Deleted Messages and WhatsApp Fraud: The Patterns Businesses Should Know
Most deleted messages are innocent. A few are a step in a scam, and the scams that use deletion share a structure: show something convincing, get you to act, remove the evidence.
Knowing the patterns is most of the defence.
Pattern 1: the fake payment screenshot
The most common one, especially where bank transfer or UPI is the payment method.
A "customer" sends a screenshot of a completed transfer. It looks right — bank branding, your account name, the correct amount. You release the goods. The money never arrives, and the screenshot has been deleted.
The deletion serves two purposes: it removes the forged image from any later investigation, and it lets them claim they sent proof of a genuine payment that your bank "lost".
Defence: never release goods on a screenshot. Confirm the credit in your own account. This is the whole answer, and it's ignored constantly under time pressure.
A stored record helps afterwards — the forged image is retained for a police report and for recognising the same fraudster returning — but it doesn't replace checking your bank.
Pattern 2: the changed bank details
Targets businesses paying suppliers, and it's expensive.
A message arrives from what appears to be a known supplier: "we've changed banks, please use these details for the outstanding invoice." You pay. The real supplier never receives it. The message is deleted.
Often the number is a lookalike, or a genuine supplier's account that's been compromised.
Defence: verify any change of payment details by phone, on a number you already had, never a number supplied in the message itself. Make it a written policy — this is the control that works.
Pattern 3: order manipulation
A customer places a large order, agrees terms, then after delivery deletes the messages containing the agreed quantity or price and disputes the invoice.
Distinguishable from an honest disagreement mainly by pattern: it happens repeatedly, and always with the specific message that carried the commercial terms.
Defence: structured confirmations requiring an explicit reply, plus a record that survives their deletion. See WhatsApp order changes.
Pattern 4: impersonating your business to your customers
Not aimed at you directly, but it lands on you.
A fraudster sets up a number resembling yours and messages your customers with fake offers or payment requests. When the customer complains to you, the messages have been deleted from their chat too.
Defence: tell customers your only official number, verify it visibly, and encourage them to screenshot anything suspicious before it's withdrawn. A green tick helps where you qualify.
Pattern 5: the recovery-code scam
Aimed at your staff. "Hi, this is WhatsApp support / your manager — we need the 6-digit code sent to your phone."
Handing it over transfers your business number to the attacker, along with every conversation and group it's in. The request is then deleted.
Defence: absolute rule — the verification code is never shared with anyone, for any reason. Enable two-step verification on every business number. See why these codes matter.
Why deletion is attractive to fraudsters
On a phone-based setup, deletion gives the other party retroactive control over your evidence. That's an unusual property. It doesn't exist with email, card payments, or signed documents.
A scam that leaves no artefact is much harder to report, to prosecute, and to recognise when the same person returns under a different number.
What a stored record changes
When a number is connected to a platform that stores messages server-side on arrival, the message and any attachment are saved when delivered. A later deletion reaches the phone, not the stored copy. In Tenashi it stays tagged "Deleted on WhatsApp".
For fraud specifically, that means:
- The forged screenshot is retained for a report
- The fraudulent bank details are preserved, including the exact account used
- The deletion itself becomes evidence — legitimate customers rarely delete the message containing payment details
- Searching across conversations reveals a repeat pattern instead of isolated incidents
- OCR on images makes account numbers in screenshots searchable, so the same fraudulent account is recognisable next time
Scope: chats with your own connected business number, from the date you connect it.
A short anti-fraud policy
- Never release goods or services on a payment screenshot — confirm the credit in your account
- Verify any change of supplier bank details by phone, on a number you already held
- Structured order confirmations requiring an explicit reply
- Verification codes are never shared, and two-step verification is on
- Tell customers your only official number
- Store messages server-side so evidence survives the sender's deletion
- Flag and search repeat contacts rather than treating each incident as new
Tenashi runs on your existing number with a shared inbox, contact records and ban-safe sending.
Pricing is flat, from $18/mo.
Get started → · See every feature
FAQ
How do I spot a fake payment screenshot on WhatsApp?
Don't try to spot it — verify the credit in your own bank account before releasing anything. Forgeries are convincing and getting better, so visual inspection is not a control. Treat a screenshot as a claim, never as proof.
A supplier messaged us new bank details. Is that a scam?
Treat every change of payment details as suspicious until verified by phone, using a number you already had rather than one supplied in the message. This is one of the most costly frauds against businesses and the verification call is the only reliable defence.
Why do fraudsters delete their messages?
Because on a phone-based setup deletion removes your copy too, destroying the evidence. It makes the incident harder to report, harder to prosecute, and harder to recognise when the same person returns under a different number.
Should we ever share a WhatsApp verification code?
Never, with anyone, for any reason. WhatsApp doesn't ask for it and no legitimate person will. Sharing it hands over the number and every conversation and group attached to it. Enable two-step verification on all business numbers.
Does keeping deleted messages help with fraud reports?
Yes. It preserves the forged screenshot, the fraudulent account details and the timeline for a police or bank report, and the deletion itself is informative — legitimate customers rarely delete the message containing payment details.
How do we recognise a repeat fraudster?
Search across conversations and flag contacts. Without stored history each incident looks new, which is exactly what a repeat fraudster relies on. OCR also makes account numbers inside screenshots searchable across cases.
The common thread in these scams is a convincing artefact that disappears. Keep the artefact. Get started.