Costa Rica’s Judicial Investigation Agency is warning residents to be careful with a new wave of WhatsApp scams that begins with something simple: a six-digit verification code. The tactic has become part of a broader fraud problem in the country. Costa Rica recorded 25,498 fraud complaints between January 1, 2025, and March 30, 2026, with scams continuing to rank among the most common property crimes tracked by the OIJ.
The agency’s criminal analysis unit has warned that these crimes keep changing as criminals adapt to digital tools and messaging apps.In the latest version, scammers impersonate a friend, relative, company, delivery service, or trusted contact. The victim receives a message saying a verification code was sent by mistake and is asked to share it. The code is not harmless. It can allow the attacker to take control of the victim’s WhatsApp account within minutes.
Once inside, the scammer can use the account to contact family, friends, coworkers, or clients. Since the message appears to come from a known person, the next victim may be more likely to trust it. In many cases, the scammer asks for an urgent SINPE Móvil transfer, often claiming an emergency, a temporary banking problem, or some other need for quick help.
Cybersecurity specialists describe this kind of account takeover as Ghost Pairing. The attacker links the victim’s WhatsApp account to another device after getting the verification code. From there, the scam can spread quickly through the victim’s contact list.
Other versions of the scam remain active in Costa Rica. Some messages say, “I changed my number, this is my new contact.” Others claim a package has been retained, offer fake jobs, promise prizes, or send links designed to steal personal or financial information. The common thread is urgency. The scammer wants the victim to act before checking.
The OIJ has also warned about scams involving hacked WhatsApp accounts used to offer U.S. dollars at unusually low exchange rates. In that variation, criminals send messages from a compromised account offering dollars at a discount, then ask the victim to deposit colones into a bank account. Once the money is transferred, the promised dollars never arrive.
Authorities are urging users not to share WhatsApp verification codes under any circumstances. WhatsApp also states that users should never share their registration code or two-step verification PIN with anyone and recommends enabling two-step verification to add another layer of protection.
The safest response to any unusual request for money is to verify it through a separate channel. Call the person directly, send a separate message through another app, or speak to them in person before making a transfer. A WhatsApp message from a familiar name is no longer enough proof that the person is really behind the request.
Residents who believe they have been targeted should save screenshots, messages, phone numbers, bank details, and any other evidence before filing a report. Costa Rica’s Ministry of Science, Innovation, Technology and Telecommunications lists the OIJ’s Office for Receiving Complaints as the official point of contact for reporting fraud, digital scams, and other crimes. The office operates 24 hours a day, with contact channels including 2295-3643, WhatsApp at +506 8800-0645, and the confidential OIJ line at 800-8000-645.
For WhatsApp users here in Costa Rica, make sure to never share a verification code, question urgent money requests, and turn on two-step verification before a scammer tries to take over the account.
