Security teams usually model fraud at the payment layer or the email gateway. Messaging groups sit outside both. A large WhatsApp group is a broadcast channel with no content filtering by default, a shared directory of every member's phone number and an implicit trust signal: if a message appears inside a group you joined, it borrows the group's credibility.
Ivan Schroll's report reviews scam families that official sources associate with messaging groups and maps them to controls an administrator can actually operate. It covers employment and task scams, investment fraud, impersonation and fake offers, with attention to Pix payments in Brazil.
The scale is not hypothetical. In August 2025 Meta reported banning more than 6.8 million accounts linked to scam centres in the first half of that year. The WhatsApp Help Center acknowledges that a scammer may message you, call you or add you to a group.
The most instructive case described by Meta looks like a distributed workflow:
Meta notes that scammers move victims across platforms so that no single service observes the full scheme. For a defender, that means no single log source contains the incident. The group admin sees only the entry point.
The FBI's 2024 alert on task scams describes the same economics: confusing pay, a dashboard showing earnings that can never be withdrawn and, eventually, a demand for crypto payment to unlock more work.
| Scam pattern | Documented feature | Capability and limit |
|---|---|---|
| Phishing, fake shop or task links | Link moderation with an allow list and automatic removal | Removes links outside the list; cannot judge a link that is allowed |
| Repeated posting of one offer | Anti-spam and anti-flood | Caps volume; one well-crafted message may pass |
| Recurring offenders | Banned words, strikes, punishment ladder | Consistent consequences; spelling variants evade word lists |
| Scam accounts joining via shared link | Member approval with filters, daily limits, history | Slows entry and leaves a record; cannot verify intent |
| Incident awareness | Moderation history and community health analytics | Shows what was done; blind to private chats between members |
| "Is this offer real?" questions | Automatic replies and custom commands | Returns a standard safety notice; not fact-checking |
Read the right column carefully. Every control has a documented failure mode, and the paper does not oversell any of them.
These map well to rules: link policies catch the last item, approval filters reduce the second, and pinned notices handle the human side.
The admin cannot inspect private chats or other platforms, so the design goal is to make the group a poor first hop.
None of this stops a determined fraudster who moves the victim into private chat. It does remove the group as an amplifier, which is the part an administrator controls.
Source: Ivan Schroll (2026), Scams and Malicious Links in WhatsApp Groups: Employment, Investment and Impersonation Fraud, Pix Payments in Brazil and Administrator-Level Controls. DOI 10.17605/OSF.IO/CYP2G
Author: Ivan Schroll (ORCID 0009-0007-0680-5570)