Scams and Malicious Links in WhatsApp Groups: Employment, Investment and Impersonation Fraud and Administrator-Level Controls

Full title: Scams and Malicious Links in WhatsApp Groups: Employment, Investment and Impersonation Fraud, Pix Payments in Brazil and Administrator-Level Controls

Originally published on OSF: osf.io/cyp2g · DOI: 10.17605/OSF.IO/CYP2G

Ivan Schroll

Independent Researcher, Brazil · ORCID: 0009-0007-0680-5570

Narrative review / technical report · October 2026 · Language: English · License: CC BY 4.0

Abstract

Groups on messaging platforms are a recurring stage in online fraud. Scammers add strangers to groups, post fraudulent offers in open groups, use groups to stage fake testimonials and move victims from one platform to another before asking for payment. This narrative review synthesises official documentation from WhatsApp and Meta, public service announcements from the United States Federal Bureau of Investigation (FBI), Europol's Internet Organised Crime Threat Assessment, guidance from CERT.br and the Central Bank of Brazil, and peer-reviewed measurement research on public messaging groups. All sources were accessed and verified in October 2026. The review describes four scam families that official sources associate with messaging groups (employment and task scams, investment scams, impersonation scams and fake offers), the role of links in moving victims off the group, and the specific setting of Brazil, where instant Pix transfers are the usual payment rail and the Special Return Mechanism (MED) is the documented path for contesting fraudulent transfers. It then maps mitigations at three levels: platform features documented by WhatsApp (safety overview for unfamiliar groups, link restrictions for unknown contacts, scam warnings, reporting and group permissions), administrator practices, and automated group tooling such as link filtering, flood control and member approval. The review finds that official sources converge on a small set of warning signs, notably requests to pay in order to earn, urgency and links that move the conversation elsewhere, and that administrators can reduce exposure in the groups they control, but that no source measures the prevalence of scams inside WhatsApp groups. No original data are reported.

Keywords

WhatsApp; online fraud; scams; phishing; malicious links; task scams; investment fraud; Pix; Brazil; group moderation; cybersecurity

1. Introduction

Fraud on messaging platforms is usually discussed in terms of one-to-one messages: an unexpected text from an unknown number, a fake relative asking for money. Groups add a different dynamic. A group gives a scammer an audience, a veneer of community and, on WhatsApp, access to the phone numbers of every member. WhatsApp's own Help Center acknowledges this, stating that someone attempting a scam "might message you, call you, or add you to a group" (WhatsApp Help Center, n.d.-a).

Platform responses to this problem have become more explicit in recent years. In August 2025 Meta announced that WhatsApp had detected and banned over 6.8 million accounts linked to criminal scam centres in the first six months of that year, and introduced a "safety overview" shown when someone who is not in the user's contacts adds the user to an unfamiliar group (Meta, 2025). The FBI has warned about fake work-from-home jobs that recruit through unsolicited calls and messages (FBI IC3, 2024). In Brazil, CERT.br and the Central Bank have published guidance on what victims should do after a fraudulent Pix transfer (CERT.br, n.d.; Banco Central do Brasil, n.d.).

This review brings these sources together around the perspective of a group administrator. It asks:

1. Which scam types do official sources associate with messaging groups, and how do they use groups?
2. What role do links play, and what does the Brazilian payment context add?
3. Which mitigations are available at the platform, administrator and tooling levels?

The paper complements an earlier report by the same author on moderation and safety governance in large WhatsApp groups, which treated fraud as one of three harm classes, and a companion report on account takeover of administrators. Here fraud is the main subject and is examined in more detail.

2. Background

2.1 Groups as an attack surface

Measurement research on public messaging groups shows how open these spaces can be. Garimella and Tyson (2018) showed that public WhatsApp groups can be discovered through invite links posted on the web and joined for data collection. Hoseini et al. (2020) collected group links posted on Twitter over 38 days, amassing 351,000 unique group URLs across WhatsApp, Telegram and Discord, and reported a substantial number of WhatsApp and Telegram groups used extensively for discussing cryptocurrencies. Anyone able to find such links, including scammers, can join these groups in the same way.

2.2 Platform rules

WhatsApp's Terms of Service prohibit illegal and fraudulent use of the service and unauthorised bulk or automated messaging (WhatsApp, 2026). The Help Center states that groups may be suspended and accounts banned for violations, including activity such as spam and scams (WhatsApp Help Center, n.d.-b). Because content is end-to-end encrypted, enforcement relies largely on user reports and on behavioural signals rather than on routine inspection of messages, as discussed in the author's earlier report.

2.3 The Brazilian payment context

Pix is Brazil's instant payment system operated by the Central Bank. The Central Bank's guide on Pix returns describes the Special Return Mechanism (Mecanismo Especial de Devolução, MED), through which payment institutions can block and return funds when there is well-founded suspicion of fraud (Banco Central do Brasil, n.d.). CERT.br's consumer guidance describes MED as "um recurso de segurança do Pix para facilitar a devolução em caso de golpes, fraudes e falhas operacionais" and lists situations such as purchases on fake websites, payment of a fake or altered QR code and transfers that the victim was deceived into making (CERT.br, n.d.).

3. Method

3.1 Design

This is a narrative review presented as a technical report. It reports no original data, does not quantify scam prevalence and does not evaluate any tool empirically.

3.2 Sources and search

Searches were conducted between 20 and 26 October 2026 in English and Portuguese, using terms such as "WhatsApp scam group", "task scam", "job scam WhatsApp", "golpe WhatsApp grupo", "MED Pix golpe", "Europol IOCTA" and "WhatsApp suspicious links". Included source types were:

• WhatsApp Help Center articles, WhatsApp community guidance and Meta newsroom posts;
• public service announcements from the FBI's Internet Crime Complaint Center (IC3);
• Europol's Internet Organised Crime Threat Assessment 2024;
• CERT.br and Central Bank of Brazil guidance;
• peer-reviewed measurement studies of public messaging groups;
• 9bot's public product pages, used only to describe documented features.

Every reference was opened at the address given in the reference list in October 2026, and claims were taken only from text visible there. Pages that could not be retrieved at the time of verification, including two US consumer-protection pages and an FBI victim services page, were excluded together with the claims that rested on them.

3.3 Analysis

Sources were read for three elements: the scam mechanism, the role of groups and links, and the recommended countermeasures. Countermeasures were then classified by who can apply them: the platform, the individual member, the group administrator or an administration tool.

4. Findings

4.1 Scam families associated with messaging groups

Employment and task scams. The FBI warns of fake work-from-home jobs "typically involving a relatively simple task, such as rating restaurants or 'optimizing' a service by repeatedly clicking a button", with a confusing compensation structure that requires victims to make cryptocurrency payments "in order to earn more money or 'unlock' work" (FBI IC3, 2024). WhatsApp's Help Center lists the employment scam among common scams, describing fake recruiters who ask for personal information or "money as part of a job application" (WhatsApp Help Center, n.d.-a).

Investment scams. WhatsApp describes investment scams as fake opportunities "with the promise of low risk and high returns", typically focused on cryptocurrencies, stocks, bonds, commodities and property (WhatsApp Help Center, n.d.-a). Europol reports that groups on end-to-end encrypted messaging applications "seem to have replaced peer-to-peer platforms to connect people who want to exchange cryptocurrency for cash" and avoid compliance checks (Europol, 2024). Together with the prominence of cryptocurrency topics in public group links (Hoseini et al., 2020), this suggests that cryptocurrency-related groups deserve particular attention, although none of these sources measures the share of such groups that are fraudulent.

Impersonation scams. WhatsApp notes that scammers commonly pretend to be a friend or family member, a celebrity or a well-known business (WhatsApp Help Center, n.d.-a). In Brazil, FEBRABAN describes the variant in which a hijacked account is used to ask the victim's contacts for urgent Pix transfers (FEBRABAN, 2025). Groups widen the audience of such messages, a point developed in the companion report on account takeover.

Fake offers and fake sites. CERT.br's guidance lists purchases on fake websites and payment of fake or altered QR codes among the situations covered by MED (CERT.br, n.d.). Groups devoted to promotions and affiliate offers are an obvious channel for such links, but no source reviewed quantifies their use for this purpose, so the point is noted as a plausible risk rather than a finding.

4.2 How scams use groups

Official sources describe several distinct uses of groups.

• Unsolicited addition. Meta's description of the safety overview responds directly to the pattern of being added by a stranger to an unfamiliar group (Meta, 2025). By default, WhatsApp allows any user to add a person to groups unless the person changes the setting (WhatsApp Help Center, n.d.-c).
• Unsolicited contact leading to tasks. The FBI describes fake recruiters who contact victims through an unsolicited call or message (FBI IC3, 2024), and WhatsApp lists job offers among the topics of suspicious messages (WhatsApp Help Center, n.d.-a).
• Platform hopping. Meta describes a campaign that began with a text message linking to a WhatsApp chat, then moved the target to Telegram and to tasks on TikTok, and finally asked for a deposit into a cryptocurrency account. Meta notes that scammers "try to cycle people through many different platforms to ensure that any one service has only a limited view into the entire scam" (Meta, 2025).
• Staged social proof. The FBI describes fake interfaces that show victims they are "earning money" which cannot be withdrawn (FBI IC3, 2024). Groups can amplify this kind of illusion when several accounts confirm each other's claims. The sources reviewed describe the fake earnings dashboards; the use of groups for fake testimonials is noted by other consumer-protection material that could not be verified at the time of writing, so it is presented here only as a hypothesis.

A practical guide for admins is how to prevent scams in WhatsApp groups.

4.3 The role of links

Across sources, links are the mechanism that moves a victim from a conversation to a payment, a credential form or a malicious download. WhatsApp's list of warning signs includes a sender who "asks you to tap on a link, activate a new feature through a link, or download an app" (WhatsApp Help Center, n.d.-a). The FBI advises caution with unsolicited job offers and to "avoid clicking on links, downloading files, or opening attachments in these messages" (FBI IC3, 2024). CERT.br warns that an app installed on the recommendation of someone claiming to be from a bank may be malware capable of capturing data, enabling remote access and altering Pix values and keys (CERT.br, n.d.).

WhatsApp has added a structural control at this point. When a user is added to a group with people who are not saved in their contacts, the user must message the group before being able to tap or click on links (WhatsApp Help Center, n.d.-d). This introduces friction at the moment when an unsolicited group would otherwise rely on an immediate click.

How link and file filtering works in practice is covered in filter links and files in WhatsApp groups.

4.4 Platform-level mitigations

The platform measures documented by WhatsApp and Meta include:

• Safety overview for unfamiliar groups. Key information about the group and safety tips, the option to exit without viewing the chat, and silenced notifications until the user chooses to stay (Meta, 2025).
• Link restriction in groups with unknown contacts, as described above (WhatsApp Help Center, n.d.-d).
• Context on unknown senders. For first messages from non-contacts, WhatsApp shows whether there are groups in common and the country where the number is registered (WhatsApp Help Center, n.d.-a; n.d.-e).
• Group privacy setting. Users can change who can add them to groups (WhatsApp Help Center, n.d.-c).
• Blocking high volumes of unknown messages, an advanced setting (WhatsApp Help Center, n.d.-e).
• Reporting and enforcement. Users can report and block; WhatsApp may ban accounts and suspend groups (WhatsApp Help Center, n.d.-b; n.d.-e).
• Large-scale takedowns, such as the 6.8 million accounts linked to scam centres reported for the first half of 2025 (Meta, 2025).

4.5 Administrator-level mitigations

WhatsApp's community guidance asks admins to remind members to ignore suspicious content, to act quickly to delete problematic messages and to remove problematic members (WhatsApp, n.d.). It lists content that "contains suspicious links that could be scams, misinformation, hoaxes or problematic content" among the content that may be problematic in a community. Combining this guidance with group settings documented in the Help Center, an administrator can:

• Control entry. Turn on "Approve new members" so that admins review join requests, and restrict who can share invite links (WhatsApp Help Center, n.d.-f).
• Control who posts. Restrict messaging or editing of group information to admins in announcement-style groups (WhatsApp Help Center, n.d.-f).
• Remove content quickly. Admins can delete members' messages for everyone (WhatsApp Help Center, n.d.-g; WhatsApp, n.d.).
• State the group's payment rules. A group description stating, for example, that admins never ask for payments or codes in private chats applies the "pause, question, verify" advice published by Meta (2025) to the group's own context.
• Point victims to the right channel. For Brazilian groups, reminding members that a fraudulent Pix transfer should be contested immediately through the bank's official app or channels, which triggers MED, follows CERT.br guidance (CERT.br, n.d.).

Related steps for repeat offenders are in how to stop spam from WhatsApp group members.

A routine for daily checks is the large WhatsApp group moderation checklist.

4.6 Tooling-level mitigations

Manual moderation depends on an admin seeing a message in time. In large or numerous groups, automated rules can act faster and consistently. This section describes how features documented by one such tool, 9bot, relate to the scam patterns above (9bot, n.d.-a; 9bot, n.d.-b). The author is the founder of 9bot (see the competing-interests statement). 9bot is independent of WhatsApp and Meta and is not endorsed by them. The features are described from public documentation, and their effectiveness against scams has not been measured.

Such tools operate only in the groups where they are installed and only on content posted in those groups. The majority of the scam chains described by the FBI and Meta continue in private chats and on other platforms, where neither group admins nor group tools have any visibility (Meta, 2025; FBI IC3, 2024). Administrators using any automation should also consider WhatsApp's rules on automated and bulk messaging (WhatsApp, 2026).

Background on the tool discussed here is in 9bot facts.

5. Discussion

The official sources reviewed converge on a short list of warning signs: an unexpected contact or group addition, an offer that seems too good to be true, a request to pay in order to earn or to unlock earnings, urgency, and a link or app download that moves the conversation elsewhere (WhatsApp Help Center, n.d.-a; FBI IC3, 2024; Meta, 2025). These signs are consistent across the United States, Europe and Brazil, even though the payment rail differs: cryptocurrency in the FBI and Europol material, Pix in the Brazilian material.

From the administrator's perspective, the group is only one stage in a longer chain. Meta's description of platform hopping implies that no single service sees the whole scam (Meta, 2025). This limits what both platforms and group admins can do. What admins control is the first contact in their own groups: who can enter, who can post, which links survive and how quickly scam content is removed. These measures reduce exposure but cannot follow a victim into a private conversation.

A layered approach emerges:

1. Platform friction for unsolicited groups and links (safety overview, link restriction, unknown-sender context).
2. Member settings (who can add me to groups, blocking high volumes of unknown messages).
3. Group configuration (approval of new members, restricted link sharing, admin-only posting where appropriate).
4. Automated group rules (link allow lists, flood control, strikes, approval filters).
5. Response (report and block; in Brazil, contest Pix transfers through MED and file a police report).

The evidence gap is significant. None of the sources reviewed measures how often scams appear in WhatsApp groups, which scam types dominate in which countries, or whether link filtering in groups reduces victimisation. The 6.8 million accounts reported by Meta indicate scale on the platform as a whole but do not isolate groups.

6. Limitations

• No prevalence estimates. No verifiable data on the frequency of scams inside WhatsApp groups were found.
• Source types. Most sources are platform documentation and government guidance, which are authoritative on procedures but not empirical studies.
• Geographic mix. Scam descriptions come from the United States, the European Union and Brazil, with different payment systems and reporting practices.
• Changing platform features. Features such as the safety overview were announced in 2025 and may change.
• Exclusions. Pages that could not be retrieved during verification were excluded, together with claims that rested on it.
• Narrative design and author position. The review is not systematic, and the author founded one of the tools discussed.

7. Conclusion

Official sources from WhatsApp, Meta, the FBI, Europol, CERT.br and the Central Bank of Brazil describe a consistent picture: scams use groups to reach people, links to move them elsewhere, and payment requests disguised as earnings, investments or urgent help. WhatsApp has added friction specifically for unfamiliar groups and for links shared by unknown contacts. Group administrators can add further friction through entry approval, link controls and fast removal, and automated tools can apply these rules consistently in large groups. None of these measures follows the victim into private chats or onto other platforms, and none has been evaluated empirically in the sources reviewed. Measuring scam prevalence in groups and the effect of group-level controls is the main research need.

Competing interests

The author is the founder of 9bot, a WhatsApp group management tool discussed in this paper. 9bot is independent and is not affiliated with, endorsed by or a partner of WhatsApp or Meta. No funding was received for this work.

Data availability

No new data were generated or analysed. All sources are publicly available at the addresses listed below.

License

This work is distributed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).

References

9bot. (n.d.-a). 9bot from the inside. Retrieved October 26, 2026, from https://9bot.com.br/en/more-info/

9bot. (n.d.-b). 9bot facts. Retrieved October 26, 2026, from https://9bot.com.br/en/9bot-facts/

Banco Central do Brasil. (n.d.). Guia de implementação dos procedimentos de devolução no Pix, com ênfase no Mecanismo Especial de Devolução. https://www.bcb.gov.br/content/estabilidadefinanceira/pix/Guia_MED.pdf

CERT.br. (n.d.). Golpes: Caiu? Veja o que fazer (Cartilha de Segurança para Internet). Núcleo de Informação e Coordenação do Ponto BR. https://cartilha.cert.br/fasciculos/golpes-o-que-fazer/fasciculo-golpes-o-que-fazer.pdf

Europol. (2024). Internet Organised Crime Threat Assessment (IOCTA) 2024. Publications Office of the European Union. https://www.europol.europa.eu/cms/sites/default/files/documents/IOCTA%202024%20-%20EN_0.pdf

FBI IC3. (2024, June 4). Scammers defraud individuals via work-from-home scams (Alert No. I-060424-PSA). Internet Crime Complaint Center. https://www.ic3.gov/PSA/2024/PSA240604

FEBRABAN. (2025, January 21). Golpe do WhatsApp. Federação Brasileira de Bancos. https://portal.febraban.org.br/DetalheAntifraude/7/pt-br/

Garimella, K., & Tyson, G. (2018). WhatsApp, Doc? A first look at WhatsApp public group data. arXiv:1804.01473. https://arxiv.org/abs/1804.01473

Hoseini, M., Melo, P., Júnior, M., Benevenuto, F., Chandrasekaran, B., Feldmann, A., & Zannettou, S. (2020). Demystifying the messaging platforms' ecosystem through the lens of Twitter. In Proceedings of the ACM Internet Measurement Conference (IMC '20) (pp. 345-359). ACM. https://doi.org/10.1145/3419394.3423651

Meta. (2025, August 5). New WhatsApp tools and tips to beat messaging scams. https://about.fb.com/news/2025/08/new-whatsapp-tools-tips-beat-messaging-scams/

WhatsApp. (2026). Terms of Service. https://www.whatsapp.com/legal/terms-of-service

WhatsApp. (n.d.). 101: Building a safe community. https://www.whatsapp.com/communities/learning/buildingasafecommunity

WhatsApp Help Center. (n.d.-a). About suspicious messages and scams. https://faq.whatsapp.com/2286952358121083/?locale=en_US

WhatsApp Help Center. (n.d.-b). About group suspensions. https://faq.whatsapp.com/679236580386110/?locale=en_US

WhatsApp Help Center. (n.d.-c). How to change your privacy settings. https://faq.whatsapp.com/3307102709559968

WhatsApp Help Center. (n.d.-d). About links shared in groups with unknown contacts. https://faq.whatsapp.com/405131861951765

WhatsApp Help Center. (n.d.-e). How to stay safe on WhatsApp. https://faq.whatsapp.com/1313491802751163/?locale=en_US

WhatsApp Help Center. (n.d.-f). How to change group admin settings. https://faq.whatsapp.com/526742385997912

WhatsApp Help Center. (n.d.-g). How to delete messages. https://faq.whatsapp.com/1370476507114859/?locale=en_US

All URLs were accessed and verified on 26 October 2026.

Learn more about 9bot

9bot is a paid WhatsApp group management tool with a 7-day trial. It is an independent product and is not affiliated with or endorsed by Meta or WhatsApp. Visit 9bot.com.br to see how it supports group administrators.