"Hi Mum, I've got a new number": what to do if your "child" asks for money on WhatsApp

"Hi Mum, I've changed my number, save this one and delete the old one." Or "Hi Dad, my phone broke, I'm messaging from a borrowed one." It arrives on WhatsApp from a number that isn't in your contacts and, a little later, the urgency appears: something has to be paid today and "your child" can't do it from their bank. If you have this message open right now, stop for a moment: this is one of the most widespread scams in Spain and across Europe, and a single call to the usual number takes it apart. Here's what to do, step by step.

How exactly does this scam work?

The scammer doesn't know who you are. They send the same generic greeting to thousands of numbers and wait for someone to reply. From there they follow an almost identical script in every wave:

1. The vague greeting. "Hi Mum" or "Hi Dad", with no name. If you reply "Is that you, Lucy?", you've just handed over the name they needed.
2. The new-number excuse. Broken phone, dropped in water, stolen, or "they changed my SIM". It explains why they're writing from an unknown number.
3. The excuse not to talk. "I can't call, the mic isn't working", "I'm in class", "my battery's dying". The scammer can't imitate your child's voice, so they avoid any call.
4. A few trust-building messages. Small talk, emojis, "how are you?". Nothing is requested yet.
5. The money emergency. A bill due today, rent, a purchase that will be cancelled, a fine. Since they "don't have the banking app on the new phone yet", they ask you to pay instead.
6. A third party's account. The money has to go by bank transfer or Bizum (Spain's instant phone-to-phone payment system; elsewhere, any instant payment app) to someone else: "a friend", "the landlord", "the shop". If you pay, a second request usually follows.

There's a more dangerous variant: the message arrives from your child's real number because their WhatsApp account has been stolen (usually by tricking them into sharing the six-digit code WhatsApp sends by SMS). In that case the chat is the usual one, but the protocol below still works: a voice call exposes it.

What are the red flags in the message?

None of them proves anything on its own, but if you see two or more together, treat it as a scam until proven otherwise:

• Unknown number and an empty or generic profile picture.
• No trace of your child's name, family nicknames or recent details only they would know.
• Consistent refusal to talk by voice or to send a voice note.
• Pressure: "it's for today", "if I don't pay now I'll lose it".
• The person receiving the money isn't your child, but someone else or a company.
• A request for secrecy: "don't tell Dad, he'll be cross".
• Expressions or a writing style that don't match how they normally message you.

What do I do right now if I've received one?

1. Don't pay and don't reply with personal details. Don't give names, don't confirm anything, and never send any code that arrives by SMS.
2. Call your son's or daughter's usual number, the one saved in your contacts, not the new number. In the vast majority of cases they'll answer calmly and the scam ends there.
3. If they don't answer, check another way: their partner, a sibling, a flatmate or a colleague. No payment is so urgent that it can't wait ten minutes.
4. Ask the new number for a voice note or a video call. A real child will do it without a fuss; the scammer will make excuses.
5. Ask a control question that can't be found on social media: what your first pet was called, what you had for dinner at the last family get-together.
6. Save evidence before blocking: screenshots of the whole chat, the number, and the account or payment details they asked for.
7. Block and report the number in WhatsApp (open the chat, tap the name or number and choose "Report"). That way WhatsApp receives the latest messages and can close the account.

What if I've already made the transfer or the Bizum payment?

Don't blame yourself: this trick is designed by professionals to get past caution. What matters now is speed:

1. Call your bank immediately on its official number (the one on the back of your card or in its app). Explain that it's a scam and ask them to try to stop or reverse the payment. With instant payments the window is short, so every minute counts. There's more detail in how to recover money lost to a phone scam.
2. Don't make any more payments, even if the supposed child insists that "only a little more" is needed.
3. Report it to the police. In Spain, to the Policía Nacional (091) or the Guardia Civil (062), at a station, with the screenshots and the payment receipt; elsewhere, to your national police. A police report is usually needed for any later claim with the bank.
4. Get guidance. In Spain, call 017, INCIBE's free and confidential cybersecurity helpline; its citizens' site, the OSI (Oficina de Seguridad del Internauta), publishes alerts about this and other campaigns. Elsewhere, contact your national cybersecurity agency or consumer fraud helpline.
5. If your own WhatsApp account has been stolen because you shared a code, register your number in the app again, turn on two-step verification (Settings Account Two-step verification) and warn your contacts.

If at any point there's a real threat or an emergency in progress, call 112 (the emergency number in Spain and across the EU) or your local emergency number.

How do I protect my family for next time?

The best defence is for parents and grandparents to know the script before they receive it. Tell them in these words: "If someone claiming to be me messages you from another number and asks for money, call me on my usual number before you pay anything." A few simple measures:

• Agree a family rule: nobody asks for money in writing only; any request is confirmed with a call.
• Agree a code word for real emergencies.
• Turn on WhatsApp two-step verification on everyone's phones and remember that the six-digit code is never shared with anyone, ever.
• Check the privacy of your profile picture so strangers can't see it.

A call and message identification app like NoCall can help you see whether a number has already been flagged by other users, but the verification call to the usual number is what really shuts the door. If you want to go deeper, we also look at this scam in "Mum, I've lost my phone": the child-in-trouble scam.

Frequently asked questions

The message says "Mum" and I don't have children. Why did I get it? Because it's sent in bulk to random numbers or numbers taken from data leaks. You weren't chosen: you just ended up on the list.

What if my child really has changed number? Then they'll have no problem calling you or sending a voice note. A genuine number change never comes with an urgent need for you to pay a third party.

The message comes from my child's usual number. Can it still be a scam? Yes, if their WhatsApp account has been stolen. Phone them, don't use the chat: if the account has been taken over, they won't know anything about the message.

Is it worth reporting if I didn't lose any money? Yes. Reporting the number in WhatsApp and warning the people around you helps cut the campaign short. If you received it without paying, report it anyway in the spam number directory.

In summary

New number, an excuse not to talk, urgency and a third party's account: that's the whole script. The answer is always the same too: don't pay, call the usual number and check another way. If you've already paid, call your bank, report it to the police and ask for help (017 in Spain). And if you've received the message, report it in the NoCall spam number directory: your warning could stop another mother or father from paying.