When an acquaintance texts on Messenger asking for a phone number under the pretext of a locked device, it marks the opening maneuver of an account takeover attack. Cybermalveillance.gouv.fr warned on October 27, 2026, that third-party demands for account parameters signal critical threats.
The Mechanics of the Locked Phone Ploy
The messaging sequence arrives from a compromised account belonging to someone the recipient trusts. A radio station reported an example on October 28, 2026, detailing how a staff member received a message asking for an urgent phone number because a customer service department required a PIN code to be sent to a separate device. No external links appear in the chat. Instead, the scammer solicits the victim’s phone number followed immediately by any verification code that arrives on their device.
The prompt claims the phone is locked and customer service requires a PIN on another line. In reality, the account of the friend belongs to an operator who initiated a password reset or device registration. The code arrives on the victim’s phone because the system generated it for that specific number. Handing over that code surrenders the keys to a Facebook or WhatsApp account, or authorizes a financial transaction.
| What the Message Claims | The Actual Mechanism |
|---|---|
| “My phone is locked” | The friend’s account is controlled by an unauthorized actor. |
| “Customer service needs my PIN on another phone” | The verification code routes to your device because it targets your number. |
| Requests the received code | Grants access to your Facebook, WhatsApp, or payment systems. |
Account Hijacking and Financial Authorization Risks
The incoming verification code serves distinct malicious objectives depending on the targeted platform. For WhatsApp attacks, the sequence typically authorizes the addition of a new device to the victim’s account, giving the operator direct access. Consequences include impersonation, propagation of the same scam to the victim’s contacts, extortion attempts, exposure of private media, and permanent lockout from the original profile.
Codes can also validate direct financial charges. Early October reporting documented fraudulent delivery runners extracting SMS codes that ultimately authorized purchases billed directly to a mobile phone subscription. Similar methods mirror deceptive delivery texts where an external actor tracks user inputs in real time.
Verifying Contacts and Securing Compromised Profiles
Defending against the tactic requires ignoring numbers provided within the chat thread. Users should respond by stating an outbound call is underway, then dial the contact using a pre-existing, verified phone number. If the contact answers and knows nothing of the message, their account is compromised. Cybermalveillance.gouv.fr designates any third-party attempt to access account configurations as a major warning indicator. Similar tactics occur via voice calls, where fraudulent advisors dictate codes that divert incoming calls directly to the operator.
Remediation requires immediate action if a code has already been disclosed. Users must open account settings, review connected devices, and purge any unrecognized hardware. Recovery steps continue with verifying telephone numbers, backup email addresses, two-step verification setups, and passwords. Changing the primary password for Facebook and any accounts sharing identical credentials prevents cascading compromises. Victims should alert contacts via alternative channels such as traditional SMS or voice calls before the operator utilizes the compromised messaging thread. Formal complaints can be filed with local law enforcement using screenshots of the suspicious messages and unrecognized devices captured prior to deletion.
Enabling two-step verification on WhatsApp and two-factor authentication on Facebook blocks simple SMS intercepts by introducing an independent second secret. WhatsApp implements this through a distinct numeric PIN. Mobile subscribers changing carriers should retain their identifier using the RIO portability code to prevent losing access to tied messaging ecosystems.
