Fake Customer Service Scam on WhatsApp: How to Protect Customers

Fake Customer Service Scam on WhatsApp: How to Protect Customers

To protect customers from the fake customer service scam on WhatsApp, a company has to make its official channel easy to recognize and say, before any problem happens, what it never asks for and never does by message. In practice this takes three efforts: consistent publication of official numbers and links, billing rules that are written down and repeated, and an AI agent with explicit prohibitions. No measure eliminates fraud, but each one lowers the chance that a customer trusts someone they should not.

Key takeaways

• The scam works because the customer has no clear reference to compare the fake message against. The company has to create that reference.
• Short, fixed billing rules (who bills, through which channel, with which payment method) are worth more than generic security warnings.
• The AI agent needs a list of prohibited requests: passwords, verification codes, full card details and payments outside the official flow.
• Standard warnings should appear at predictable moments in the customer journey: first conversation, billing messages and payment confirmation.
• Every channel needs a fast path for customers to report a suspicious message and for the company to act on it.

How does the fake customer service scam work?

The pattern is simple. The scammer learns that a person is a customer of a company, sometimes through a data leak, sometimes through a public post or a fake ad with a number that differs from the official one. Then they make contact pretending to be support, using the company name and the customer's name, and invent an urgent reason: an overdue bank slip (boleto), a stuck order, a refund that depends on a code, an account update.

The goal is usually one of three things: get the customer to pay into an account that does not belong to the company, obtain a verification code that lets the scammer take over the customer's WhatsApp or another service, or collect personal data for further fraud.

The key point for a company is this: the customer rarely can judge the message by its content, because it looks correct. What the customer can do is compare it with a rule they already know. If the company never said how it bills, any charge looks plausible. If the company said, clearly and repeatedly, that it never asks for a code by message, a request for a code becomes a warning sign.

AI agents in customer service change two things. First, customers start to expect fast, personalized replies, which also describes the scammer. Second, the agent itself can be manipulated by malicious messages if it has no limits, a topic OWASP covers in its list of risks for applications built on language models.

How does a customer recognize the official channel?

Recognizing the official channel cannot depend on attention or technical knowledge. It has to depend on a single reference that is easy to find and consistent across every touchpoint.

The measures below work together:

• An official page on the website with a simple title such as "Our official channels", listing the WhatsApp numbers, the website domain, the email addresses and the social media profiles. Any other contact does not belong to the company.
• The same number shown on the website, in email signatures, on invoices, on bank slips and on printed material. If the number changes, the change is announced in those same places.
• A complete WhatsApp business profile: company name, description, address, website and opening hours. When the company uses the official API and goes through Meta's verification, the profile can gain additional identification signals. The step-by-step guide to Meta Business Verification for the WhatsApp API covers the process. Even so, no badge should be presented to customers as an absolute guarantee.
• A single domain for links. If the company sends links, they should always point to the same domain, and the standard warning should say so.
• A clear rule about who starts the conversation. If the company only contacts customers with outbound messages in specific situations (order confirmation, delivery notice, appointment reminder), customers learn to be suspicious of contact outside that pattern.

On that last point, disorganized outbound messaging trains customers to accept unexpected contact, which helps the scammer. It is worth reviewing WhatsApp outbound messages, templates and opt-in to align what the company sends and when.

Which billing rules can customers actually remember?

Billing rules are the most effective defense against the fake bank slip or fake Pix scam (Pix is Brazil's instant payment system), because they give the customer an objective test. The condition is that there are few of them, they are written in plain language and they are true to how the operation really works.

One possible set, which each company should adapt to what it actually does:

• Billing is only sent through channels listed on the official channels page.
• WhatsApp support never changes the payment method agreed in the contract or the order.
• The destination account appears in the company's name. If the payee is an individual or a different company, the customer should not pay and should tell us.
• A duplicate bank slip or payment link is only generated inside the customer area or through a link on the official domain.
• There is no fee to release a refund, an order, a credit or a prize.
• Debt negotiation or time-limited discounts are never offered through a message from an unknown sender.

For this to work, the rule has to be true. If the finance team currently sends bank slips through three different channels and sometimes asks for a Pix payment to an alternative account, the company will be the one breaking its own rule, and the customer loses the reference. Before publishing any rule, align finance, sales and support on what is allowed.

Also avoid informal exceptions. Every "just this once" teaches the customer to accept what the scammer will ask for.

What should the AI agent never ask for or do?

An AI agent on WhatsApp is the voice of the company. If it asks for something a scammer would also ask for, the company is training customers to be fooled. That is why the prohibitions should be written, tested and enforced outside the instruction text, with output and action validation. The article on guardrails for AI agents explains how to separate what the model "should" do from what the system prevents.

Minimum list of what the agent must never ask for:

• Passwords of any kind, including the customer area password.
• Verification codes sent by SMS, WhatsApp, email or an authenticator app.
• Full card number, security code or a photo of the card.
• Photos of documents in free-form chat, unless there is a formal flow that is justified and covered by the privacy policy.
• Installing apps, remote access to the phone or screen sharing.
• Payment, deposit or "fee" to release anything.
• Confirmation of sensitive data the customer has not already provided in the conversation.

What the agent must also never do:

• Generate or change bank details for receiving payment. Those details come from a billing system, never from text generated by the model.
• Send links that do not come from an allowed domain list.
• Promise a refund, discount or negotiation without human approval.
• Follow instructions embedded in the customer's message that contradict company rules. This is known as prompt injection, and OWASP's guidance on prompt injection prevention describes defensive measures.
• Pretend to be human when asked.

One important note: a customer may mistakenly send a code or password to the legitimate agent. The agent should recognize the pattern, not store the content in its logs, tell the customer to change the credential and hand off to a human. This needs to be part of the flow design and the log retention policy, in line with what Brazil's data protection authority (ANPD) recommends on handling personal data.

Which standard warnings should you use, and where?

A warning works when it appears at the moment the customer makes a decision. Generic security notices in a website footer are rarely read. A short sentence inside the conversation, next to the charge, usually is.

Recommended moments:

• In the first message of a new conversation.
• Together with any bank slip, payment link or duplicate copy.
• In the payment confirmation.
• In the automatic reply outside business hours.
• In email signatures and on invoices.

Example wording, to adapt to your brand voice:

We are the company's official support. We never ask for a password, verification code or full card details by message.

This payment link belongs to the company's official domain. If the payee does not appear under the company's name, do not pay and contact us.

Received a suspicious message in the company's name? Send a screenshot to the reporting channel listed on the official channels page.

Three precautions prevent fatigue. First, do not repeat the long warning in every message, because customers will start ignoring it. Second, keep the wording identical so it becomes a recognizable mark. Third, review the text whenever the billing operation changes. To tune how the agent handles incoming and outgoing messages, the guide on how to write instructions for an AI support agent can be a starting point.

How do you roll this out, step by step?

The working method we follow is map, limit, pilot and hand over. Applied to this topic, it looks like this.

Map: list every point where the customer receives something from the company. WhatsApp numbers, emails, links, bank slips, charges, reminders. Note who sends each one, in which situation and from which system. This map usually reveals forgotten numbers, duplicated channels and informal exceptions.

Limit: reduce what the company and the agent can ask for or do. Define the list of prohibited requests, the list of allowed domains, the single source of billing data and the cases in which the agent hands off to a human.

Pilot: choose one real flow, for example sending a duplicate bank slip, and run it with the standard warning, a decision log and an agreed metric, such as the number of customer contacts asking whether a message is genuine or the time taken to handle a report. Do not invent a target before you have a baseline.

Hand over: give the flow to the team with documentation, owners and a criterion for expanding, adjusting or stopping.

A stepwise plan:

• Bring finance, support, sales and IT together to define the official channel list and the billing rules.
• Publish the official channels page and update the website, signatures, bank slips and WhatsApp business profile.
• Write the standard warnings and decide where they enter the journey.
• Configure the agent with the prohibitions, the domain list and the routing to a human. If the WhatsApp integration is still being designed, the material on how to integrate AI into your company's WhatsApp helps organize the architecture.
• Test with messages that simulate scammers: requests for codes, attempts to change the payment account, instructions hidden in the customer's text.
• Start the pilot on one flow, logging every decision the agent makes.
• Review the logs, adjust, and only then expand to other flows.
• Define who responds when a customer reports a scam, and how quickly the company commits to reply, without promising deadlines the team cannot meet.

What should you do after a scam attempt?

Even with everything in place, someone will fall for it or be targeted. Having a procedure avoids improvisation and protects the customer.

Illustrative scenario: a customer receives a message from an unknown number using the company name and their own name, saying the order is stuck and a small fee must be paid by Pix. They are suspicious because they remember the notice "there is no fee to release an order" from their purchase confirmation. Instead of paying, they look for the official channels page, send a screenshot to the reporting channel and get a reply from a human agent, who confirms the message is fake, logs the number and advises the customer to block and report the contact in WhatsApp. What prevented the damage was the clear rule, the accessible reference and the reporting path, not sophisticated technology.

Procedure for the company:

• Support the customer without blaming them and confirm the message did not come from the company.
• If a payment was made, advise the customer to contact their bank or payment provider immediately and file a police report. The company can help with the information it has, within the limits of LGPD, Brazil's data protection law.
• Record the number, the text, the time and the channel through which the scammer reached the customer.
• Investigate whether there was a leak: did a system, partner or spreadsheet expose customer data?
• Warn other customers when there is a pattern, using the official channel and the standard warning.
• Review the rules and the agent's behavior based on what the scam exploited.
• If the incident involves personal data, consult legal counsel and check the ANPD guidance on reporting security incidents.

To keep the official number healthy during the process, it is also worth reading about how to avoid a WhatsApp number ban when using an AI agent, since reports and poorly configured sends affect the channel's reputation.

Frequently asked questions

Is the WhatsApp verification badge enough for customers to trust a number? It should not be the only reference. The badge or other identification signals help, but customers need a simple rule and an official page to check the number against. A complete profile, a channels page and standard warnings together are more robust than any single signal.

Can the AI agent send bank slips and payment links? Yes, as long as the billing data comes from a reliable system and not from text generated by the model, and the links belong to an allowed domain list. Changes of account or payment method should go through human approval. Every send should be logged.

Is the company liable if a scammer uses its name? Liability depends on the specific case, on what the company did to protect data and inform customers, and on whether there was a leak. A general answer is not possible here, so the recommendation is to consult a lawyer and document the measures taken. Acting quickly, recording everything and communicating clearly helps in any scenario.

Do we need to warn the customer in every message? No. Too many warnings become noise. Use them at decision moments such as billing, first conversation and payment confirmation, with short text that is always the same, and keep the official channels page as a permanent reference.

Sources

• OWASP: prevenção de prompt injection
• OWASP Top 10 para aplicações com LLM
• ANPD: Autoridade Nacional de Proteção de Dados