'Hi Mum' WhatsApp Scam — Why That New Number Is Not Your Child
The 'Hi Mum' WhatsApp scam: how scammers impersonate your child from an unknown number and beg for emergency money. Warning signs + reporting steps in India.
How the scam actually works
- Scammers scrape Facebook, Instagram and LinkedIn to figure out family relationships.
- They message the parent (or aunt/uncle) from a fresh number, claim it's the child's 'new number', and delete/change their WhatsApp profile pic to something generic to avoid mismatch.
- They fabricate an emergency — broken phone, stuck in traffic, exam fee, hospital deposit.
- They ask for money to a UPI ID (usually a mule account) with pressure to send fast and not call.
Red flags — what to look for
- Any 'new number' message that immediately asks for money — real family members don't ask this way.
- Refusal to take a voice or video call. 'Phone speaker is broken', 'I'm in a meeting'.
- UPI ID doesn't match the person's real name (usually random syllables + @paytm or @okaxis).
- Bad grammar or word choices that don't sound like your child. Scammers often work in bulk across languages.
How to report in India
- Call your child on their known number to confirm. Don't reply on WhatsApp until you've talked.
- If money was sent: call 1930 within 24 hours and file on cybercrime.gov.in with the UPI ID and screenshots.
- Report the WhatsApp number inside the app: tap the number → Report contact → 'Block and report'.
- Tell family and friends — this scam works because it spreads through one family before the number is blocked.
How to protect yourself going forward
Prevention is boring but works. Enable UPI transaction alerts on SMS + email (both, not just one). Set a daily UPI cap of ₹10,000 unless you actively need more — you can raise it back in 30 seconds when required. Add a separate low-balance current account for online payments and keep the salary account off UPI entirely. Lock your Aadhaar biometric at resident.uidai.gov.in — that alone stops most eKYC-based downstream fraud even if your OTP is leaked. Finally, tell one family member every time you get a suspicious message. Fraud thrives on isolation.
What actually helps recovery
Time. The single strongest recovery factor is reporting to 1930 within the first hour. RBI's Turnaround-Time framework requires banks to freeze beneficiary accounts within specific windows and the 1930 number is plugged directly into that flow. After 24 hours, freeze probability drops sharply. After 72 hours, recovery is rare. Screenshot everything: the SMS, the caller number, the UPI ID, and the debit alerts. All of these become evidence on cybercrime.gov.in.
Frequently asked questions
How do scammers know I'm the parent?
Public Facebook posts ('Happy 18th birthday to my daughter!') and Instagram tags are enough. They also buy leaked data-broker lists that map phone numbers to families.
Why doesn't the scammer just call?
Voice would blow the cover — they aren't the person they're claiming to be. Text hides tone, accent and mistakes.
Is WhatsApp doing anything about this?
WhatsApp added 'unknown number' warnings and lets you block+report in one tap. But the block only affects that number — scammers rotate numbers every few days.
What if I already sent money?
Call 1930 immediately, before the 24-hour recovery window closes. Also file at cybercrime.gov.in and report the UPI ID to your bank and to the receiving PSP (PhonePe/GPay/Paytm).
How do I test a suspicious 'new number' message?
Reply with a question only your real family member could answer (a pet name, an inside joke, a past event) — and always call the original known number first.