Two men in Kingston lost control of their WhatsApp accounts in June 2026. Neither was warned by WhatsApp or by a bank. One found out because friends and relatives started calling, confused by messages he had never sent, according to the Jamaica Gleaner. By then the account had spent hours posing as him and asking his contacts for money.
Scams are constant. The failure here is that a hijacked account can work through someone's trusted network for hours, message after message, before any platform, bank or telecom notices. Detection tools that watch for account takeovers and unusual payment requests already run in other countries and could cut that window to minutes. Jamaica does not yet join them up, and this scam spreads in that gap.
In close to two decades of building AI capacity in the region, I have found Caribbean institutions generally good at responding to fraud once it is reported and weak at catching it while it is still moving. This case shows the difference clearly.
How the Kingston cases unfolded
The Gleaner's reporting, published on 25 and 26 June 2026 under the headline "WhatsApp Web of Deception," follows two victims: Victim A, in his forties, and Victim B, in his sixties. Criminals took over both accounts and used them to ask the victims' contacts for money. Victim B learned of the breach only when people who knew him called to ask about strange messages.
The method was the same each time:
- an ordinary, friendly greeting first, nothing to raise suspicion;
- then a request for money, in one documented case US$820 by Zelle, with a promise to repay the next day;
- refusal of every phone call, always "busy," because one voice call would have exposed the fraud.
One case was reported at the Cross Roads police station. Several divisional police commanders told the Gleaner they had heard of similar incidents beyond these two, which points to a pattern nobody has yet counted formally.
What JaCIRT has said, and what its advice leaves out
Godphrey Sterling, director of the Jamaica Cyber Incident Response Team (JaCIRT), told the Gleaner the agency would "do a deeper dive" into the pattern. He said JaCIRT had not seen a recent rise in formal reports, while divisional commanders were describing the opposite.
That mismatch between informal police reports and formal national figures is a data problem in itself. JaCIRT's public advice is sound: turn on two-step verification, never share a verification code, check the linked devices list in WhatsApp, and confirm any money request independently. But it relies on each person spotting a fraud mid-conversation with someone they trust, and it helps only after the attack has started.
The same trick is running across the region
The Bank of Jamaica reports an 890 percent rise in internet banking fraud since 2020, with losses above J$800 million, roughly US$5 million, by the end of 2023. Card theft accounts for 69 percent of fraud losses tracked by the central bank. Jamaica had about 3.06 million active mobile connections at the start of 2025, split almost entirely between Digicel and Flow.
Elsewhere the channel differs and the method is the same: borrow the trust of a familiar name.
- In Trinidad and Tobago, fake news articles on cloned newspaper layouts, using real reporters' names and photographs, promote bogus investment platforms.
- In Barbados, police issued an alert in May 2026 about SMS messages posing as a government traffic penalty notice.
- Business email compromise, where criminals pose as a supplier or executive to redirect a payment, averages more than US$39,000 per successful attempt worldwide.
- Small and medium enterprises make up an estimated 99.5 percent of Caribbean businesses, and most cannot afford a dedicated security function.
Why This Isn't Just a Jamaica Story
The WhatsApp hijack, the cloned news article, the fake traffic fine and the fraudulent payment request all use a familiar channel to get past the scrutiny a stranger would face. A detection system built to catch that in Kingston would work in Port of Spain or Bridgetown with minor adjustment, so the region can build it once and share it.
Why each institution misses it
A message from a known number, in a familiar tone, asking for something modest, does not set off the alarm a stranger's message would. Refusing a phone call is the giveaway, since a real money emergency rarely survives a thirty-second call, but the recipient is not looking for giveaways.
Each institution sees only its own slice. A bank watches transactions, a telecom watches its network, and a messaging platform watches for spam at scale, not for one hijacked account messaging a hundred people who trust it. None of them shares what it sees with the others, so a SIM anomaly, a burst of outgoing WhatsApp messages and a Zelle request never meet as one signal.
What detection would look like, and its limits
Commonwealth Bank of Australia runs an AI system that issues more than 40,000 proactive fraud warnings to customers a day, with a Live Threat Detection layer that looks for SMS forwarding, hidden background app launches and misuse of accessibility overlays, the technical signs of a takeover in progress. Mastercard survey data shows 42 percent of card issuers and 26 percent of acquirers saved more than US$5 million each in fraud losses over two years using AI-based detection.
For the Kingston pattern, three layers would help, each run by the party that can lawfully see the data:
- Telecoms: flag a SIM swap, a new device registration or an unusual verification-code request on a number, and warn the customer.
- Banks: score transfers for this pattern, a first-time payee, a request made through a personal channel and a hard-to-reverse method such as Zelle, and hold or call back on the risky ones.
- The recipient's own phone: WhatsApp messages are end-to-end encrypted, so no bank or telecom can read them. Scam-script detection has to run on the recipient's device, with their consent, or inside the platform itself.
I know of no Jamaican bank or telecom offering these checks to consumers today. The weak point in my own proposal is the messaging layer: only Meta can act inside WhatsApp, and Caribbean regulators have little influence over it.
What telecoms, banks and the region could build
Digicel and Flow carry nearly all of Jamaica's mobile connections, which puts them in the best position to spot a SIM swap or suspicious code request before a hijacked account sends its first message. Banks can tune transaction scoring to the pattern in this scam. The larger step is a CARICOM-wide shared database of scam signatures, pooling confirmed fraudulent payment destinations, account-takeover patterns and scam phrasing, so a scam identified in Kingston can be blocked in Bridgetown within hours. The Caribbean's AI and fintech sector has the people to build it.
What to do next
- Every WhatsApp user: turn on two-step verification today. In WhatsApp, go to Settings, then Account, then Two-step verification, set a six-digit PIN and add a recovery email. It takes two minutes.
- Anyone asked for money by a contact: call a number you already had. If the person will not take a call, treat the account as hijacked and warn the real owner by another route.
- Digicel and Flow: warn customers on SIM swaps and code requests. Send an SMS and in-app alert whenever a SIM is replaced or a WhatsApp code is requested by voice call, with a number to call if it was not them.
- Commercial banks: add a call-back rule for first-time payees. Hold transfers above a set amount to a new payee when the customer's recent pattern shows no link to them, and call the customer before release.
- JaCIRT and the Jamaica Constabulary Force: count cases in one place. Set up a single online form for reporting account hijacks, shared with divisional police, and publish monthly totals so the scale is known.
Frequently Asked Questions
How do criminals take over a WhatsApp account?
Most takeovers start with the six-digit registration code WhatsApp sends when someone sets up your number on a new phone. The attacker triggers that code and then tricks you into sharing it, often posing as a friend who sent it to you by mistake. Another route is to request the code by voice call when your phone is off, so it lands in a voicemail box protected by a default or weak PIN. Setting your own voicemail PIN and turning on two-step verification closes both routes.
What should I do if my WhatsApp account has been hijacked?
Reinstall or reopen WhatsApp on your phone and register your number again with the SMS code, which logs the attacker out. If the attacker has set their own two-step verification PIN, WhatsApp may make you wait up to seven days before you can re-register without it, so warn your contacts by other means at once. Report the account through the app's help menu, and file a report with the police.
Can banks or telecoms read my WhatsApp messages to detect scams?
No. WhatsApp messages are end-to-end encrypted, so neither your bank nor your mobile provider can see their content. Telecoms can see network events such as a SIM swap, and banks can see the payment you are asked to make. Any tool that checks message text for scam patterns has to run on your own phone with your permission, or be built by WhatsApp itself.
Can I get money back after sending it by Zelle to a scammer?
It is difficult. Zelle payments usually move within minutes and are treated as authorised by you, so contact your bank immediately and ask whether it can stop or recall the payment. Report the fraud to the bank in writing and keep screenshots of the conversation. The sooner you act, the better the slim chance that funds remain in the receiving account.
Where do I report a WhatsApp scam in Jamaica?
Report the crime to your local police station, as one Kingston victim did at Cross Roads, and keep the report number. You can also report the incident to JaCIRT, the Jamaica Cyber Incident Response Team, which tracks cyber incidents nationally. If money was sent, report it to your bank the same day. Reporting matters even for failed attempts, because official counts are how the pattern gets taken seriously.