The phone numbers associated with WhatsApp have become a prized asset in underground forums. The magnitude of the market became evident when an actor put up for sale a database with nearly 500 million recent records, verified by independent researchers, which included data from users in 84 countries, including Spain and much of the EU.

Obtaining those numbers does not require magic: it is enough to combine old leaks, massive social media tracking, and scrapers that extract metadata from web pages or public groups of the application. The next step is to confirm which phones are actually registered on WhatsApp. For this, enumeration scripts proliferate —some openly published in code repositories— that via the web API return in seconds whether a number is "online" on the service; you just need to feed the tool with a list, and it processes thousands of attempts per minute.

With the verified data, criminals customize the deception. In Spain, variants such as the "troubled son" scam have flourished, where the attacker impersonates a relative asking for urgent money, or the involuntary transfer of the six-digit verification code that hijacks the account and then allows scamming the entire victim’s contact list. The success of these campaigns relies on seemingly trivial details: a profile picture, a real name, or the time at which someone usually connects provide enough context for the message to seem credible.

Cybersecurity in this context not only involves protecting the infrastructure but also writing more robust code and educating the user. Limiting the visibility of the number on public platforms, properly configuring privacy on WhatsApp, and avoiding sharing sensitive data via messaging are key practices. But at the corporate level, it is vital to implement solutions that detect and block anomalous traffic and behavior patterns, cutting off the attack before it wreaks havoc.

Experience shows that a poorly exposed phone number can open the door to financial fraud, identity theft, and malware distribution. Protecting that piece of information, no matter how insignificant it may seem, is today an essential part of digital hygiene for both individual users and companies that rely on WhatsApp to communicate with employees and clients.