A routine response may give scammers the opening they need.
MADRID, SPAIN — July 2026.
Answering a call from an unknown number may seem harmless, especially when someone is expecting information from a bank, delivery company or public institution. Cybersecurity specialists warn, however, that criminals increasingly use telephone conversations to obtain voice recordings, personal information and access credentials. Two responses require particular caution: an affirmative “yes” and any WhatsApp verification code received by text message. Neither should be shared impulsively during an unexpected call.
The danger surrounding the word “yes” begins with the natural way many people answer the telephone. A caller may ask whether they are speaking with a specific person, whether the sound is clear or whether the recipient recognizes a particular service. The questions are designed to generate a brief affirmative response that can be recorded. That audio may later be manipulated or presented as supposed evidence of consent.
Fraudsters may impersonate banks, telecommunications companies, delivery services or government agencies to make the conversation appear legitimate. They sometimes mention a person’s name, address or other information obtained from social networks and previous data leaks. These details create familiarity and reduce the victim’s initial suspicion. Once trust is established, the caller begins requesting confirmations or sensitive information.
A recording of someone saying “yes” should not normally be sufficient to authorize a legitimate financial transaction by itself. Responsible institutions use additional authentication measures, contractual records and identity controls before approving significant operations. The risk increases when weak verification systems, manipulated recordings or complementary stolen information are involved. Victims should therefore avoid assuming that a single word is harmless simply because it cannot independently complete every fraud.
A safer response is to avoid affirmative answers when the identity of the caller has not been verified. Instead of saying “yes,” the recipient can respond with phrases such as “Who is calling?” or “Please explain the reason for the call.” The person should not confirm their full name, address, account provider or other identifying information until the caller’s legitimacy is established. When doubt remains, ending the conversation is safer than continuing under pressure.
The second major threat involves the six-digit code used to register a WhatsApp account on a new device. WhatsApp sends this verification code when someone attempts to activate a telephone number through its platform. A criminal who already knows the victim’s number may initiate that process and then call or message the victim requesting the code. Sharing it can allow the attacker to complete the registration and take control of the account.
Scammers frequently invent urgent explanations to obtain the code. They may claim that it was sent by mistake, that they work for technical support or that the account requires immediate verification to avoid suspension. Some impersonate a friend or relative whose own WhatsApp account has already been compromised. The urgency is artificial and designed to prevent the victim from pausing to examine what is happening.
WhatsApp verification codes must never be shared with another person, including someone claiming to represent the platform. Legitimate support personnel do not need users to dictate these codes over a telephone call or private message. Enabling two-step verification adds a personal identification number that provides another barrier against account takeover. Users should also register a recovery email and review the devices connected to their account.
A stolen WhatsApp account can become a tool for broader fraud. Attackers may read available conversations, impersonate the victim and request money from family members, friends or professional contacts. They can also use the compromised account to obtain more personal information or spread malicious links. The reputational and financial consequences may therefore extend beyond the original account holder.
Caller identification should not be treated as definitive proof of legitimacy. Telephone spoofing allows criminals to manipulate the number displayed on the recipient’s screen so that a call appears to come from a trusted company or institution. When a caller requests confidential information, the safest procedure is to hang up and contact the organization through its official application, website or published customer-service number. Returning the call to the number displayed on the screen may reconnect the victim with the fraudster.
People who suspect that they have been deceived should act immediately. They should contact the relevant bank or service provider, review recent transactions and change passwords associated with affected accounts. WhatsApp users who have lost access should begin the account-recovery process and warn contacts not to respond to unusual requests. Screenshots, call records and messages should be preserved in case a formal report becomes necessary.
Telephone fraud succeeds because it exploits routine behavior rather than complex technical failures. A familiar question, a convincing voice and a sense of urgency can cause people to respond before evaluating the risk. The most effective defense is to slow the conversation, refuse to share credentials and independently verify the caller’s identity. In an unexpected call, silence and caution can protect far more than politeness.
Phoenix24 — Global news with clarity and perspective.