WhatsApp Cloning (Clonagem) in Brazil: How Scammers Hijack Your Account to Steal PIX

WhatsApp is not just a messaging app in Brazil — it is the central communication infrastructure for over 190 million users. People use it for everything: personal conversations, business transactions, government services, and most importantly, coordinating PIX payments. That dependency has made WhatsApp account hijacking — known locally as "clonagem de WhatsApp" — one of the country's most devastating scams.

When a scammer clones your WhatsApp, they do not just read your messages. They impersonate you to your contacts, requesting urgent PIX transfers. The results are devastating because your friends and family trust messages that come from "you."

How WhatsApp Cloning Works in Brazil

1. Chip Swap (Troca de Chip) + WhatsApp Takeover

This is the most common method. The scammer:

1. Obtains your personal data (CPF, full name, phone number) from data breaches
2. Contacts your carrier (Vivo, Claro, TIM) pretending to be you
3. Requests a new SIM card, claiming the old one was lost or damaged
4. Once the new SIM is activated, your phone loses signal
5. The scammer inserts the new SIM and receives your WhatsApp verification code
6. They log into your WhatsApp account and lock you out

Time to complete: Often under 30 minutes. By the time you realize your phone has no signal, the scammer may already be messaging your contacts.

2. Verification Code Theft (Golpe do Codigo)

The scammer calls or messages you with a pretext — a fake OLX inquiry, a fake delivery confirmation, a fake prize notification — and asks you to share a "confirmation code" that was just sent to your phone. That code is actually the WhatsApp 6-digit verification code. Once you share it, the scammer registers your number on their device.

Common pretexts used in Brazil:

• "I sent you the wrong code by accident, can you forward it?"
• "This is OLX support. We need the code sent to your phone to verify your listing."
• "You won a promotion! Confirm with the code we sent."
• "This is [your bank]. Please share the security code we just sent."

3. WhatsApp Web Hijacking

If someone has brief physical access to your phone — at a party, at work, or during a repair — they can link your WhatsApp to a new device through WhatsApp Web in seconds. They then monitor your conversations and wait for the right moment to impersonate you.

4. Malware-Based Cloning

Malicious apps disguised as utilities, games, or even "WhatsApp enhancement" tools capture your WhatsApp session data. RAT (Remote Access Trojan) malware can also capture your screen and extract verification codes in real-time.

The PIX Connection: Why Clonagem Is So Profitable

WhatsApp cloning in Brazil is uniquely profitable because of PIX:

1. Scammer clones your WhatsApp
2. Immediately messages your close contacts: "Oi, estou com um problema, preciso que voce me transfira R$XXX via PIX urgente, te devolvo amanha"
3. Contacts trust the message because it comes from your account
4. PIX transfers are instant and irreversible — the money is gone within seconds
5. Scammers target multiple contacts simultaneously — one cloned account can yield R$5,000-50,000+

Why Contacts Fall for It

Factor	Why It Works
Trust	Message comes from a known contact
Urgency	"I need this NOW, it is an emergency"
PIX speed	Transfer completes before anyone can verify
Brazilian culture	People help friends and family without question
WhatsApp dominance	"If it is on WhatsApp, it must be real"

How to Protect Your WhatsApp Account

Enable Two-Step Verification (Verificacao em Duas Etapas)

This is the single most important step. It adds a 6-digit PIN that is required whenever WhatsApp is registered on a new device:

1. Open WhatsApp > Settings > Account > Two-step verification
2. Set a 6-digit PIN (do not use obvious numbers like 123456 or your birth year)
3. Add a recovery email in case you forget the PIN
4. Never share this PIN with anyone, for any reason

Lock SIM Changes with Your Carrier

Contact Vivo (1058), Claro (1052), or TIM (*144) and request:

• SIM lock — requires in-person visit with ID for any SIM changes
• Verbal password (senha de atendimento) for phone support
• Portability block to prevent unauthorized number transfers

Secure WhatsApp Web Sessions

1. Open WhatsApp > Settings > Linked Devices
2. Review all active sessions
3. Remove any device you do not recognize
4. Check this list at least once a week
5. Never leave your phone unlocked around people you do not trust completely

Never Share Verification Codes

No legitimate service will ever ask you to share a verification code that was sent to your phone. This rule has zero exceptions:

• Not OLX
• Not your bank
• Not Correios
• Not WhatsApp itself
• Not any government agency

If anyone asks for a code, it is a scam. Period.

Additional Protection Steps

• Enable biometric lock for WhatsApp (Settings > Privacy > Fingerprint Lock)
• Hide your "last seen" and profile photo from non-contacts
• Do not click unknown links in WhatsApp messages
• Keep WhatsApp updated to the latest version
• Use an eSIM if your phone supports it — eSIMs cannot be physically cloned

What to Do If Your WhatsApp Is Cloned

Immediate Steps (First 15 Minutes)

1. Try to reclaim your account — Open WhatsApp, enter your phone number, and request a new verification code via SMS
2. If SIM was swapped — Call your carrier immediately from another phone to report fraud and request SIM deactivation
3. Enter your two-step verification PIN when prompted (this is why having it is crucial)
4. Email WhatsApp support at support@whatsapp.com with subject "Lost/Stolen: Please deactivate my account" and your phone number in full international format (+55...)

Alert Your Contacts

5. Post on social media (Instagram, Facebook) immediately: "My WhatsApp was cloned. Do NOT transfer money to anyone messaging from my number"
6. Call your closest contacts to warn them directly
7. Ask contacts to report and block the cloned account on WhatsApp

Documentation and Recovery

8. File a B.O. (police report) online — this is essential for any financial recovery
9. Request MED (Mecanismo Especial de Devolucao) through your bank for any PIX transfers made by the scammer to your contacts
10. Report to Procon if the carrier was negligent in the SIM swap

Sharing Sensitive Information via WhatsApp Alternatives

One of the risks of WhatsApp cloning is that scammers gain access to your chat history, which may contain sensitive information — bank details, passwords, personal documents. To minimize this risk, avoid sending sensitive data directly in WhatsApp messages.

Instead, use LOCK.PUB to create password-protected links that expire. When you need to share a PIX key, bank account number, or personal document with someone, send the link through WhatsApp but share the password through a phone call. Even if your WhatsApp is cloned, the scammer cannot access the content behind the expired link.

Scam Response Flowchart

When you receive a PIX request from a contact on WhatsApp:

1. Pause — Do not transfer immediately, no matter how urgent it seems
2. Call the person on their phone number (voice call, not WhatsApp call)
3. Ask a verification question that only the real person would know
4. If you cannot reach them — Do not transfer. Wait until you can verify
5. If confirmed as scam — Report the account on WhatsApp and warn other contacts

Conclusion

WhatsApp clonagem is one of Brazil's most financially damaging scams because it exploits the trust between friends and family. Enable two-step verification today — it takes 30 seconds and is the single most effective defense. Lock your SIM with your carrier, never share verification codes, and always call to verify before making PIX transfers.

Keep your sensitive information out of WhatsApp chat history. Visit LOCK.PUB to share passwords, bank details, and documents through free encrypted, expiring links.