Impersonation fraud on WhatsApp and other messaging apps remains one of the most common forms of online fraud in Europe. The pattern is familiar: a message from an unknown number, claiming to be a son, daughter, or colleague with a broken phone, followed shortly by an urgent payment request. Variants target businesses, where fraudsters pose as a director or supplier and request an urgent transfer or changed bank details.
The three main variants
Family emergency fraud. “Hi mom, this is my new number, my phone broke.” After a short warm-up follows an urgent bill that must be paid today. The language is casual, the pressure is emotional, and the account receiving the money is a money mule, which is why speed matters when reporting to the bank.
CEO and invoice fraud. An employee receives a message or email that appears to come from a director: an urgent, confidential transfer is needed. Or a known supplier “changes” its bank details just before a large invoice. These attacks are prepared: names, roles, and running projects are collected from public sources first, which is what makes the request feel routine.
Payment link phishing. A fake payment request, delivery notification, or refund link that harvests banking credentials. Increasingly combined with a follow-up call from a fake “bank employee” who guides the victim through confirming the fraudulent transaction.
Why these scams work
The scam exploits urgency and familiarity. The message arrives at a busy moment, the story is plausible, and the requested amount is often just low enough not to trigger suspicion. Fraudsters also count on shame: many victims hesitate to verify because asking “is this really you?” feels awkward. That hesitation is exactly the gap the fraud lives in.
Immediate steps if you paid
- Contact your bank immediately and ask them to attempt recall of the transfer.
- Report the fraud to the police and, in the Netherlands, to the Fraudehelpdesk.
- Preserve the full conversation, the phone number, payment details, and any profile photo before the account disappears.
- Warn the person who was impersonated, so they can alert others in their network.
Will the bank refund the money?
It depends on how the money left. Where the fraudster took over your account or payment card, banks generally reimburse unless there was gross negligence. Where you authorized the transfer yourself, which is the case in most impersonation fraud, reimbursement is not automatic. For family-emergency fraud via WhatsApp, Dutch banks generally do not reimburse; a fast recall sometimes retrieves funds before the mule account is emptied. If someone posed as an employee of your own bank, using that bank’s name or phone number (bank helpdesk fraud or spoofing), the major Dutch banks apply a goodwill scheme. The bank assesses each case, and a police report is a condition. Ask your bank about it explicitly. Two things consistently improve the odds: reporting to the bank within hours rather than days, and providing a complete, organized evidence file. Never rely on a refund promise from someone who contacts you afterwards; “recovery” follow-up calls are frequently the same criminals.
What investigation can add
For individual cases with limited amounts, reporting to the bank and police is usually the proportionate route. Investigation becomes relevant when amounts are substantial, when a business has been targeted repeatedly, or when the impersonation is part of a broader pattern: fake profiles of a director, a hijacked business identity, or ongoing supplier fraud.
Investigators can document the digital traces around the fraud: the phone numbers and accounts used, connections to other known fraud campaigns, money flow indicators, and the public sources the fraudster likely used for preparation. For businesses, that supports internal decisions, insurance claims, and reports to banks and law enforcement. It can also identify which publicly available information made the organization vulnerable in the first place.
Reducing the risk
Agree on a verification habit for payment requests: call the known number of the person before transferring anything. For organizations: require a second channel for any change of bank details or urgent payment, and periodically review what information about roles and projects is publicly visible. No measure removes the risk entirely, but a simple verification step defeats most impersonation attempts.
Contact NCRB confidentially if your organization has been targeted by impersonation or payment fraud and you need the facts documented.
Disclaimer: This article is general information and does not constitute legal advice. Every case is different; consult a qualified professional where needed.
