WhatsApp stock scams trick investors into buying worthless shares

Published August 17, 2026

Scammers are using WhatsApp groups to talk ordinary people into buying real stocks through their own legitimate brokerage accounts, then dumping their own shares once the price rises and leaving members holding a stock that soon crashes.

Report priority
High
Targets
WhatsApp

How it works

Deepfake video ads posing as financial experts push viewers to a location-based redirect that funnels them into a WhatsApp group run by a fake head analyst, who tells members to buy a specific small-cap stock at a set price and send proof of the purchase.

What to do

If you joined a WhatsApp group after clicking a stock-tip ad and were told by a 'head analyst' to buy a specific small-cap stock at a set price and then send proof of the trade, treat any WhatsApp group that demands purchase proof, sets urgent price targets, or promises certain gains as a scam, and report the group and the ad to WhatsApp and to your brokerage rather than acting on further instructions, including any later offer to 'recover' losses for an upfront fee.

Technical details

An advertisement using deepfake video of a supposed financial expert appears online for a short time, then disappears. A viewer who clicks is redirected based on their location into a WhatsApp group led by a self-described head analyst. On 6 November 2025, the group was told to buy a NASDAQ-listed stock at $24.79 with a $29 target and to submit proof of the trade. Coordinated buying from roughly 1,000 to 3,000 group members pushed the price to $27.87 by 9 December, a 12.4 percent gain, at which point the operators sold their own pre-positioned shares.

Group-IB researchers tracked two fraud operations, GoldBull and CoinLure. GoldBull uses short-lived deepfake ads and geo-targeted redirects to fill WhatsApp groups where a fake analyst persona directs members to buy real small-cap shares at a set limit price, generating an estimated $1.5 million to $3 million in victim-driven buying pressure per campaign, enough to move a thinly traded stock before operators sell their own pre-positioned holdings. CoinLure instead lures victims, including through romance-scam grooming, to fake investment platforms with staged registration, KYC checks, and trial funds, then blocks withdrawals with fake fees before offering a bogus 'recovery' service. Investigators linked one CoinLure platform to 208 domains sharing 23 templates, hosting, and contact details, with estimated network revenue of $187 million.

References

View Original Source