Someone Quietly Changed the Group Name: A Festive Fraud Check for School Fair and Village Hall Volunteers

There's a particular kind of chaos that only exists in a school fair WhatsApp group in November. Forty-three messages before nine in the morning. Someone asking whether the tombola needs a licence. Someone else posting a photo of a cake. A third person — who hasn't read anything since Tuesday — asking where to drop off the raffle prizes.

It's wonderful, and it's also wide open.

Because somewhere in that noise, a compromised account can post a payment request and get four people to tap 'send' before anyone thinks to check. It happens every festive season, and it's rarely dramatic. No alarms, no obvious villain. Just a helper's old phone number resurfacing, a new admin appearing, or a link to a "stall booking spreadsheet" that nobody quite remembers asking for.

This is a five-minute audit. Run it once now, before the fundraising rush properly begins.

First: is the group still the group you joined?

Group takeovers are usually boring rather than clever. An attacker gets into one member's WhatsApp account — often because they've been sent a six-digit code by someone pretending to be a friend asking for it — and then quietly works from the inside.

The tell-tale signs are small but consistent:

• A new admin nobody appointed. WhatsApp shows who the admins are. If a name you don't recognise has appeared there, ask in the group directly, out loud, by name.
• The group name or photo has been changed slightly. "St Mary's Christmas Fair 2026" becoming "St Marys Christmas Fair 2026" is the sort of thing your brain skips over. Slow down and read it.
• Group settings have shifted. If "who can add members" or "who can send messages" has been relaxed, that's a door propped open. Admins can check this in Group Info > Group Settings.
• Someone has been removed and re-added. Common trick: boot a member, then re-add them from a fake account with the same photo and a near-identical name.
• The invite link keeps circulating. A group invite link is a key. Anyone with it can walk in.

Five minutes, once a week, is genuinely enough to catch most of this.

The payment request rule that saves arguments

Here's where the money actually goes missing. A message lands in the group: "Hi all, the stall deposit needs paying today, can whoever's collecting send it to this account — sort code 04-00-xx." It sounds completely ordinary, which is precisely why it works.

Adopt one rule and stick to it: no payment details are ever actioned from the group chat. Not once, not even when you're sure.

If a request arrives by WhatsApp, verify it by a second channel — a phone call to the number you already had saved, a face-to-face word at pick-up, a message in the school office system. The second channel is the whole point. A fraudster sitting inside one account can't reach into your saved contacts.

For the committee, do one better. Publish the fair's real bank details once, somewhere persistent — a printed sheet on the hall noticeboard, a pinned message from a named treasurer — and state plainly that they will not change. Any message that contradicts that sheet is, by definition, wrong. Say it in the group now, while everyone's relaxed, rather than in December while everyone's frantic.

Lock the door behind you

A few settings are worth the two minutes they take.

Turn on two-step verification for every admin. WhatsApp's version of this asks for a six-digit PIN when the account is re-registered on a new phone. It is the single most effective defence against the takeover itself, and it takes about thirty seconds in Settings > Account > Two-step verification.

Reset the invite link after the fair. WhatsApp lets you revoke and generate a fresh one. Do it when the event ends and again whenever a phone goes missing.

Approve new members manually. In larger groups, changing the setting so admins must approve anyone joining stops the quiet infiltration that happens when a link escapes into a year-group chat.

Keep the money talk out of the big group. Set up a small committee group with named admins and strict joining. The fewer people who can see financial messages, the fewer people who can be impersonated inside them.

If a helper's phone goes missing

Lost phones are the quiet engine behind most of these incidents, and they tend to happen at exactly the wrong moment — in a car park, on a bus, down the back of a sofa at the Christmas do.

If it's your phone, act in this order. Use WhatsApp's linked-device screen from another machine to log out all sessions. Then, if you can, remote-wipe the handset through Find My (Apple) or Find My Device (Google). Then tell the group's admins, in plain terms, so they can watch for odd messages from your name. Then get your SIM replaced with your network — a stolen SIM is a bigger problem than a stolen handset, because it's how account recovery codes get intercepted.

If it's someone else's phone, the admins should remove that account from the group until it's confirmed sorted, and reset the invite link for good measure. Nobody will be offended. Everyone should expect it.

The shared spreadsheet that isn't

One last thing, because it's cropping up constantly at the moment. Fake links to "the stall rota" or "the raffle ticket tracker" are a favourite because they're so plausible. Volunteers expect spreadsheets. Nobody questions a spreadsheet.

Before you tap, look at the address bar. A document shared through Google or Microsoft will live on their domain, not on something that merely contains the word 'docs'. If you're asked to sign in to view it, stop — that's the trick, not the rota. And if the link came from someone whose account you now suspect, don't tap it at all; message them somewhere else and ask.

The five-minute version

If you only do one thing this week: open the group, check who the admins are, confirm the real bank details are pinned and unchanging, and tell everyone the second-channel rule. Then turn on two-step verification on your own account before you close the app.

Christmas fairs are run by people doing something generous with limited time. Fraudsters know that, and they rely on it. A small, boring habit — repeated — is the best defence there is.