Paraguay warns of WhatsApp theft via voicemail

Update November 3, 2026: MITIC clarified that one of the detected methods uses voicemail to obtain verification codes and transfer control of the account. The Municipality of Asuncion also said its Citizen Service WhatsApp account was hacked and asked people not to reply to messages or open links sent from that number.

In Paraguay, authorities reported attempts to take over WhatsApp accounts affecting entrepreneurs, businesses, content creators and the Basilica of Caacupé. The scheme is designed to seize profiles, impersonate the owner and then try to scam their contacts. The warning also flagged risks linked to parallel apps and artificial intelligence tools associated with WhatsApp, especially on business accounts.

Who was affected by the takeover attempt?

The reported targets were entrepreneurs, businesses, content creators and the Basilica of Caacupé, according to the report circulated in Paraguay. The scope suggests this was not an isolated case or one limited to a single type of account, but rather a series of attempts aimed at different profiles that rely heavily on messaging.

Local coverage also pointed to mass hacks of WhatsApp Business accounts, according to ABC Color, and to warnings about strengthening defenses against account theft, according to Oviedo Press. Separate notes from El Paraguayo Independiente offered advice for people who receive codes they did not request, while RDN published a guide on account recovery and fraud prevention.

What risk was flagged for business accounts?

The focus was on business accounts and the use of parallel apps and artificial intelligence tools tied to WhatsApp. The source made clear that the use of AI alone does not prove an account was compromised, so that signal is not enough to confirm a breach.

That distinction matters because it avoids confusing a feature or integration with an intrusion. Based on the available material, the warning is to pay close attention to non-official environments and any unusual behavior on accounts used to sell, support customers or share updates.

What is known about the method?

The scheme aims to take over the account, impersonate the victim and potentially scam the victim’s contacts. The material does not name a specific group or confirm a single attack technique, but it does center on account control and the later use of the stolen access.

The related reporting also points to signs that often raise suspicion, such as receiving codes a user never requested. In the WhatsApp ecosystem, that kind of alert is usually an indicator of a takeover attempt, although the material provided does not add further technical details about the attack chain.

How does voicemail theft work?

MITIC warned that one of the observed techniques uses voicemail to capture WhatsApp’s numeric verification code and transfer the account to another device. According to coverage from Última Hora, attackers request a verification call and then remotely access the voicemail to listen for or retrieve the code.

The official warning was also shared on MITIC’s X account, where it recommended changing the default voicemail password or asking the carrier to disable voicemail if it is not used. In parallel, one specialist cited in Paraguay linked this type of account takeover to SIM swapping, a technique associated with the duplication or fraudulent takeover of phone lines used for WhatsApp.

What happened to Asuncion’s municipal account?

The Municipality of Asuncion said its Citizen Service WhatsApp account was hacked and asked people not to reply to messages or open links sent from the number ending in 777. The notice was meant to curb misuse of that line while the incident was being contained.

That case added to alerts issued by local agencies and media outlets about account theft through voicemail and other takeover methods. Coverage also noted that users and account administrators should pay attention to code requests, verification calls and access to phone lines, although the material does not attribute these incidents to a single group or provide a consolidated count of those affected.