A WhatsApp scam is impersonating your business: how to respond without making the harm worse

Confirm the incident before responding publicly

Start by distinguishing a compromised company account from an outside number merely using the company's name and image. Ask the affected person which number contacted them, how the conversation began, which identity it used, and what it requested. Do not ask them to forward intimate documents, banking details, or complete identity images to a general inbox.

Preserve captures showing the number, visible name, photograph, date, opening message, links, and request for money or information. Record where the victim first encountered the scammer: an advertisement, social platform, fake website, group, or unexpected message. A short timeline is more useful than hundreds of duplicate screenshots.

Check internally whether the stated vacancy, promotion, invoice, or conversation exists. Identify who can speak for human resources, customer service, security, and communications. Do not declare that a crime occurred or attribute the account to a particular person without evidence; describe the observable conduct as suspected impersonation or fraud.

• Number and visible name
• Opening message and link
• Money or information requested
• Channel where contact began
• Confirmation from the internal owner

Protect the people who may be targeted first

Spain's cybersecurity institute INCIBE documented a case in which someone used WhatsApp and a false interview to impersonate a company. Its guidance included warning people through the official website or social channels, collecting evidence, and directing the victim to specialist help. The response should reduce harm, not merely defend the brand.

Publish a short notice through controlled channels when the risk is real and verified. State which number, domain, or offer is not associated with the company, how genuine processes work, and where a message can be confirmed. Avoid repeating active links, personal data, or harmful images. Date the notice and update it as facts change.

For someone receiving the message, the FTC recommends avoiding links and phone numbers contained in unexpected communications and verifying the business through known contact details. If the person disclosed credentials or financial information or sent money, they should quickly contact the relevant provider and use official recovery resources available in their country.

Report each component through the appropriate route

Within WhatsApp, the recipient can block and report the contact using controls available in the conversation or profile. The person who received the messages usually holds the clearest direct evidence. A company can help identify relevant elements, but it should not access the person's phone or pretend to be them.

If the campaign includes a website, advertisement, social profile, email address, or fake job listing, treat each as a separate object. Preserve the complete URL and use the process offered by the provider controlling that item. A WhatsApp report does not automatically remove a fake website, and removal of one post does not prevent the same number from sending messages.

Where fraud, threats, coercion, identity theft, payments, or personal danger are involved, consider appropriate law-enforcement, cybersecurity, financial, or legal resources. INCIBE offers assistance in Spain through 017; scams in the United States can be reported to the FTC. The appropriate route depends on the country and facts.

Strengthen the company's authentic processes

Use the careers, billing, or support page to explain the channels the business actually uses. State whether the company never requests recruitment fees, verification codes, passwords, urgent transfers, or identity documents through an unknown number. Avoid absolute statements if an authorized team genuinely uses WhatsApp; document exceptions precisely.

Align the official domain, social profiles, Google Business Profile, directories, and contact pages. Provide a simple way to verify jobs, promotions, and invoices. Train reception, HR, and customer-service staff to record reports without blaming the victim and to escalate repeated patterns quickly.

Review whether the fraud uses public executive photographs, employee descriptions, or exposed documents. Do not impulsively remove useful company information. Minimize unnecessary data, secure accounts, enable available authentication protections, and define who may create advertisements, numbers, and profiles for the organization.

Measure outcomes without promising complete removal

Maintain one record per number, URL, and platform: first detection, evidence, warning, report, response, and last observed activity. Separate actions from outcomes. One person's block does not confirm platform-wide removal, and a few quiet days do not prove that the campaign has ended.

Search the company name with terms such as scam, WhatsApp, job, or fraud in affected markets. Check AI answers as well if the incident generated news or public warnings, recording the prompt, language, country, and cited sources. Correct controlled information without trying to conceal legitimate reporting about the incident.

ReputationGeo.ai can organize evidence, coordinate warnings and reporting routes, review search surfaces, and monitor changes. WhatsApp, providers, authorities, financial institutions, and search engines make independent decisions. Removal, attribution, recovery of money, Google ranking, and timing are not guaranteed. This material is educational and does not replace legal or security advice.

How to turn this guidance into a responsible plan

Begin with evidence, not assumptions. Save the exact URLs, screenshots, publication dates, search phrases, review profiles and AI answers that are creating concern. Record where each item appears, who controls the source and whether the information is inaccurate, outdated, private, misleading or simply unfavorable. These distinctions matter because removal, correction, response, suppression and monitoring are different remedies. A credible adviser should explain those differences before recommending work or discussing timing.

Next, define the audience and the decision at risk. A result seen by prospective clients in Spain may require different language, sources and local signals from a result affecting investors in the United States. Decide which names, brands, locations and search questions matter most. Prioritization prevents a campaign from becoming a vague attempt to control the internet and turns it into a measurable program focused on accuracy, trust and discoverability.

Evidence, people and measurements to prepare

Create a baseline before changes begin. It can include the first two pages of Google for agreed searches, ratings and review volume, visibility of owned pages, recurring themes in AI answers and the status of platform or publisher requests. Keep personal data to the minimum necessary and share sensitive documents only through an agreed secure process. If a legal right may apply, involve qualified counsel in the relevant jurisdiction; reputation strategy does not replace legal advice.

Assign an owner for approvals, factual verification and customer responses. Review progress consistently, but do not judge the program by one daily ranking. Useful measures include corrected or removed items, response completion, the share of credible owned and independent sources, search-result composition, branded query trends and whether public information answers real questions. The objective is a more accurate and resilient digital record, not an artificial promise that criticism will disappear.

Keep a decision record, not just a list of links

For every material item, record the exact source, the factual concern, the person responsible for verification, the proposed route and the reason that route is proportionate. Include the date of any request, response deadline, platform reference number and next review date. This record prevents duplicate or contradictory reports and helps a new decision-maker understand why an item was corrected, challenged, answered, monitored or left alone.

A sound record also separates confirmed facts from interpretations. Label legal questions for qualified counsel, service failures for operational owners and public explanations for communications review. If an item changes, preserve the before-and-after evidence without collecting more personal data than necessary. This discipline is especially important when search engines and AI systems update unpredictably: it shows what actually changed and avoids claiming credit for movements that may have several causes.

• Source, URL, date and affected search or prompt
• Verified facts, disputed claims and supporting evidence
• Chosen route, owner, status and next review date
• Privacy, amplification and escalation risks