A message arrives from an unfamiliar number: “Hi Mum, this is my new number.” The phone is broken, there’s no time to talk, and a transfer is needed immediately. It is one of the most profitable social engineering schemes in circulation, and it targets instinct rather than software. The script barely changes, but the sums involved are substantial: in a single operation dubbed Hiwaso, Spain’s Guardia Civil attributed more than €850,000 in losses to 238 victims in the province of Alicante alone, with individual amounts ranging from €800 to €55,000. More than 100 people were arrested across the country.
- The core mechanic: A stranger poses as your child from a new number, blames a broken or lost phone, and requests an urgent transfer to an account that is not your child’s.
- The tell: The scammer insists everything stays in text, because a phone call would expose the voice. Calling your child’s usual number is the free, decisive check.
- New safety net: Since 9 October 2025, banks in the EU must offer free beneficiary verification for euro transfers, flagging mismatches between the name you type and the account holder.
- If you’ve paid: Call your bank immediately, preserve all evidence, block and report the number, file a police report and seek guidance from a cybersecurity helpline.
Anatomy of the ‘child in distress’ fraud
The first contact may come by SMS or directly through WhatsApp. A May 2025 advisory from Spain’s national cybersecurity institute, INCIBE, describes a variant that opens with a text claiming the phone is broken and asking to continue the conversation on WhatsApp. In a separate Guardia Civil operation in Granada, reported by the Interior Ministry in October 2023, the message greeted the mother, said the phone was broken, that the sender was writing from a temporary number and could not call. That inability to call is the linchpin: the fraudster needs the entire exchange to remain in writing, where voice cannot betray him.
Organised groups typically sit behind these campaigns. The Guardia Civil says they study victim profiles, with one common factor: having an adult child who has moved out, studies away from home or is travelling. In an operation with 59 arrests announced in January 2024, the National Police said the network trawled social media accounts of young people studying elsewhere. The money lands in accounts held by “mules” — in that case, young people who received the transfers and withdrew cash in exchange for a cut. The Hiwaso investigation identified more than 500 bank accounts used by the network.
The warning signs that expose the fake child
No single signal is proof, but together they form the pattern repeated in official alerts:
- Unknown number plus a technical excuse: a broken, lost or “temporary” phone.
- No phone calls — text only.
- Urgency: the Guardia Civil describes desperate messages designed to trigger a parent’s protective reflex.
- An account that isn’t theirs, because they supposedly can’t access their bank. This is the moment to stop.
- An immediate transfer: in Hiwaso the request was explicit, and the Guardia Civil describes the payment as “without return.”
- Odd phrasing: the National Police advises suspicion when the language or expressions don’t match the person writing.
The check that dismantles the scam is the one the National Police itself recommends: contact your child through a channel other than WhatsApp and, if that fails, ask a relative or friend. Call the usual number. If your child is fine, the problem ends there.
This fraud will keep working as long as it is treated as a problem of “distracted elderly people”: the victims documented by police are ordinary families with children living away.
Does the bank warn you when the account name doesn’t match?
Yes, for euro transfers, since 9 October 2025. From that date banks must offer a free beneficiary verification service that checks whether the name you enter matches the holder of the destination account, according to the Bank of Spain’s Banking Customer Portal. The obligation stems from Regulation (EU) 2024/886 on instant transfers.
There are four possible outcomes: match, close match (with the real name displayed), no match, or verification not possible. If you type your child’s name and the bank says the account isn’t theirs, you know something is wrong.
The fine print: if you proceed despite a no-match or close-match result, the money goes to the IBAN you entered and the bank will not be liable, the Bank of Spain warns. If someone tells you it’s “a friend’s account,” hang up and call your child.
Act within minutes: call your bank to try to stop the operation, preserve the evidence and file a report. These are the steps INCIBE recommends:
- Call your bank immediately so it can take protective measures and attempt to cancel the transaction.
- Preserve the evidence: screenshots of the messages, the numbers used and the transfer or instant-payment receipts.
- Block and report the number on WhatsApp.
- File a police report. The National Police advises visiting its stations or calling 091; the Bank of Spain recommends reporting to the National Police or the Guardia Civil with screenshots and phone numbers.
- Seek guidance from INCIBE’s cybersecurity helpline on 017.
Expectations should be realistic. The Bank of Spain explains that transfers are irrevocable orders: once the money is credited, your bank cannot reverse it without the beneficiary’s consent or a court order. And because you authorised the operation yourself, it does not fall under the unauthorised-transfer regime, in which the bank must reimburse immediately. That is why the police report matters: it is the route by which an investigation can reach the mule accounts.
Hardening the family before the message arrives
Prevention here is more conversation than technology:
- Family rule: nobody pays into a new account without a call to the known number, even if the message insists a call is impossible.
- Always type the account holder’s name on transfers and read the beneficiary verification result before confirming.
- Protect your children’s WhatsApp: a nastier variant arrives from their real, hijacked account after a six-digit verification code is stolen.
The fake-child scam is technologically crude: a line registered under a false name and a script. Its power lies in urgency. The defence is equally simple — one phone call. Banks should arguably go further than a warning a panicked customer can dismiss, for instance by introducing a voluntary delay on payments to new accounts. Until then, the call rule remains the best protection available, and it costs nothing.