Bitdefender has published new findings on a WhatsApp scam that is increasingly affecting users across Europe.
According to Bitdefender Labs, the scam is known as the ‘Vote for my child’ fraud and involves attackers taking over WhatsApp accounts to spread phishing links and later demand money from victims.
The scam typically starts when a WhatsApp user receives a message from someone they know-often a friend or family member-asking for their help to vote for a child in a contest.
The seemingly innocent request leverages personal trust, as the message appears to come from a legitimate contact. The text of the message may be similar to: “Hi! Please vote for Adeline in this contest, she’s the daughter of a close friend. The main prize is a scholarship abroad. Thank you so much!”
Bitdefender’s research details that the link in these messages leads to a phishing website, such as those with domains like poldance.top or thebestdance.top.
These websites are built to appear authentic, displaying photographs of children in dance or gymnastics poses, ‘vote’ buttons, and even fabricated contest statistics to convince the target the competition is real.
Takeover strategy
Victims are asked to enter their phone number followed by a six-digit WhatsApp verification code they receive, under the guise of casting a vote. Unbeknown to them, entering this information hands attackers control over their WhatsApp account.
Once the attacker has gained control, they send out the same messages to all the contacts in the compromised account. They may then escalate the situation by making urgent pleas for money, typically requesting 1,800 RON (approximately EUR €360) followed by an additional 2,000 RON (approx. EUR €400), claiming immediate need.
These repeated actions also risk location-based account suspensions due to spam reports.
Spread across Europe
Bitdefender Labs indicates that the campaign has grown quickly in recent months across Europe. The geographical distribution of the scam’s activity is led by Poland (41%), Romania (29%), and Germany (20%), with additional cases reported in the Czech Republic (2%), Italy (1%), and Austria (1%).
The scam’s reach has also appeared, though at lower rates, in other Western European countries, the United States, and Kazakhstan.
Bitdefender Labs has been monitoring a rapidly expanding campaign that exploits WhatsApp users through fraudulent ‘voting contests’ to take over accounts and steal money. This ‘Vote for My Child’ scam hijacks accounts by tricking users into sharing their verification codes, turning friends and family into unknowing amplifiers of the fraud.
Researchers have found that the simplicity and emotive nature of the scam-exploiting trust, urgency, and empathy-make even digitally savvy individuals vulnerable.
Bitdefender notes: “These scams are particularly dangerous because they are designed to bypass rational thinking. By combining familiarity (messages come from a known contact), urgency (act now, vote fast, send money immediately), and emotional triggers (helping a child, saving a friend in trouble), attackers manipulate victims into ignoring warning signs. Even digitally literate users can be fooled when trust and empathy override caution.”
Elderly most at risk
The report highlights that older adults are especially susceptible, as they commonly rely on personal connections and may have limited awareness of contemporary phishing methods.
Bitdefender advises steps to reduce risk to these groups: enable two-step verification on their WhatsApp accounts, explain common scams using simple language, and suggest that phone calls be used to confirm any unusual or urgent requests from contacts.
Bitdefender advises all users to never share their WhatsApp verification code and to verify money or favours requested through a direct phone call.
The company also recommends reporting suspicious messages within WhatsApp and contacting support services if access to an account is lost. In cases where money has already been transferred, Bitdefender recommends informing both the bank and personal contacts.
Growing trend
The company describes the tactic as part of a wider pattern of social engineering scams.
The ‘Vote for my child’ and urgent money request scams, while not new, are growing in prevalence throughout Europe and beyond. Bitdefender warns that, “The damage they inflict extends beyond financial loss – accounts are compromised, reputations are damaged, and trust is compromised.”
They advocate a proactive approach, emphasizing awareness and security measures: “The best defence is awareness, prevention, and layered security. By enabling two-step verification, educating loved ones, and using trusted cybersecurity solutions, families can stay a step ahead of fraudsters.”
The findings reinforce the continued importance of vigilance, the use of technology safeguards, and ongoing education for all ages to help prevent account takeovers and financial loss via social platforms like WhatsApp.