‘Please vote for Eliska’: a WhatsApp message that can link a stranger’s device to your account

Checked: 25 Oct 2026, against WhatsApp’s Help Center (English and Spanish) and INCIBE. Menu names can change with app updates. Checked against official help pages, and the menu steps were checked on a phone.

Where it has been seen: Spain (confirmed). It was also reported in Austria (Watchlist Internet, 16 Sep 2026), as the return of a scam first seen about a year earlier. We have found no local reports yet in the UK, Mexico, Colombia, Argentina or the US. Linked devices is a normal WhatsApp feature in every country, so the trick could travel.

The short version

A friend or family contact sends you a WhatsApp message: “Could you vote for Eliska? She is the daughter of friends. First prize is a free dance class.” The link opens a fake voting page with two girls’ photos. The message names a girl, such as Eliska or Sophie, and the prize can change. To “vote,” the page asks for your phone number. Then it shows you a code and tells you to type it into WhatsApp. That code is not for voting. Typing it into WhatsApp links the scammer’s device to your account. Some versions ask you to scan a QR code instead. The result is the same.

After that, the scammer can use your account from their own device. They can write to your contacts as you. That is how the message reaches the next person.

Some details:

  • The message comes from a real contact whose account was already taken over. A known name does not prove the message is safe.
  • The photos on the page were made with AI. VerificaRTVE found an OpenAI watermark (a hidden mark that shows who made an image), and a detector flagged them.
  • RTVE says VirusTotal marked the page as suspicious, and an identical twin page as phishing (a fake page that tricks you). The URLScan tool also marked it as malicious. VirusTotal and URLScan are online tools that check links.
  • INCIBE, Spain’s national cybersecurity institute, rated its notice “4 – Alta” (high).
  • Opening the link or typing your number does not by itself link a device. But check your linked devices anyway (steps below).

A related Spanish notice from INCIBE, 14 Oct, is also rated “4 – Alta.” Contacts of some iPhone users got messages asking for money (for example, 980 euros). The messages were sent from the user’s own WhatsApp, and the user could not see them. INCIBE says most cases it handled involved iOS older than 18, and some involved iOS 26 older than 26.7. INCIBE says these are only the cases it handled. They do not mean every user of those versions is affected. We do not know if the two events are linked.

Newtral (13 Oct) received a screenshot of a message about Spain’s general election on 29 November 2026. Spanish media call that election “29N”, for 29 November. The message asks people to “verify your vote” by linking WhatsApp to a device with a code. Spain’s INE (the national statistics office) told Newtral that verification of votes is never requested, including by WhatsApp. WhatsApp told Newtral it has no role in voting. Newtral could not confirm what happens after the code is entered. This verification does not exist.

Do this today (it should take under 10 minutes; steps 5 and 6 are only if needed, or for later)

  1. Check your linked devices first. Open WhatsApp.
    • Android: tap the three dots (More), then Linked devices.
    • iPhone: tap Settings (or your profile picture), then Linked devices.
    • Tap any device you do not know, then tap Log out. On iPhone, tap Log out again to confirm.
  2. Turn on two-step verification. This is an extra lock on your WhatsApp account.
    • Android: tap the three dots, then Settings, then Account, then Two-step verification.
    • iPhone: tap Settings (or your profile picture), then Account, then Two-step verification.
    • Set the PIN or password the app asks for. Add an email address only you can open.
    • WhatsApp is replacing the 6-digit PIN with a password, so you may see either. It is not the code WhatsApp sends you. Never share your PIN or password.
    • This protects your number if someone tries to sign in to it on another phone. It does not remove a device that is already linked, so do step 1 first.
  3. Never type a code into WhatsApp, or scan a QR code, because a web page or a chat tells you to. A real vote never needs you to link a device. Link a device only when you are setting up WhatsApp yourself, for example on your own computer. If WhatsApp shows a “link new device” message you did not start, tap “Don’t link”. Never share the 6-digit code WhatsApp sends you when you sign in.
  4. If a contact sends a strange message, call them or text them another way. Do not ask in the same chat. Do not forward the message or the link, even to warn people. Tell them in your own words.
  5. If you think someone else is using your account:
    • First, log out any device you do not know (step 1).
    • Then tell your contacts by another channel, such as a call. Ask them not to open the link or send money.
    • Keep screenshots and dates. Check your linked devices again.
    • If strange messages keep going out, or you lose access, contact WhatsApp support. In Spain you can also call 017 (free, every day, 8:00 to 23:00).
    • If you use an iPhone with an old iOS version, INCIBE’s 14 October notice also advises updating iOS and then reinstalling WhatsApp. Back up your chats first.
    • If you sent money, call your bank right away, using the number on your card or on its official website. Getting money back is not guaranteed.
  6. Next, when you have time: protect the email account tied to your accounts with a passkey or an authenticator app. Our guides explain how.

US/UK/other versions

The steps are the same idea everywhere. Menu names can differ a little by phone, language and app version. Reporting differs:

  • Spain: call INCIBE’s cybersecurity helpline, 017. It is free and confidential, and open every day from 8:00 to 23:00. If money was sent, call your bank first. Then report to the police (Policía Nacional or Guardia Civil).
  • UK: Report Fraud, 0300 123 2040 (England, Wales and Northern Ireland). In Scotland, call Police Scotland on 101.
  • US: ReportFraud.ftc.gov.
  • Argentina: report at the police station or complaints office for your home area (argentina.gob.ar, Centro Nacional de Ciberseguridad).
  • Mexico, Colombia: we have not checked local reporting routes yet.

Sources (all checked 25 Oct 2026)