"Hi Mum, my phone is broken, this is my new number." "Could you send me some money? I will pay you back tomorrow." Messages like these reach thousands of people every day. When the sender uses your name and your photo, the people who fall for it are your friends and family. And you find out when someone rings to ask whether the money has arrived.
How the scam works
There are two main versions:
- A cloned profile on Facebook or Instagram: they copy your photo and name, create a new account and send friend requests to your contacts. Once accepted, they ask for money, a verification code or bank details with an urgent excuse.
- A "new number" on WhatsApp: they write from an unknown number with your profile photo and claim to be you with a new phone. It is often aimed at parents and grandparents, including relatives back home if you live in Spain.
In both cases the scammer plays on urgency and trust. They do not need to have broken into your account: your photo and knowing who your contacts are is enough, and that is often visible on your social media.
Step 1: warn everyone
The most urgent thing is to stop the scam. Post on your real account and in family and friends groups: "Someone is impersonating me and asking for money. It is not me. Do not pay or share any code." Ask your contacts to phone you before acting on any unusual request, even if it comes with your photo.
Step 2: report the profile or number
- On Facebook: go to the fake profile, tap the three dots, choose "Find support or report profile" and the option saying it is pretending to be someone else. If you do not have an account, Facebook has a form for reporting impersonation.
- On WhatsApp: open the chat with the number, tap the contact's name and choose "Report". Ask anyone who has received messages to report and block it too.
Step 3: keep evidence
Before the profile disappears, take screenshots of the account, the number and the conversations, with the date and time. If someone has paid, keep the receipt of the bank transfer or the Bizum payment (Spain's instant mobile payment system), with the recipient's account or phone number. That information is extremely valuable for any investigation.
If someone has already paid
They should call their bank as soon as possible. The sooner the bank is told, the better the chances of trying to stop the payment, although that is not always possible. Then they should report it to the police with all the receipts.
Step 4: report it to the police
Asking for money while pretending to be someone else may amount to fraud under Spanish law (Article 248 of the Criminal Code). The report should be made by the person who lost the money, but you can also report the impersonation yourself. You can do it at the Policía Nacional, the Guardia Civil or the regional police where they cover your area. Provide the screenshots, the profile URLs, the phone numbers and the receipts. If the person who paid lives in another country, they should also report it to the police there.
If you are unsure how to proceed, the 017 helpline run by INCIBE, Spain's national cybersecurity institute, answers questions about fraud and cybersecurity free of charge and in confidence.
Step 5: protect your accounts
Even though in most cases your account has not been stolen, check:
- That two-step verification is turned on for WhatsApp, Facebook and Instagram.
- That you have never shared a six-digit verification code.
- What information you have public: visible friends list, family photos, phone number.
Reducing what can be seen on your profile does not completely stop you being cloned, but it does make it harder.
What to tell older relatives
Older people are the most common victims of the "new number" scam. Talk to them before it happens and agree on a simple rule: if they get a request for money by message, even if it looks like it is from you, they call you on your usual number before doing anything. You could even agree on a family code word that only you know.
If the profile comes back
Sometimes a profile is closed and another one appears a few days later. If this happens, report it again, keep evidence of each profile and mention it in your police report: repetition shows intent.
If you are being impersonated repeatedly or the fake profile will not come down, we analyse your case for free and tell you which routes are available. The final decision lies with each platform, and we give you a fixed quote before we start. More information on removing content from Facebook (in Spanish) and on our service to remove content from social media. We work in English, remotely, wherever you are.
