On November 5, 2026, La Razón reported that the Guardia Civil in Cantabria, Spain, was investigating more than 20 complaints involving alleged WhatsApp account takeovers on iPhones. The report said victims lost control without clicking a link or taking another action, after which impostors asked their contacts for money through Bizum or bank transfers.

What was reported in Cantabria

The account describes alleged WhatsApp misuse and urgent payment requests sent to victims’ contacts. The reported no-click behavior means the victims were said not to have interacted before losing control of their accounts; it does not identify how the account access happened.

A separate alert from Spain’s cybersecurity institute, INCIBE, published October 14, 2026, described consultations about WhatsApp accounts sending payment requests that account holders said they had not written. In some cases, account holders retained access while messages went out without appearing in their own chat histories. Those reports provide context for the kind of account activity INCIBE addressed, but they do not identify the method behind the Cantabria complaints.

What INCIBE’s iOS observations say

INCIBE said the consultations it handled predominantly involved iOS versions earlier than iOS 18. It also received some reports involving iOS 26 versions earlier than iOS 26.7. The institute cautioned that these consultation patterns do not mean every user on those versions is affected. They are not a diagnosis of an individual iPhone; install the latest iOS version compatible with your device.

INCIBE recommends enabling WhatsApp two-step verification with a PIN and adding a recovery email that only you control. This is a WhatsApp account setting, separate from Face ID or an iPhone passcode.

An empty list of unfamiliar linked devices does not rule out unauthorized WhatsApp use, according to INCIBE. Checking linked devices is still one of the institute’s recommended account-security steps.

What to do before reinstalling WhatsApp

If you suspect someone has used your account, INCIBE recommends this order:

  1. Warn your contacts through another channel. Don’t rely on the affected WhatsApp conversation to alert them.
  2. Preserve evidence before deleting messages or reinstalling. Keep screenshots, dates, phone numbers, payment details, and copies of relevant conversations, including recipients’ chat records.
  3. Update iOS first. Install the newest version compatible with your iPhone. If no update is offered, INCIBE advises checking Apple’s compatibility guidance or contacting Apple support. If Apple confirms the phone will receive no further security fixes, consider a device that remains supported for the apps and sensitive data you use.
  4. Back up your WhatsApp chats and confirm the backup completed. Do this after updating iOS and before reinstalling the app.
  5. Reinstall WhatsApp, then review linked devices. INCIBE said that, in some cases it handled, updating iOS alone or reinstalling WhatsApp before updating iOS was insufficient.

INCIBE’s alert and account-recovery guidance

Before sending money in response to an urgent WhatsApp request, call the person or contact them through another channel.

How to handle an urgent payment request

INCIBE advises verifying an unexpected request by calling the supposed sender or contacting them through another channel, rather than replying in the same WhatsApp conversation. If you already sent money, contact your bank immediately through its official channels and ask it to try to stop or recover the transfer. Recovery is not guaranteed.