The 2017 WhatsApp Voucher Scam: Spam, Not a Confirmed Virus

A warning that changed as details emerged

This article began on July 18, 2017, as an urgent warning about suspicious WhatsApp messages. Early reports suggested a possible virus, particularly on Android. Later updates pointed instead to a voucher scam that encouraged people to forward messages.

That correction matters: the material documented here did not establish that receiving a message or opening a link automatically infected a phone. Nor did it establish that Apple devices were immune to the scam.

How the offer spread

A message could arrive from someone already in the recipient’s contacts, making it look more trustworthy. The linked page claimed to offer a retailer gift voucher and prompted visitors to share the offer with other people.

The original updates mentioned versions using the names of Lidl, Albert Heijn, Bol.com, and MediaMarkt. Those names were part of the lure, not evidence that the retailers ran the promotion.

What the captured page showed

The original article included a long, escaped copy of page source, attributed to a Security.nl discussion. It showed redirects, a claimed €250 voucher, simulated social comments, and logic that counted sharing interactions before allowing another step.

Those elements supported a social-engineering explanation: persuade people to spread an attractive offer and then send them onward. A sharing counter isn’t proof that every claimed share was independently verified, and copied testimonials aren’t evidence of real winners.

What to do with a similar message

• Don’t forward an offer simply because a page asks you to.
• Check promotions through the retailer’s own website or app.
• Tell the sender through a trusted conversation if their account has shared a suspicious link.
• If you entered credentials, change them through the real service and review account access.
• If you installed an unfamiliar app, investigate that separately rather than assuming a forwarded message proves an infection.

The original recommendation to restore a backup was too broad for an unconfirmed infection. The right response depends on what actually happened. This article records the 2017 incident, not a newly confirmed outbreak.