Authorities in Cuba have issued an urgent warning regarding a sophisticated wave of digital fraud targeting WhatsApp users, specifically leveraging the island’s precarious economic climate to lure victims into fraudulent currency exchange schemes. The alert, initially raised by the Banco de Crédito y Comercio (Bandec) in Matanzas, describes a coordinated effort to hijack personal accounts and exploit the trust between friends and family to steal funds via bank transfers.
The scam represents a critical intersection of social engineering and technical vulnerability. By gaining control of a trusted individual’s account, attackers can bypass the natural skepticism victims might have toward strangers, instead presenting a “too-good-to-be-true” financial offer from a known contact. This method has already led to significant economic losses for users across the region, as the perpetrators vanish immediately after the funds are transferred.
The Anatomy of the Account Hijack
From a technical perspective, these estafas en WhatsApp en Cuba do not rely on complex hacking software, but rather on the manipulation of the platform’s own security and recovery features. The process begins with a “setup” phase where the attacker creates a fake profile mimicking a close relative or friend of the target.
The attacker then contacts the victim, claiming to be experiencing technical difficulties or requesting aid to “synchronize contacts” or “link phones.” During this conversation, the scammer asks the victim to provide a specific eight-digit code. While the attacker frames this as a technical requirement for device linking, it is actually a verification code triggered by the attacker attempting to register the victim’s phone number on a different device.
The official warning from Bandec is explicit on this point: “El código de ocho dígitos que el estafador proporciona NO es para vincular dispositivos. Es, en realidad, el código de verificación que el sistema de WhatsApp envía por SMS o llamada.” Once the victim shares this code, the attacker gains immediate and total control of the account, effectively locking the original owner out of their own profile.
Exploiting Economic Desperation
Once the account is compromised, the attacker moves quickly to monetize the access before the victim can alert their network. The first step is typically to block the original owner to prevent them from sending warnings to their contacts. The attacker then posts a status update or sends direct messages to the contact list with an offer that appeals to the current financial hardships in Cuba.
A common lure involves an urgent necessitate for a bank transfer, promising an attractive exchange rate. One typical message identified by authorities reads: “Necesito hacer una transferencia urgente. Doy efectivo en mano al 1×1. Interesados al privado.”
In a landscape where access to hard currency and efficient transfer methods is limited, a “1×1” offer from a trusted friend is highly enticing. When a contact agrees to the deal, the scammer provides a bank card number to receive the transfer. As soon as the payment is confirmed, the attacker blocks the victim and disappears with the funds.
The Fraud Cycle: A Step-by-Step Timeline
The efficiency of this scam lies in its rapid execution. The following sequence outlines how a typical attack unfolds:
- Impersonation: Attacker creates a fake profile of a known contact.
- The Hook: Attacker asks for an 8-digit “synchronization” code.
- Takeover: Attacker uses the code to log into the account on a recent device.
- Isolation: The original account owner is blocked or logged out.
- The Offer: Fake currency exchange offers are sent to all contacts.
- The Theft: Victim transfers money to the attacker’s card and is immediately blocked.
A Broader Pattern of Instability
The rise in digital fraud is occurring against a backdrop of severe economic crisis, which authorities suggest is increasing the prevalence of various crimes. While official figures on the total increase of digital scams have not been released, other high-value thefts have highlighted the current volatility.
For instance, state media in Matanzas recently reported the recovery of equipment stolen from the Hotel Iberostar Varadero in mid-March. The stolen items, which included a professional coffee machine, were valued at approximately three million Cuban pesos (roughly $6,000 USD based on official rates). While this was a physical theft, it underscores a broader trend of opportunistic crime emerging from the island’s financial instability.
How to Protect Your Account
To combat these estafas en WhatsApp en Cuba, security experts and banking authorities recommend a zero-trust approach to verification codes. No legitimate company, including WhatsApp, will ever ask a user to provide a verification code to a third party for “synchronization” or “linking” purposes.
Users can significantly reduce their risk by enabling Two-Step Verification. This feature adds a secondary layer of security—a personal PIN—that must be entered whenever the account is registered on a new device. Even if a scammer manages to steal the SMS verification code, they would still be unable to access the account without the secret PIN.
if a friend or family member makes an unusual financial request via text, users are encouraged to verify the request through a separate communication channel, such as a direct phone call or a face-to-face meeting, before initiating any bank transfer.
Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice.
The Cuban authorities continue to monitor these digital threats, with Bandec and other official channels expected to provide further updates as new modalities of fraud emerge. Users are encouraged to report any suspicious activity to their banking institutions immediately to attempt the freezing of fraudulent transfers.
Do you have experience with these types of digital scams or tips on how to stay safe? Share your thoughts in the comments below.
