The +212 prefix on WhatsApp triggers a reflex of distrust among many French users. This prefix corresponds to Morocco, and the fraud scenarios exploiting it have evolved well beyond simple ping calls. However, +212 remains the primary communication channel for millions of legitimate businesses and individuals between France and Morocco.
WhatsApp fraud scenarios related to +212: current technical mechanisms
The classic ping call (a brief call followed by a hang-up to provoke a callback to a premium rate number) no longer represents the main threat on WhatsApp. Fraudulent campaigns now go through identity theft scenarios: a supposedly distressed relative, fake technical support, a fake community vote, or the sending of malicious QR codes.
The most common vector in 2025-2026 remains account theft via a six-digit code. The attacker, using a +212 number, contacts the target pretending to be a friend and asks them to transfer a code received via SMS. This code is actually the victim’s WhatsApp verification code. Once entered, the account switches to the attacker’s device.
We are also observing an increase in innocuous initial messages (“Hello, do we know each other?”, “Sorry, wrong number”) aimed at engaging in conversation. The goal: to build trust before deploying a romance scam or fictitious investment scenario. The +212 is just one vector among others, but its frequency in these campaigns is explained by the very low cost of prepaid SIM cards in Morocco.
To delve deeper into the real risks and legitimate uses associated with the phone prefix 212 in Morocco, it is essential to distinguish the prefix itself from the suspicious behaviors that accompany it.
WhatsApp reporting and French platforms: the complete process
Public articles often limit themselves to “block and ignore.” However, the reporting system is more structured and allows for feeding anti-fraud databases.
- 33700: this number allows you to report via SMS a voice or text spam received on a French mobile. It also works for foreign numbers originating a call or unsolicited SMS, even if the exchange continues later on WhatsApp.
- SignalConso and PHAROS: for characterized scams (phishing attempts, identity theft, extortion), reporting on the PHAROS platform of the Ministry of the Interior remains the appropriate channel. SignalConso mainly covers commercial disputes but can receive reports related to misleading practices.
- Cybermalveillance.gouv.fr: this platform offers a guided diagnosis and directs users to the appropriate steps (filing a complaint, recovering an account). It also documents ongoing campaigns, allowing verification if a received scenario is already listed.
- Internal WhatsApp reporting: in the conversation, the reporting menu sends the number and the last messages to Meta. This reporting contributes to the mass blocking of fraudulent accounts but does not trigger any legal procedures on the French side.
The continuum between traditional telephony and encrypted messaging complicates processing. A missed call from +212 reported to 33700 will not automatically correlate with a subsequent WhatsApp message from the same number. We recommend reporting on both channels when the scam combines calls and messaging.
Blocking all +212 on WhatsApp: a false good idea
The reflex to systematically block any number starting with +212 poses a concrete problem for a significant portion of French users. WhatsApp Business is a major commercial channel in Morocco, used by real estate agencies, tourism providers, craftsmen, and import-export companies that directly target French or European customers.
A freelancer collaborating with a Moroccan client, a tourist booking a riad, an importer negotiating a batch of goods: all these exchanges go through +212 numbers on WhatsApp. Blindly blocking these numbers amounts to cutting off an active professional channel.
Sorting criteria for an unknown +212 number
Verification relies on a few actionable signals before any response:
- A verified WhatsApp Business account displays a badge and a business description. Its absence does not prove fraud, but its presence significantly reduces the risk.
- An initial vague message, without context or clear identity (“Hi, how are you?”, “I found your number”), is the most reliable marker of a social engineering attempt.
- A request for a code, money transfer, or clicking on an external link in the early exchanges should trigger an immediate block and report.
Never transfer a verification code received via SMS, regardless of the pretext invoked by the interlocutor. This is the most protective rule against account theft.
WhatsApp usernames and the gradual disappearance of the visible prefix
WhatsApp is working on introducing usernames that allow interaction without displaying one’s phone number. This development will change the game for exchanges with strangers. The +212 prefix will no longer be visible in public groups or during a first contact via a username.
This additional layer of anonymity has a dual effect. It protects the privacy of legitimate Moroccan users, who will no longer be immediately identified by their prefix. On the other hand, fraudsters will be able to more easily mask their geographical origin, rendering filtering by prefix obsolete.
We recommend anticipating this change by strengthening behavioral verification reflexes rather than filtering by prefix. A suspicious message remains suspicious, whether it comes from a visible +212 or an anonymous username. Activating two-step verification in WhatsApp settings (six-digit PIN code) remains the most effective technical protection against account takeover, regardless of the caller’s prefix.