A friend asked me to vote for a young dancer. Why was my WhatsApp stolen?

The message comes from somebody you know. Your sister-in-law, a colleague, your coach. It says their niece has made the final of a dance competition, that a vote is needed, that it closes tonight. There is a photo of a little girl too. You tap the link, because it is your sister-in-law.

The site looks like a voting portal: two finalists, the photos, a vote count ticking over, a reference to a dance school. You pick your candidate. And at that point the site asks for your phone number, and then for a code that arrives on your phone.

That is where the voting ends and the theft begins.

Why it comes from a real person

This is the first thing to understand, because it is also the reason it works so well: your sister-in-law did not write to you at all.

Her account has already been taken, before yours. Whoever controls it has opened her address book and sent the same message to everybody in it. CERT-AGID, the incident response centre for Italian public administration, puts it flatly in its analysis of 6 October 2026: the message arrives from an already known contact whose account has been compromised earlier, and that is what makes the request credible. The Polizia Postale, the Italian cyber police, said it from the reader’s side in its notice of 10 October: a message coming from a known contact is not enough to treat it as safe.

It is a chain. Every stolen account becomes the trusted sender for the next address book.

On the second half of the mechanism, that is, why a request for a vote works better than an alarm, I have an idea of my own: asking for a small, free favour puts nobody on guard, while a security warning makes defences go up. But that is my opinion and I declare it as such. I have not found any study measuring that difference, and I would rather tell you so than pass it off as a research finding.

Two variants, and it changes everything

Here is something that should be told rather than hidden, because in Italy in October 2026 two institutional sources describe two technically opposite outcomes, four days apart.

CERT-AGID, 6 October: the code serves to authorise the linking of a device controlled by the attackers, the victim’s phone can go on working normally, and that makes the compromise less obvious.

The Polizia Postale, 10 October: the code lets the criminals complete the WhatsApp registration procedure on another device, and the victim may lose access to their own account.

There is no contradiction to be resolved here: they are two real variants of the same bait, with different consequences for you.

First variant, registration. Whoever has the 6-digit code registers your account on their own phone. WhatsApp’s documentation says that when the account is registered again, every device that had signed in is automatically disconnected: so your app stops working and you notice at once. There is a piece of good news inside the bad, though: the same page says that whoever registers your account on a new device cannot read your earlier conversations, because the messages sit on your phone.

Second variant, the linked device. Here your phone stays yours and goes on working. Alongside it, though, a device belonging to the attacker is hooked to your account, reading conversations as they come in and writing in your name. There is no obvious sign of it. According to the documentation a linked device stays active for up to thirty days of inactivity, and gets disconnected if the main phone is not used for more than fourteen days. Let me say straight away that those two numbers sit on the same official page and do not match: this is not me getting confused, it is an inconsistency in the documentation.

The detail that takes the scam apart

If you remember one thing from this article, remember this one.

When a device is linked legitimately, the code travels in a particular direction. You go to WhatsApp Web or to the Windows app, and the eight-character code appears on the screen of the device you want to link. Then you type it on the main phone. The phone shows you the name and location of the device about to be linked and asks you to confirm, and it usually asks for your fingerprint or unlock PIN as well. The code does not arrive by text message and it is never entered on a website.

The scam reverses that direction. It gets you to enter a code on a web page, or it asks you to pass on a code you have received. In both cases you are doing the thing that never happens in normal operation.

From that you get a rule that does not require you to be able to spot a fake site: no WhatsApp code is ever typed into a web page, and no code is ever passed to anyone. Whichever variant it is, whatever the site looks like.

If it has already happened

Time matters, so the order is this one and not another.

1. Take the account back before doing anything else. Open WhatsApp, tap "Accedi di nuovo" (the interface is in Italian: this is the option to sign in again), confirm, enter your number in international format and then the 6-digit code that arrives by text message or call. The documentation is explicit on a point that sounds counterintuitive: whether or not you know the two-step verification PIN, anyone using your account will be automatically disconnected once you have entered that code.
2. Do not report the account before you have recovered it. WhatsApp puts it in black and white: if you report the compromised account you are trying to recover, it could be suspended for breach of the terms of service and you could lose access or data. Recover first, report after.
3. Check the linked devices and unhook anything you do not recognise. According to the documentation the route on iPhone is WhatsApp's Impostazioni (settings), or the profile picture, then "Dispositivi collegati" (linked devices), then the device, then "Disconnetti" (log out). On Android you start from the menu at the top right and arrive at "Dispositivi collegati". An honest warning: the two official Italian pages call that button two different things, "DISCONNETTI" on one and "Esci" on the other, and I was not able to try the sequence on a phone. These are the instructions from the documentation, not a check in the field, and the labels change between versions of the app.
4. Turn on two-step verification, if you do not have it. It makes re-registration harder: anyone wanting to move your account has to have that code too, and without it they have to wait seven days. Every Italian institutional source recommends it.
5. Warn your contacts, and do it with a phone call to the ones most exposed. Not with a WhatsApp message, which might be going out from an account you do not control yet.
6. Check the archived chats too. CERT-AGID has documented that the fraudulent messages can go out from archived or little-used conversations, the ones you never look at, which is why the victim does not notice.

Two things two-step verification does not do, and they are the opposite of what you often read. The first: it does not throw out somebody who is already inside. The support page says it clearly, and it is worth reading twice: passwords, two-step verification and other security features are designed to protect an account you still have access to; if another person has taken control of it, the only way to remove them is to register the account again with the 6-digit code. The second: I have not found it documented that two-step verification prevents a new device being linked. The official linking flow asks for the main phone and the biometrics or screen unlock PIN, not that code. It is still worth turning on, but it is right to know what it covers and what it does not.

If the attacker turned on two-step verification themselves while they were inside, the most annoying thing of all happens: you have to wait seven days and try again. WhatsApp states this as the procedure, and adds a sentence that works as a general warning: it cannot give any information about who signed into the account, nor when, nor from where.

The defences that exist, and what they are worth

Some of it WhatsApp does by itself. Since 2023 there has been a feature that can ask for confirmation from the old device when somebody tries to move an account to a new one, and the same page announces automatic server-side checks against malware on the phone. In the linking flow, if the system detects a device it does not recognise it asks for an explicit confirmation, with the options “Non collegare” (do not link) and “Collega dispositivo” (link device). And there is a notification when somebody tries to register an account with your number.

In August 2026 WhatsApp announced passkeys: signing in with a fingerprint, a face or an unlock code, and two-step verification moving from the 6-digit code to a longer password. Here I have to stop and say that I do not know: the documentation describes the passkey as a faster way of signing in, not as a block on re-registration by text message or on a device being linked. I have not found any source saying a passkey stops this scam, and I have not found any source saying the opposite. So I am not selling it to you as the solution.

A word on the name. There is no official name for this scam: the Polizia Postale called it “vota ballerina” in January, “voto alla ballerina” in February, and in October speaks only of fake online competitions. CERT-AGID says “truffa della ballerina”. The term “ghost pairing” that you read in some articles does not come from any authority or from WhatsApp: it is a journalists’ coinage. And the bait changes: the documented variants include competitions for dogs, school events, generic contests. The dance competition is not the scam’s signature, it is just the version that caught on best.

To understand what sits underneath

Two-step verification comes back in nearly all of these cases and it helps to know what it actually does: I wrote about it in Two-step verification: what it is and how to turn it on in Gmail, in 5 minutes, and in Two-factor authentication: SMS, app or hardware key? Which one to choose there are the differences between text messages, apps and hardware keys. The general mechanism of messages that look as if they come from somebody you know is in Phishing: what it really is, where it reaches you, and why careful people still fall for it.