The "Hi Mum" WhatsApp Scam: Britain's Costliest Family Con

"Hi Mum, I've smashed my phone. This is my new number, please save it." From an unknown number, over WhatsApp or plain text, begins one of Britain's cruellest and costliest scams: the stranded-child con. There is no malware and no clever hacking. Just a stranger pretending to be your son or daughter, and an urgent money request that lands once you already believe you are talking to family.

It is worth understanding properly, because the script is always the same — and once you know it, it is almost impossible to fall for.

How the "hi mum" scam works

The scammer sends the same opening message to thousands of random numbers. They do not know whether you have children, what their names are, or anything about you. That is why the first message is deliberately vague: "Hi Mum" or "Hi Dad", with no name. If you reply "Sophie, is that you?", you have just handed over the name. From there, "Sophie" writes back with total confidence.

The conversation follows a well-rehearsed pattern:

1. The new-number excuse. "I dropped my phone" or "it was stolen, this is a temporary one." It explains why they are writing from an unknown number — and why they cannot call you or send voice notes ("the mic doesn't work", "hardly any battery").
2. A few warm-up messages. They ask how you are, drop something generic, use emojis. They ask for nothing yet. The goal is to get you relaxed and assuming this is your child.
3. The emergency. The problem arrives: a bill must be paid today (rent, a deposit, a purchase that "falls through if I don't pay now") but they cannot access their banking because the app was on the smashed phone and recovery takes days.
4. The ask. They want you to send the money — usually a bank transfer, sometimes PayPal or a payment app — "and I'll pay you straight back once I'm back in my banking." The amount is believable: a few hundred pounds. And here is the key detail: the destination account is not in your child's name, but in a "mate's" or the supposed company's. If you pay, a second request almost always follows.

Why it works so well

Because it does not attack your intelligence — it attacks your emotions. The mix is powerful:

• Emotion. It is your child in trouble. The instinct to help fires before analysis does.
• Urgency. Everything must be solved now. The rush is engineered so you never stop to think or verify.
• Plausibility. Smashing a phone, losing banking-app access, asking parents for a quick favour — none of this is strange. They are not asking for anything absurd; they are asking for something a real child might ask.

Messaging also plays in the scammer's favour: we are used to treating a written message as "being" the person. And if they previously hijacked your child's real WhatsApp account, the message can even arrive in the usual chat. The defence, as you will see, is the same in both cases.

Concrete warning signs

No single sign proves anything on its own, but two or more together should set off every alarm:

Pay special attention to the refusal of voice. It is the constant of this scam: text is easy to fake; a real-time conversation with your child is not.

The check that never fails

Faced with any message like this, before moving a single pound, do one thing: ring your son's or daughter's usual number. The lifelong one, the one saved in your contacts. In most real cases your child answers from their usual number, completely unaware of everything, and the scam collapses in ten seconds.

If they do not answer, you have more options — all better than paying:

• Ask for a voice note to the new number: "send me a voice note and I'll make the transfer." The scammer will make excuses; a real child sends it without thinking.
• Ask a control question only your family could answer: the first pet's name, where you holidayed last year, what you call your child at home. Nothing guessable from social media.
• Verify another way: message the old number, contact their partner, a sibling, a flatmate.

The underlying rule is the same as with bank-impersonation fraud: the valid verification is the one you start, over a channel you control. An unknown number writing to you and rushing you is not a trustworthy channel, no matter how many "mum"s it uses.

What to do if you already paid

Act fast, in this order:

• Call your bank immediately on the official number (the one on the back of your card). Explain you are a scam victim and ask them to try to hold or recall the payment. Under the UK reimbursement rules for authorised-push-payment fraud, reporting quickly matters enormously.
• Save all the evidence: screenshots of the full conversation, the number that wrote to you, the payment confirmation, the destination account.
• Report it to Action Fraud, the UK's national fraud reporting centre, with those screenshots — and to the police on 101 if you need a crime reference for the bank.
• Forward the scam text to 7726 so your network — EE, O2, Vodafone, or Three — can flag the number, and report the number publicly so the next parent who receives the message finds a warning.

Protect your family in advance

This scam aims mostly at parents of adult children living away from home. The best vaccine is telling them the script before it arrives: explain the pattern ("hi mum, smashed phone, new number, urgent transfer") and agree on a simple family rule: nobody in this family asks for money in writing; anyone who does gets a call to their usual number before anyone pays. You can even agree on a family code word for real emergencies.

The bottom line

The scammer knows nothing about you: you supply the name, the trust, and the money. Their only tool is a script mixing emotion, urgency, and a plausible story. Your only necessary defence costs one phone call: to the usual number, before paying anything. No voice, no transfer.