Article

WhatsApp scams at work in Nigeria: 6 to stop and check

By Cyberwareness Team · October 1, 2026 · Updated October 14, 2026 · 4 min read

A man smiling at his phone while holding a coffee at his workplace

Get a free phishing test for up to 25 of your staff We run a safe, fictional phishing test and show you who clicked and what to fix. It takes a short form. Request the free test →

WhatsApp is how many Nigerian offices talk every day. That is exactly why scammers like it. A message from “the MD” or from a friend feels normal, so people act fast.

Here are six WhatsApp scams at work to stop and check, and one simple routine.

Never share the 6-digit code WhatsApp sends you by SMS. It lets someone log in to your account.

Scammers try to get you to read that code back. They may say they sent it by mistake, or that it is for a “prize” or a “security update”.

Cyber agencies give the same advice. Ghana’s Cyber Security Authority says to treat the verification code like a password and share it with no one. It says scammers pose as group admins or trusted contacts, and that once you share the code they can take over your account and message your contacts as you.

What are the common WhatsApp scams that reach staff?

Six come up again and again.

Six WhatsApp scams that reach staff: please send me the code, the boss needs gift cards or airtime, change of account number, quick loan or emergency, join this group for a job, and your account will be closed

“Please send me the code.” A contact (whose account was hijacked) says they sent a code to your number by mistake. It is your own WhatsApp code.
“The boss needs gift cards or airtime now.” A new number uses your manager’s photo and asks you to buy cards and send the codes.
“Change of account number.” A “supplier” says to pay a new account from today.
“Quick loan or emergency.” A friend or relative asks for money to be sent now.
“Join this group for a job.” The link leads to a fake form that asks for your BVN, NIN or bank PIN.
“Your account will be closed.” A message says to click a link to keep your account.

Each one has the same shape: someone you trust, a hurry, and a request that skips the normal steps.

A person reading a message on a smartphone in an office

How do you check a WhatsApp request in 60 seconds?

Stop, look, call, ask, tell. It takes about a minute and saves months of pain.

The 60-second WhatsApp check: stop, look, call on a number you already have, ask something only the real person knows, and tell IT or your manager

Stop. Do not reply to a money or code request right away.
Look. Is it a new number? Does the message push you to hurry?
Call. Phone the person on a number you already have. Do not use the same chat.
Ask. Ask something only the real person would know.
Tell. Send a screenshot to IT or your manager.

How do you make your WhatsApp account harder to steal?

Turn on two-step verification and watch your linked devices. The Ghana CSA also recommends two-step verification (Settings, Account) and keeping the six-digit PIN private.

Turn on two-step verification (Settings, Account, Two-step verification).
Do not log in on a phone someone else owns.
Check Linked Devices now and then, and log out any you do not know.
Keep work messages about money on email or your finance tool, with a call to confirm.

What should you do if your WhatsApp is hijacked?

Act fast and tell people by another channel.

Warn your contacts by phone call, SMS or email, so they do not send money.
Try to sign back in with your phone number and your PIN.
Use WhatsApp’s help page for lost or stolen accounts.
Tell your manager or IT. If work data or contacts were exposed, see what staff do in the first 72 hours of a breach.
If you shared a BVN, card or OTP detail, call your bank on its official number at once.

What should the office rule say?

Put this one line in your staff WhatsApp group: “No payment, airtime, gift cards or code sharing on WhatsApp. We confirm by phone call first.” Then say it again at each team meeting.

Add a second rule for finance: “A change of bank account needs a call to a known number and a second person.” That is the same fix that beats business email compromise.

Train the habit

A rule on a wall is not enough. Staff need to practise stopping under pressure. Our phishing simulation program includes a WhatsApp-style family-emergency scenario. Today every simulation is delivered by email, so it is an email written around that pattern. Not sure where your team stands? Request a free phishing risk test or book a free demo.

Questions people ask

Why do scammers ask for the WhatsApp verification code?

The code lets them log in to your WhatsApp on their phone. Once they are in, they message your contacts as you. Ghana's Cyber Security Authority says to treat the code like a password.

How do I turn on two-step verification in WhatsApp?

In WhatsApp go to Settings, then Account, then Two-step verification, and create a 6-digit PIN. Check WhatsApp's own help centre for the current steps on your phone.

What if my boss messages me on WhatsApp for urgent money?

Do not send anything. Call your boss on a number you already have, or ask in person. Do not use the same chat to check, because the account may be taken over.

What should I do if my WhatsApp was hijacked?

Warn your contacts by another channel, try to sign back in with your phone number and PIN, use WhatsApp's help page for stolen accounts, and tell your manager.

How can a company stop WhatsApp scams?

Set a one-line office rule, train staff on the common scams, and give one place to report. Practise with safe test messages.