WhatsApp and Mercado Pago scams: how to spot them before you lose money

If you sell through WhatsApp and get paid with Mercado Pago, you are an attractive target: you move money every day, you reply quickly and you are often serving several people at once. The most common scams don't need to "hack" anything: they take advantage of the rush.

These are the three we see most often in businesses, and how to stop them.

1. The fake payment receipt

How it works. The "customer" sends you a screenshot of a bank transfer or a Mercado Pago payment. The image looks perfect, with amount, date and transaction number. You ship the order. The money never arrived: the screenshot was edited.

How to stop it.

• Never confirm a payment by looking at a screenshot or an email. Open the Mercado Pago app (or your online banking) and look for the transaction in your activity. If it's not there, it's not there.
• Be wary of urgency: "I already paid you, send it now, I'm coming to pick it up" is the most repeated line.
• If you use Mercado Pago in an online store, let the store mark the order as paid on its own, based on the notification from Mercado Pago. Don't mark it by hand.

2. Stealing your WhatsApp with the 6-digit code

How it works. You get a text message with a WhatsApp code and, at the same time, a message from someone pretending to be a supplier, a customer or "support": "I sent you a code by mistake, can you pass it to me?". That code is what allows someone to register your number on another phone. If you share it, you lose your account and they start asking your contacts and customers for money in your name.

How to stop it.

• The WhatsApp verification code is never shared, with anyone. WhatsApp will not ask you for it by chat.
• Turn on two-step verification: in WhatsApp, Ajustes → Cuenta → Verificación en dos pasos (Settings → Account → Two-step verification). It asks you for a 6-digit PIN that you choose, and without that PIN they can't register your number even if they have the code from the text message.
• Add a recovery email in that same menu, so you can reset the PIN if you forget it.
• If you use WhatsApp Business on more than one device, check Dispositivos vinculados (Linked devices) from time to time and log out of any you don't recognize.

3. The link that imitates Mercado Pago

How it works. An email or a message arrives saying that your account was suspended, that you have a payment on hold or that you need to "validate your details". The link leads to a page identical to Mercado Pago's, where they ask for your email, password and, sometimes, the code you receive by text message.

How to stop it.

• Don't go into Mercado Pago from links. Open the app or type the address yourself.
• Look at the full address before typing anything. A fake page can look the same, but it can't be on the real domain.
• Turn on two-step verification in Mercado Pago too, and in the email linked to the account. If they steal your password, it's not enough without the second factor.

A checklist for today

1. 1
   Two-step verification turned on in WhatsApp, Mercado Pago and the business email.
2. 2
   Internal rule: no order goes out without seeing the payment in the app, not in a screenshot.
3. 3
   The whole team knows that the WhatsApp code is never shared.
4. 4
   Nobody goes into payment accounts from links that arrive by message.

These are four changes you can make in one afternoon, and they close most of the doors scammers use with small businesses.

Would you like us to review how your business accounts are set up? We do security audits for businesses and give you everything in writing.