“Hi mum, my phone broke so I’m using a friend’s phone for now. This is my new number, you can delete the old one. Message me on WhatsApp when you see this xx”

If you have a child old enough to own a phone, there is a decent chance a message like this has already landed on yours. It reads like your kid. It is not your kid. It is the opening move of what UK police and consumer groups call the “hi mum” scam, and it has become one of the most reliable ways criminals extract money from ordinary families over WhatsApp and SMS.

I co-founded Hongi because of scams exactly like this one, so I have spent an unhealthy amount of time reading scam transcripts. The pattern is remarkably consistent. Once you can see the skeleton underneath, the whole thing loses its power. That is what this article is for.

Anatomy of the hi mum scam, message by message

The scam is a script, and the script has four beats.

Beat one: the opener. “Hi mum” or “Hi dad”, almost never your name, because the same message goes out to thousands of numbers at once. The scammer does not know who your children are. They are fishing, and the parents who reply “Emma, is that you?” have just handed them a name to use for the rest of the conversation.

Beat two: the excuse for not calling. This is the load-bearing lie. The phone fell in the toilet. The screen is smashed and the microphone is broken. “I can text but calls don’t work.” Every version exists for one reason: a voice call would expose the fraud in three seconds, so the script must make a call feel impossible. Some victims who insisted on calling anyway got a follow-up like “the speaker’s broken, I can only text”, which should tell you how central this beat is.

Beat three: the urgent payment ask. Because the “new phone” is not set up yet, the banking app is locked out, and wouldn’t you know it, a bill is due today. Rent. A phone contract. An online purchase that will be cancelled in an hour. The amounts are calibrated to be painful but payable, typically a few hundred to a few thousand pounds, sent by bank transfer to an account that belongs to a money mule, not to your child.

Beat four: pressure and repetition. If you hesitate, the tone shifts. “Mum please, I’m really stressed.” Guilt is the accelerant. If you pay, there is very often a second ask twenty minutes later, because the first payment “didn’t go through” or another bill surfaced. The script only ends when you stop paying or start verifying.

Which? documented this pattern moving from WhatsApp to plain SMS back in 2022, including a case where a mother lost £3,600 to a fraudster playing her son. Action Fraud, the UK’s national fraud reporting centre, has put reported losses to “hi mum” and “hi dad” texts at over £226,000 between 2023 and 2025, and reported losses are always the floor, not the ceiling, because embarrassment keeps many victims silent.

Why the new number text scam works on smart people

It is tempting to think only naive people fall for this. That is exactly wrong, and the smugness is dangerous.

The scam works because it attacks the one relationship where your guard is structurally down. You have spent years responding to “mum, I need…” messages that were genuine. The scammer is not building trust from zero; they are borrowing twenty years of it. Add three well-known pressure levers and you get a very effective trap. Urgency shrinks your thinking time. Authority of the relationship (“my child needs me”) overrides procedural caution. And the “new number” framing pre-emptively explains away the single most suspicious fact, which is that the message comes from a stranger’s number.

There is also a quieter mechanism I find more interesting: the victim does the scammer’s work. When you reply “Tom??”, you supply the name. When you ask “is this about the flat?”, you supply context. Scam transcripts read like cold-reading sessions, because that is what they are.

One honest hypothetical to make it concrete. Imagine it is 9 pm on a Tuesday. You are tired, half-watching television. The message arrives, you reply, “Tom” answers warmly, jokes about the toilet incident, and then mentions the bill. Nothing in that exchange feels like a heist. That is the point. The scam is engineered to be boring.

Just call the old number. That is the whole defense

Every piece of official advice, from the FTC’s guidance on fake family emergencies to UK police, reduces to one move: contact the person on the number you already have, before any money moves.

It works because it inverts the scam’s geometry. The fraudster controls the new number completely and the old number not at all. If your child’s phone is genuinely broken, calling the old number costs you nothing, since it simply won’t be answered. If the phone is fine, your actual child picks up, confused, and the scam dies instantly. There is no scenario in which calling the old number hurts you. There is no scenario in which it helps the scammer. In security terms it is a free move, and free moves that fully resolve the threat are rare enough that you should treasure this one.

The corollary: never verify through the channel the request arrived on. Asking “is this really you?” inside the new WhatsApp chat is asking the scammer to vouch for himself. He will. Convincingly.

What to do if money has already been sent

Speed matters far more than embarrassment here, so act in this order:

Call your bank immediately and say the words “authorised push payment fraud”. Ask them to attempt recall of the transfer. UK banks can often freeze or claw back funds if contacted within hours, and many UK victims are covered by the mandatory APP reimbursement rules introduced in 2024. The first hour is worth more than the next week.
Report it to Action Fraud (or Police Scotland on 101 if you are in Scotland). In the US, report at ReportFraud.ftc.gov. You will get a crime reference number, which your bank may ask for.
Forward the scam text to 7726, the free UK spam-reporting number, so the sending number gets flagged and blocked faster.
Tell the family, including the person who was impersonated. Scammers reuse working numbers, and the sibling or grandparent who has not heard about your near-miss is their next target.
Do not pay a “recovery agent”. A follow-up contact offering to get your money back for a fee is the same criminals, taking a second bite.

Notice what is not on the list: self-blame. This script is run at industrial scale against thousands of households because it works on ordinary, careful people. Reporting is not an admission of foolishness, it is how the next family gets warned.

Closing the “but their phone broke” loophole

Here is the uncomfortable residue after all the good advice. “Call the old number” has one gap, and scammers know it: sometimes phones really do break, numbers really do change, and the old number really does go unanswered. At that exact moment, the honest situation and the scam look identical from the outside. Families need a way to verify each other that does not depend on a particular handset, SIM card, or phone number surviving.

That gap is the reason paired verification exists. The idea is old, military even: two parties agree on a shared secret in advance, in person, and later use it to prove themselves to each other over any channel. What Hongi adds is making the secret impossible to reuse or leak, because it rotates. When you pair with your mum by scanning a QR code face to face, both phones start computing matching codewords offline that change every 30 seconds. Anyone claiming to be her must be able to read out the word currently showing on her screen, and there is a second word only you can see, so an impersonator can never know both.

I will be honest about the limits. This only helps families who paired before the scam message arrives, the same way a smoke alarm only helps if it was installed before the fire. And it will not stop a scammer from texting you; it stops them from surviving verification. When a “new number” message comes in, one partner sends a silent check through the app, the kind of quiet “Dad is checking, is it really you?” that costs nothing and settles everything. The person on the broken phone, the new number, the borrowed handset can still prove themselves, because the codeword lives in the pairing, not in the phone number. That is precisely the loophole the “my phone broke” line was built to exploit, closed.

Hongi is free, Belgian-built, and works without any server seeing your codes. If the mechanics interest you, the FAQ explains how the rotating codewords are computed, and the use cases page walks through the family scenario in detail. But whether you use our app or a pen-and-paper family password, do the pairing part this week, while the only “hi mum” message in your inbox is a real one.