to think—and that’s exactly what they’re counting on.

If a message seems urgent and includes a request to do something with your account or money—stop right there. No real-life situation will be ruined by taking five minutes to verify it.

Figure 1. Verification Code

You receive a message purporting to be from an acquaintance: “I accidentally entered your number—please send me the code from the text message.” Or you get a call “from customer support.” The code you receive is the key to your account. Whoever gets it will be able to log in.

A rule with no exceptions: Never give your verification code to anyone—not to friends, not to customer support, not to the bank, and not to the police. The messaging app’s customer support team will never ask for your code.

Figure 2. A friend's hacked account

After hijacking an account, the attacker sends messages to all of the owner’s contacts on the owner’s behalf: asking to borrow money, to vote in a contest, or to “transfer money to my card—mine’s been blocked.”

It's easy to check: call this person and speak to them. Don't message them in the same chat—it's not them anymore. A voice message isn't proof either: voices can be faked.

Figure 3. Fake Technical Support and Administration

A message saying, “Your account has violated the rules; please verify your information.” It includes a logo, the official name, and sometimes a blue checkmark. The goal is to trick you into revealing a code or password, or to get you to click on a link.

Support teams do not initiate messages on messaging apps asking you to urgently confirm your information.

Figure 4. Selling on a marketplace

A classic scam for anyone selling something: The “buyer” offers to arrange shipping and sends a link to “pay.” The page looks like a bank or a shipping service, but asks for your card information, including the CVV and a code from an SMS.

Key feature: You never need your CVV or an SMS code to receive money. The card number alone is sufficient for the transaction.

Figure 5. Work and Easy Money

“Like posts, 500 UAH a day.” The first payments actually come through—this builds trust. Then they ask you to “unlock your account” or “make a deposit to withdraw funds.” That’s where it all ends.

Figure 6. QR Codes

A sticker with a fake QR code placed over the real one on a parking meter, in a café, or on a poster. The code leads to a fake payment page.

See where the link leads: most browsers display the address before you click. If you see a shortened link or a string of characters instead of a familiar domain, don't click on it. We've written about how these links work on the page QR code generator.

Figure 7. Substituting Details in Business Correspondence

The most costly for companies. The attacker gains access to email or chat, waits for a discussion about payment, and sends “updated payment details.” The money is transferred to someone else’s account.

Security measure #1: Any change to your account information must be confirmed by voice call using the number you already know, not the one listed in the email.

How to Check a Link in 10 Seconds

• Check out the domain before the first slash. In privat24.secure-login.top a real domain — secure-login.top, not “privat24.”
• Check the letters: rn instead of m, Latin a There is an extra hyphen in the Cyrillic title.
• Shortened links in messages about money—a reason not to click on them at all.
• The padlock in the address bar simply indicates encryption. Scammers have one, too.
• Do not click on the link in the message—open the bank's app or website manually.

What to Do Right Now

1. Turn on two-step verification in the messaging app. In Telegram, go to “Settings → Privacy → Two-Step Verification”: even with the code from the SMS, no one can log in without your password. This is the main protection against account hijacking.
2. Check your active sessions — There's a list of devices in the settings. Remove any you don't recognize.
3. Hide your phone number in the privacy settings.
4. Turn on two-factor authentication in email and the banking app.
5. Set up a password manager — Using the same password across multiple services means that a breach on one exposes the rest.

If you've already ended up there

• Lost access to the messaging app: Log in from another device, end any active sessions under your name, and change your two-step verification password. Warn your contacts—someone is already sending messages in your name.
• The following card information was entered: Block your card immediately in the bank's app, then call the hotline.
• The money was transferred: Contact the bank immediately—sometimes they can stop the payment in time—and file a report with the police.
• Compromised work email: Change your password and check your forwarding settings—hackers often set up silent forwarding of emails to their own addresses.

For Business Owners

Agree on the rules with your team in advance: account details can only be changed after verbal confirmation; login credentials are not shared in chat rooms; and everyone has their own account. The same principles apply to the website— How to Protect a Website from Hacking.

In Brief

Verification code—don't give it to anyone. Urgency—a reason to stop and think. Domain—read from the end. Two-step verification—enable it today, not after your account has already been compromised.