CYBCybersecurity

Affection phishing: when the bait plays on love and reaches the office

A child says their phone is broken, a colleague asks for a code, the owner writes from a new number. These scams play on affection and the wish to help, and simple rules stop them at work too.

Strategic editorial team 6 March 2026 8 min read

Cover: “Phishing that uses affection instead of fear”, Cybersecurity

Affection phishing is a scam that plays on love or trust rather than fear. It might be a child with a broken phone, a colleague in trouble or an acquaintance asking a small favour. It works because the person who receives the message wants to help. It almost always arrives on WhatsApp or by text message, far from the company’s email filters. Businesses are exposed too, because the same phones are used for work and because a stolen account is then used to write to customers and suppliers. The defence is a simple rule turned into a procedure. Before you pay, send a code or change any details, you check through a channel you already know, never through the one the request came from.

From fear to affection

Classic phishing frightens people. “Your account has been blocked.” “This invoice is unpaid.” “Your parcel is held at customs.” It still works, but it is now well understood. Spam filters often catch it, and many people have learnt to spot it. So the fraudsters have changed their tone.

A typical scenario. It is Friday evening. A company’s finance manager receives a message from an unknown number. “Hi Mum, I’ve dropped my phone and this is my new number. Save it and message me here” (our translation). It is the wording the Polizia Postale, the Italian State Police’s cybercrime unit, has described in its warnings. The request follows soon after. An urgent payment is needed, because the new phone has to be paid for at once and the card is blocked. She calls her son on the number saved in her contacts. He answers from a pizzeria, on his own phone, which works perfectly. For that evening, the story ends there.

On Monday morning a real contact writes to the same phone. It is a colleague from another site. “Sorry, I sent you a six-digit code by mistake. Could you forward it to me?” The name is right, and so is the photo. But his account has already been stolen, and the code is what the thief needs to steal hers too. If she forwards it, whoever asked for it takes over her WhatsApp and writes to everyone in her contacts, from suppliers and customers to colleagues. This is the scheme described by the police headquarters in Aosta (Questura di Aosta) in a warning issued in October 2025.

How does affection phishing work?

It almost always works in three stages.

The approach. A new number claims to belong to a loved one. Alternatively, the message comes from the real account of someone you know, which is already in the fraudsters’ hands.
The hook. The message combines urgency and secrecy with an affectionate tone, such as “don’t tell anyone” or “I can’t talk, just message me”.
The request. It asks for a bank transfer, a top-up, a verification code or online banking login details.

Compared with classic phishing, the elements that filters look for are missing. There is no link, no attachment and often no spelling mistake. And the message arrives on a messaging app, which the company’s email system cannot see. At the end of August 2026 Italy’s State Police (Polizia di Stato) reported thefts of WhatsApp accounts made possible, among other things, by out-of-date versions of the phone’s operating system and of the app. The stolen accounts were then used to ask contacts for money with fake emergencies.

Why does it hit businesses too?

The same phone serves family and work alike. It holds the contacts, the chats with customers and the team groups.
The “new number” may claim to be the owner’s or a senior manager’s, with a message such as “I’m in a meeting, I can’t talk, I need a favour”.
The colleague who asks for a code exploits the wish to help, not fear. It is the request people agree to with the least suspicion.
A stolen account becomes a megaphone. Messages go out to customers and suppliers with the right name and photo, and the reputational damage falls on the company.
The most exposed roles are those that can pay, release or authorise. They include accounts staff, treasury, executive assistants and salespeople with many contacts.

Which warning signs should make you stop?

A new number, together with a claim that the sender cannot talk on the phone
Urgency combined with secrecy
A request for a code received by text message, for any reason
Bank details that differ from usual, or a payment outside the normal procedures
An affectionate or familiar tone that is unusual for that person
An invitation to move to another app or another number

The bank provides one more signal. Since 9 October 2025, under Regulation (EU) 2024/886 on instant payments, banks in EU countries that use the euro must offer a check that matches the IBAN against the payee’s name before every transfer. This check is known as Verification of Payee. A mismatch warning is a reason to stop, not a detail to click past. The regulation covers banks in the euro area. If your account is with a San Marino bank, ask your bank whether the check is available and how it works.

How do you turn “call the number you know” into a procedure?

At home the rule is instinctive. You call the number you know, not the one the message came from. At work it has to be written down, so that people apply it even under pressure.

Situation	What to do	Who decides
A colleague or manager writes from a new number	Call the number held in the company directory, not the one in the message	The recipient, without asking for permission
Someone asks for a verification code	Do not send it, to anyone, for any reason	A rule with no exceptions
A supplier announces new bank details	Confirm by phone with the contact already on file. A second person approves the change	Accounts department
An urgent payment request arrives outside the normal procedures	Put it on hold and send it through the formal process	Finance manager
An account used for work seems to have been stolen	Alert IT and the contacts at once, through another channel	IT and communications

The rule holds only if it also applies to the people at the top. A request from the owner goes through the same check as any other, and whoever does the checking is simply doing their job.

To share with staff. First, a new number is checked by calling the old one. Second, codes received by text message are never forwarded to anyone. Third, bank details never change because of a message.

How do you protect a WhatsApp account used for work?

Turn on two-step verification (Settings, then Account, then Two-step verification), with a PIN and a recovery email address.
Check “Linked devices” regularly and log out any device you do not recognise.
Never forward codes received by text message.
Keep the phone and the app up to date.
For company numbers, decide who manages them and how they are recovered if lost.

What if the transfer has already gone?

Call your bank at once and ask it to try to recall the transfer. Recovery is never certain, especially for instant transfers, and the odds fall with every hour.
Contact the Polizia Postale and make a formal criminal complaint (denuncia). Its portal, commissariatodips.it, also accepts reports.
Keep the evidence, including screenshots of the chat, the number, the times and the receipts.
If an account has been stolen, recover it, warn your contacts through another channel and check the linked devices.
If company data or systems are involved, start the incident procedure. The rules for the first hours apply here too.

In brief

Affection phishing replaces fear with affection and the wish to help.
It arrives on messaging apps, without links or attachments, so email filters cannot see it.
At work it targets the people who can pay or authorise, and a stolen account becomes a megaphone aimed at customers and suppliers.
The defence is to check through a channel you already know, and to make that a written procedure that applies to everyone, leadership included.
Verification codes are never forwarded. Two-step verification protects the account even if someone makes a mistake.
If the money has gone, hours count. Call the bank, report it to the police, keep the evidence and warn your contacts.

Frequently asked questions

Why don’t spam filters stop these messages?

Because they arrive on messaging apps, often on personal phones, and contain no links or attachments to analyse. The only reliable check happens outside the conversation, through a channel you already know.

Why does the scammer want the six-digit WhatsApp code?

The code lets them register the victim’s number on another phone and take over the account and its contacts. That is why it must never be forwarded to anyone, not even a trusted contact. Two-step verification adds a PIN that protects the account even if you make a mistake.

Is it right to run an affection-phishing simulation on staff?

Yes, provided the simulation is designed with HR and, where needed, with the data protection officer. It must stay out of people’s private lives, and its purpose is learning, not finding someone to blame. It is best to read the results by department, not by name.

What should you tell your contacts if the account has been stolen?

Send a short message through another channel. Say that the account has been compromised and that any requests for money or codes received in the last few hours are fake. Anyone in doubt should call the number they already know.

Verification rules work when they are written down, known and practised. The training and simulations for staff and leadership run by our Cybersecurity division start from scenarios like these. They come with procedures for changes of bank details and for compromised accounts. The story of the barista explains why a hacked mailbox weighs on the whole company. The one about the fax explains why many fake senders can be stopped at the door.

Sources

Consulted on 16 September 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.