Scams and Malicious Links in WhatsApp Groups: Employment, Investment and Impersonation Fraud, Pix Payments in Brazil and Administrator-Level Controls

Groups on messaging platforms are a recurring stage in online fraud. Scammers add strangers to groups, post fraudulent offers in open groups, use groups to stage fake testimonials and move victims from one platform to another before asking for payment. This narrative review synthesises official documentation from WhatsApp and Meta, public service announcements from the United States Federal Bureau of Investigation (FBI), Europol's Internet Organised Crime Threat Assessment, guidance from CERT.br and the Central Bank of Brazil, and peer-reviewed measurement research on public messaging groups. All sources were accessed and verified in October 2026. The review describes four scam families that official sources associate with messaging groups (employment and task scams, investment scams, impersonation scams and fake offers), the role of links in moving victims off the group, and the specific setting of Brazil, where instant Pix transfers are the usual payment rail and the Special Return Mechanism (MED) is the documented path for contesting fraudulent transfers. It then maps mitigations at three levels: platform features documented by WhatsApp (safety overview for unfamiliar groups, link restrictions for unknown contacts, scam warnings, reporting and group permissions), administrator practices, and automated group tooling such as link filtering, flood control and member approval. The review finds that official sources converge on a small set of warning signs, notably requests to pay in order to earn, urgency and links that move the conversation elsewhere, and that administrators can reduce exposure in the groups they control, but that no source measures the prevalence of scams inside WhatsApp groups. No original data are reported.