The ‘mom-in-distress’ text scam is back – and it’s draining accounts in under 60 seconds
A two-line WhatsApp message – ‘Hi, it’s me, new phone, please write back’ – is all it takes to hijack a family’s savings. Spanish police logged 3,200 cases of the so-called ‘familiar fraud’ in April alone, each one emptied through instant Bizum transfers before the victim realised the voice on the other end belonged to a stranger with a prepaid SIM.
How a €40 burner becomes a direct pipe to your bank balance
Crooks buy a €40 anonymous SIM, clone the profile photo of a real child or grand-child, then blast the same cry for help to every number scraped from leaked school parent lists or old Facebook posts. The hook is always urgent: ‘I’m at the police station, I need €600 for the fine, please don’t tell dad’. Because the message arrives from an unknown number, the target’s brain fills the gap with panic instead of suspicion.
Once the victim replies, the scammer escalates. A voice note follows – three seconds of AI-generated audio trained on TikTok clips – and within minutes the mark is tapping the green ‘send’ button on a Bizum screen. The money lands in a mule account, is split into crypto and is gone before the bank’s fraud algorithm wakes up.
INCIBE reclassified the trick last month as Category 4, the same threat level it reserves for ransomware gangs. The reason: unlike classic phishing, the user volunteers the transfer, stripping banks of the legal obligation to reimburse. Average loss per case: €1,850. Average age of victims: 57. Average time to realise the con: four hours, by which point the number is already dead.
The family password that makes the scam collapse
Police stations in Madrid now hand out blank cards titled ‘Our safe word is…’ for relatives to fill in together. The premise is brutal but effective: if a message arrives without the agreed phrase – last summer’s campsite, the dog’s first toy – you hang up and call the landline. In test runs organised by the cyber-crime unit, the simple ritual reduced successful fraud by 92 %.
Yet most households still rely on intuition. ‘They sound just like my daughter’, victims repeat in statements, ignoring that today’s deep-fake tools need only three seconds of voice to rebuild the entire timbre. The trick isn’t technological brilliance; it’s emotional precision. The scammers bet on shame, on the fear of looking like a bad parent who refuses help.
WhatsApp is testing a warning banner that triggers when an unknown number claims to be a relative, but rollout is patchy and optional. Until then, the cheapest firewall remains a 30-second phone call. ‘If they can’t say the name of the neighbour’s cat, it’s not your kid’, an officer shrugs. The Oscar-worthy performance ends the moment real life intrudes.