TL;DR: Which? warned in late September 2026 about calls from “Amazon” saying an unauthorised iPhone order was stopped on your account. To “verify” you, they ask you to read out a code sent to your phone. That code is actually WhatsApp’s login code, and reading it out hands them your WhatsApp account, which they then use to ask your contacts for money. Amazon never needs a code you received by text read back over the phone.
How the call goes
The Which? scam alert describes it simply: callers say an unauthorised order for an iPhone 15 was stopped, and ask you to read out a code to verify your account. The relief of “we stopped it” lowers your guard. Then a text arrives with a six-digit code, and it feels natural to read it out.
What is happening behind the scenes: the scammer is trying to register *your* phone number on WhatsApp on *their* phone. WhatsApp sends the verification code to you. If you read it out, they’re in.
Why they want WhatsApp, not Amazon
Your WhatsApp is worth more than a stolen order. Once they control it, they message your family and friends as you: a classic version of the “hi mum” or guess-who scam. People pay because the message comes from a name they trust. They can also see group chats and set their own two-step PIN to lock you out.
Signs it’s a scam
- Someone calls you out of the blue about an order you never placed.
- You’re asked to read out a code from a text.
- The text mentions WhatsApp, or says “Don’t share this code with anyone” while the caller asks you to share it.
- There’s urgency: “we need to confirm in the next two minutes.”
What to do
- Hang up. Check your orders in the Amazon app yourself. If there’s an order you didn’t make, you’ll see it.
- Never read out a code. No genuine company needs a code sent to you to be read back.
- Turn on WhatsApp two-step verification: Settings, Account, Two-step verification. Add a PIN and an email. This stops a stolen SMS code being enough on its own.
- Report the call by texting “call” followed by the scammer’s number to 7726 (on Android, text “call” and follow the prompts), per Which?.
If you already read out the code
Act fast. Reinstall WhatsApp, re-verify your number to kick them out, then turn on two-step verification. Warn your contacts by text or another app that your WhatsApp was taken. Our guide on recovering a hacked WhatsApp walks through it. If anyone paid money to the scammer, they should call their bank or 159 straight away.
How did they get your number?
Mostly from leaked data. Phone numbers, names and email addresses from old breaches are traded freely. Check whether your email has been in a breach with a free email exposure check, and read where phone numbers get exposed.
Frequently Asked Questions
Does Amazon call about unauthorised orders?
Treat unexpected calls about orders as suspicious. Hang up and check your orders in the Amazon app yourself.
What code are the scammers asking for?
Usually a WhatsApp verification code, sent because they are trying to register your number on their phone.
How do I protect my WhatsApp?
Turn on two-step verification in Settings, Account, and never share any code sent to you.
How do I report a scam call in the UK?
Text "call" followed by the number to 7726, and report losses to Report Fraud.
Sources
- Which?: The latest scam alerts (Amazon scam calls, Sept 28, 2026)
- WhatsApp Help Center: About two-step verification