It usually starts with something small enough to ignore. A text on WhatsApp from an unfamiliar international number, apologizing for reaching the wrong person, or a friendly message offering easy paid work rating products online. Neither message asks for anything at first, which is exactly why so many people reply. What follows is one of the fastest growing scam patterns tracked by the Federal Trade Commission and state financial regulators, and it very often ends in a cryptocurrency payment that cannot be recovered.
The message that starts it all
Two openings dominate this category. The first is the wrong number text, an apparently accidental message meant for someone else, followed by a warm reply instead of silence once the sender realizes the mistake. The second is a direct, unsolicited job offer promising flexible remote work, often something as simple as rating products, liking videos, or completing small online tasks for pay. Both are chosen because they feel low stakes. Nobody suspects a scam from a stranger apologizing for a wrong number, and a job offer that asks for nothing upfront does not trigger the alarm bells that a request for money would.
The task scam structure
- An invitation to complete simple tasks, such as rating products, subscribing to channels, or reviewing listings, for a small real payment
- A short trial period where the first few payouts are genuinely sent, building confidence in the platform
- An introduction to larger, higher paying task sets that can only be unlocked with a deposit
- Pressure to deposit through cryptocurrency specifically, described as faster or required by the platform
- A group chat filled with other apparent workers celebrating payouts and encouraging bigger deposits
- A final stage where withdrawals are blocked, additional fees are demanded, and the recruiter eventually goes silent
Why the first payments are real
Scammers frequently pay out small amounts early in the process for a simple reason: it works. A real payout, even a tiny one, does more to establish credibility than any amount of marketing language could, and it makes the eventual request for a deposit feel like a natural next step rather than a red flag. The Federal Trade Commission has specifically warned that this style of task scam increasingly asks victims to fund their own participation through cryptocurrency, framing it as the only accepted payment method for unlocking further work.
The group chat pressure tactic
Many of these schemes add victims to a group chat alongside dozens of other apparent participants, who post screenshots of their earnings and encourage each other to deposit more. In reality, many of these accounts are also controlled by the scam operation itself, manufacturing social proof and urgency that would be far less convincing coming from a single recruiter. Seeing what looks like ordinary people succeeding at the same task makes the opportunity feel validated by more than just one stranger's word.
How the wrong number opening actually escalates
The wrong number text deserves closer attention because it is deliberately engineered to feel harmless. A message arrives addressed to a name that is not yours, often something ordinary like confirming a dinner reservation or asking if a package arrived. Replying to correct the mistake feels like basic politeness rather than the start of anything risky, and the sender typically responds with warmth and a bit of self deprecating humor about the mix up rather than immediately trying to continue the conversation. Only after several exchanges, sometimes over days, does the conversation shift toward getting to know each other, at which point it can follow either the job and task scam pattern described above or a longer, more personal relationship building pattern that eventually leads to a cryptocurrency investment pitch, the same structure covered in depth in our guide on pig butchering scams.
Why this opening works so well
Unlike a cold sales message or an obvious phishing attempt, the wrong number opening contains no request of any kind. There is nothing to refuse, nothing to be suspicious of, and no reason to search the sender's number online before replying. That absence of an ask is precisely the point. By the time any request eventually appears, whether it is a job offer, an investment tip, or a personal favor, days or weeks of ordinary, low stakes conversation have already built a baseline of familiarity that makes the request feel like it is coming from someone you already know, rather than a stranger.
Recognizing the signs in someone else
Because these conversations often move to WhatsApp specifically because it feels more private than a dating app or social media, family members are sometimes the last to know a new relationship or job opportunity even exists. Warning signs worth paying attention to include a relative who has started an unusual number of voice notes or calls with someone they describe only vaguely, a sudden new interest in a work from home opportunity that involves upfront payments or cryptocurrency, or hesitation to explain who exactly they are talking to when asked directly. If someone close to you mentions a great new job paying for simple online tasks, or a new friend who has been unusually generous with investment advice, asking a few gentle, specific questions, how did you meet, what company is this, can you show me the app, often surfaces inconsistencies faster than a direct warning would.
Overlap with relationship based scams
WhatsApp is also widely used as the platform where longer, relationship based investment scams play out once initial contact has moved off a dating app or social media. The messaging habits people already have on WhatsApp, voice notes, photos, daily check ins, make it a natural place for scammers to sustain the kind of ongoing personal relationship that eventually leads to a fraudulent investment pitch. Our guide on how pig butchering scams work covers this pattern in detail, since WhatsApp frequently plays the same role there that Telegram or a dating app does in other cases.
One reason this transition happens so smoothly is that WhatsApp already feels private and personal by design, given its end to end encryption and its use for close family and friend conversations rather than public networking. A scammer who successfully moves a conversation from a dating app onto WhatsApp has effectively removed it from a platform with built in safety reporting tools and placed it somewhere that feels, and functions, much more like a genuine one on one relationship, which can make later warning signs easier to overlook.
A legitimate employer will never require payment, a crypto deposit, or a purchased training kit before you can access work or get paid. Any version of this request is the scam itself, not a step toward a real job.
Warning signs to watch for
- Contact from a stranger on WhatsApp offering work with no application, interview, or verifiable company behind it
- Any request to pay, deposit, or purchase something before you can start earning or before a withdrawal will be released
- Pressure to use cryptocurrency specifically as the only accepted method of payment or deposit
- A group chat full of enthusiastic participants you have never independently verified are real
- Urgency around limited time bonuses, expiring task sets, or closing windows to deposit more
How to verify a job offer before responding
A few minutes of checking can rule out the vast majority of fake WhatsApp job offers. Search the company name together with the word scam or review, since a fraudulent operation recruiting broadly enough to reach you through a cold message has almost always generated complaints somewhere online already. Look for the company on a professional networking site and check whether it has any verifiable employees, history, or physical address, rather than only a logo and a generic description. A legitimate employer will also always be reachable through a company domain email address, not only through a personal WhatsApp number, and will never ask a candidate to pay for training, equipment, or a starter task package before receiving a first paycheck.
What to do if you have already sent crypto
Stop sending any further payments immediately, even if you are told a final fee will unlock your funds, since this pattern rarely ends until the victim stops paying. Document the WhatsApp conversation, every wallet address you sent funds to, and any transaction identifiers before deleting anything. Our guide on what to do in the first 24 hours after a crypto theft walks through exactly what to preserve and in what order, which matters both for any recovery effort and for filing a report with authorities.
Securing your accounts and reporting the incident
- Block and report the WhatsApp contact and, if applicable, the group chat or channel involved, rather than simply leaving it silently
- Change passwords on any account you may have discussed or accessed during the conversation, particularly if you installed any app the contact recommended
- File a report with the FBI's Internet Crime Complaint Center, which specifically tracks cryptocurrency job scams as a distinct category
- If you shared identification documents as part of a fake job application, consider placing a fraud alert with the major credit bureaus, since these documents are sometimes reused for identity theft
- Search for your phone number alongside terms like scam or fraud, since documenting a pattern of similar reports from other victims can support both your own report and broader law enforcement action
Frequently asked questions
Cryptocurrency transfers are fast, difficult to reverse, and do not always require the identity verification a bank transfer would, which makes them attractive to scammers extracting deposits from many victims at once. Regulators have specifically flagged crypto as the leading payment method requested in these task and job scams.
Yes, this is a common and deliberate part of the scheme. Small real payouts early on are used specifically to build trust before a larger deposit is requested, after which withdrawals typically stop.
Simply do not reply, or reply once to clarify the mistake and stop the conversation there. Continuing a friendly exchange with an unknown international number that claimed to reach you by accident is one of the most common openings for both job scams and longer relationship based investment scams.
Recovery depends heavily on how quickly the transfer is reported and where the funds moved afterward. Blockchain transactions cannot be reversed directly, but documenting the wallet addresses and reporting the case quickly gives investigators the best chance of tracing where the money went.
WhatsApp's large global user base, end to end encryption, and normal use for both personal and business messaging make it an unusually versatile tool for scammers, since a message can plausibly claim to be a wrong number, a personal contact, or a business recruiter without seeming out of place. Its familiarity also lowers a target's guard compared to an unfamiliar platform, since most people already use it daily for entirely ordinary conversations.
Sources and further reading
- How to spot and avoid task scams · Federal Trade Commission
- Cryptocurrency Job Scams · Federal Bureau of Investigation