The Government of Cantabria warned on 24 October 2026 of a wave of scams on WhatsApp disguised as a vote for a supposed children’s dance competition. According to the Directorate for Trade and Consumer Affairs the attack begins with a message that appears to come from someone the recipient knows and asks them to vote for “a girl in the competition”. The link asks for a phone number and a code, presented as confirmation. In fact, the code authorises an outside device to be linked to the victim’s WhatsApp session, allowing the account to be taken over.
The warning from Cantabria is consistent with advice from the national cybersecurity institute INCIBE and notices from the Policía Nacional dated 21 and 22 October 2026. The scam has reportedly been detected in several regions of Spain. Once compromised, accounts automatically send the deceptive message to more contacts in an effort to link additional devices, demand money or download malicious content. Experts stress that the purported “voting code” is not for voting, but authorises linked devices.
The authorities offer consistent advice: do not open suspicious links or share any codes or login details; verify unusual requests through a second channel; and check the “Linked devices” list in WhatsApp settings. They also recommend enabling Two-step verification , keeping operating systems and apps up to date, using strong, unique passwords and saving evidence such as screenshots, message text and web addresses.
Victims should inform their contacts outside WhatsApp, immediately disconnect unauthorised sessions and report the incident. INCIBE provides a free 017 helpline . The authorities cite the method of distribution, the dates of the current warnings and the recommended countermeasures as confirmed facts. Possible financial losses or misuse of data are identified as risks that must be assessed on a case-by-case basis.
The latest notice from the Gobierno de Cantabria is part of a series of nationwide warnings about social engineering tricks that exploit trust between contacts. The case shows that attackers are increasingly abusing legitimate service features — here, the linking of devices — to gain access without visible malware. Anyone who receives such a request or has already shared a supposed voting code should act immediately and follow the recommended steps.
Editor: Mira Cadena (Article created with AI assistance).