WhatsApp Weaponized: How Scammers Target
U.S. Latinos Through Public Groups
Part 3 (of 3): Crypto and Other Investments
If you’re new to the WhatsApp Weaponized series, start with our earlier reports:
EXECUTIVE SUMMARY
WhatsApp Weaponized is a three-part investigation into how scammers exploit U.S. Latinos through Spanish-language public WhatsApp groups. Digital Democracy Institute of the Americas (DDIA) opened the series in November 2025 with a deep dive into commercial and product scams (read here). A month later, the second report exposed the predatory tactics behind fraudulent legal services, fake job offers, and questionable health-care schemes – schemes that prey on immigrants trying to stay afloat and to provide for their loved ones in an unfamiliar system (read here).
This final installment shifts the spotlight to cryptocurrency and investment scams – specifically, to the financial fantasies being aggressively marketed across WhatsApp. DDIA researchers document how scammers lure Latinos with “irresistible” high-yield investment promises, banking tricks, and dubious crypto-trading models. Unlike employment scams, which target people seeking to earn a living through work, these schemes prey on those hoping to grow their wealth. The illusion of easy wealth becomes the bait used to drain potential targets of their resources.
What emerges from this third report is a troubling ecosystem where unregulated investment platforms, cryptocurrency hustles, and forex trading schemes proliferate unchecked. The patterns uncovered here should sound alarms not only for Latino communities but also for U.S. regulators, law enforcement agencies, and financial institutions.
Stay tuned for further research from DDIA on scams circulating on the open internet and through social media.
METHODOLOGY
For this three-part series of investigations, DDIA researchers examined more than 18,400 unique messages suspected of facilitating scams shared within 3,300 Spanish-speaking public WhatsApp groups between January 1 and September 1, 2025. Hundreds of these pieces of content were so widely circulated on the app that Meta marked them with its “frequently forwarded” double-arrow label, a sign of how rapid and dangerous this type of information can be.
The DDIA team relied on two primary data sources: Palver, a social listening tool that analyzes more than 3,300 public WhatsApp channels in the United States, and the Google Fact Check API, which has been aggregating fact-checks produced by media organizations around the world for years.
Researchers also reviewed and categorized 139 Spanish-language fact-checks published since 2017 that debunk various scams. This dataset from Google Fact Check API provided essential historical context to help DDIA trace how quickly online fraud has expanded in Spanish and how scammers’ techniques have adapted and grown more sophisticated over time.
Important note: In researching WhatsApp public groups with Palver, DDIA does not have access to people’s personal data and does not collect demographic information about WhatsApp users. The tools do not allow DDIA to see full names or phone numbers of users. For more information on Palver, please visit www.palver.com.br.
THE MIRAGE OF WEALTH
Between January 1 and September 1, 2025, DDIA identified more than 3,000 unique messages that appeared to promote fraudulent financial schemes circulating in Latino public WhatsApp groups, digital spaces with hundreds of users that use Spanish as a primary language and that comprise at least 30% U.S.-based phone numbers. According to data extracted from Palver, this content might have potentially reached over 192,000 users in 262 groups, making investment-related scam attempts a topic that deserves attention.
The Scam:
This fraudulent ecosystem clearly operates by exploiting the financial aspirations and anxieties of digitally connected communities. Criminals in this universe often pose as successful "investors," "mentors," or "coaches," inviting Latinos to join an exclusive class of "entrepreneurs" (emprendedores) and achieve extremely high profit. The dataset reviewed by DDIA also indicates that fraudsters in this group commonly target diaspora WhatsApp public spaces, understanding some of their members might need cash fast.
In one of the most prominent cases reviewed by DDIA – a unique message that was posted 82 times during the first three quarters of 2025 – the scammer presented a high-yield investment program without mentioning any level of risk and masking it as a great opportunity. The message read "Cómo ganar dinero con tu celular sin moverte de casa” (How to earn money with your cell phone without leaving home), and directly targeted Spanish-speaking individuals with passive income, or an alternative to traditional employment. The central offer (see image below) was the promise of a 1,000% return (a 10x increase) on the investment, with suspiciously low entry points, a tactic seemingly aimed to minimize the potential victim's initial hesitation.
a. The "Magic" Trading Bots
The most prevalent tactic detected by researchers involves promoting (unverified) automated financial algorithms that promise unrealistic daily returns. The hook seems to be earning money without working. "Pon tu dinero a trabajar por ti. Sin experiencia. Ganancias automáticas en tu billetera." (Put your money to work for you. No experience. Automatic profits in your wallet.) Here, scammers frequently request deposits in cryptocurrency (typically USDT, a type of cryptocurrency designed to maintain a stable value and pegged 1:1 to the U.S. dollar) to avoid banking regulations.
Fraudulent Investment Schemes: Under titles like “plan de 24 horas” (24-hour plan), people are encouraged to invest small amounts of cryptocurrency (USDT) with the guarantee of exponential growth within a day (e.g., "Invest $50 USDT - Earn $750 USDT"). To build credibility, scammers use potentially fabricated testimonials of massive, overnight financial success.
DDIA identified plans promising 150% profit in 24 hours on a $5,000 minimum deposit and 200% profit in 48 hours on a $50,000 deposit. In another case, researchers detected a return on investment of 12% in just 24 hours.
Deceptive Financial Services and Loans: This category includes offers of “Ayuda financiera muy rápida” (Very fast financial help), promising loans from $2,000 to $1,000,000. These are classic lures for advance-fee fraud, where the victim is eventually convinced to pay an amount of money to unlock a loan that never materializes or has hidden high interest rates.
b. Pyramid Schemes and "Mandalas"
Distinct from commercial scams, financial fraud also relies on community recruitment disguised as cooperative economics or "gifting circles." "Únete a nuestro Telar de la Abundancia. Regala y recibirás multiplicado por 8." (Join our Loom of Abundance. Gift and you will receive multiplied by 8.) DDIA researchers believe this allows for Ponzi schemes to spread virtually.
c. Bank Impersonation
In the dataset, potential scammers were also exploiting the name of legitimate financial entities to offer personal assistance in opening a bank account. The likely goal is to trick individuals into providing sensitive personal information and identity documents under the guise of helping them access a legitimate financial service.
d. Online Gambling
Finally, in this universe, researchers also found online gambling promotions, such as aggressive advertisements for online casinos being used to lure users with enticing but deceptive offers, such as promises to "Double your money... Limited offer... Register Now" or bonus packages like "Dobla tu depósito + 100 giros Grátis" (Double your deposit + 100 FREE spins).
The Manipulation Tactics:
Across all of these financial-related scams, perpetrators employ a consistent set of social engineering techniques designed to override critical thinking and exploit psychological triggers.
Appeal to Emotion and False Trust: The communication seeks to bypass rational skepticism by establishing a personal connection. Phrases like "Trust me with this platform" and "believe me that your story will change with just one step" were detected, being used to position the scammer as a benevolent guide, encouraging faith over due diligence.
Promise of Life Transformation: The narrative focuses on long-term aspirations like financial freedom and autonomy. By using phrases such as "I don't think you need to keep looking for work," the scam presents itself not just as an investment, but as a solution to professional dissatisfaction and economic insecurity.
Technobabble as Authority: To create a veneer of legitimacy, the scammers often offer a superficial and sometimes incoherent technical explanation, mentioning terms like "Bitcoin mining machine" and "trading" without providing verifiable details. The goal is not to inform, but to sound legitimate, discouraging questions from people unfamiliar with the technology. Other keywords found include: blockchain, arbitrage, and smart contracts.
Construction of False Credibility: To appear legitimate, fraudsters also aim to create an illusion of a large, successful operation. They claim to have thousands of clients in dozens of countries. They fabricate seemingly fake success stories to validate the scheme and create a sense of missed opportunity. And they usually share screenshots of “bank notifications” with captions like: "Gracias a la plataforma por mi pago de hoy" (Thanks to the platform for my payment today).
Appeal to Urgency and Easy Money: Scammers in this field create a sense of immediacy with phrases like "¡Y tú puedes activarlos HOY MISMO!" (And you can activate this TODAY!). Combined with promises of high returns for low effort, this encourages impulsive decisions based on emotion rather than logic.
Targeted Communication Strategy: Scammers seem to infiltrate specific communities and public diaspora WhatsApp groups, leveraging inherent trust within these tight-knit communities. Messages are made more visible and attention-grabbing through heavy use of emojis and bilingual or "Spanglish" phrasing.
THE MULTI-PLATFORM STRATEGY
It is crucial to note in this report that, in the financial types of scam, the operation seems to use a multi-platform strategy to attract and control victims. Initial communication takes place on public WhatsApp groups but are seemingly moved to private environments.
Calls-to-action usually direct potential victims to private messaging on WhatsApp, Telegram or Facebook's systems, isolating those who were targeted from external influences, which allows scammers to apply more pressure tactics.
FINAL TAKEAWAYS AND RECOMMENDATIONS
For further questions, please reach out to: [email protected]