WhatsApp Companion Nudge
A phishing email campaign can optionally also send each phone-bearing target a short, link-free WhatsApp message nudging them to check their email — a second, independent channel that mirrors how real attackers escalate across channels to make a lure feel more legitimate.
What it is — and isn't
- Send-only. The nudge carries no link, so there's nothing to click or capture — it is not tracked or scored as a funnel step. It exists purely to add cross-channel legitimacy to the email lure.
- Pretext-matched. Its wording is chosen to match the theme of the email's scenario, not a generic "check your WhatsApp" blast.
- A companion, not a channel. The nudge rides alongside an email simulation; it isn't a delivery channel of its own. See Phishing & training for the separate WhatsApp delivery channel.
- Phone-bearing targets only. Recipients without a phone number on file just get the email, same as any other campaign.
The six pretext themes
AfriPhish's 18 phishing scenario families collapse into six WhatsApp pretext themes; each theme is one Meta-approved UTILITY template (its one variable is the recipient's first name, no links).
| Theme | Example scenario families |
|---|---|
| Delivery | Delivery & logistics, e-commerce |
| Payment | Banking, mobile money, invoice/BEC, subscriptions |
| Account | Email security & gateways, IT & productivity, social, telecom |
| Travel | Travel |
| Work | HR & payroll, recruitment, file sharing |
| Official | Government & tax, regulators, utilities, energy/industrial |
Whichever family the email template belongs to, the nudge picks the matching theme automatically — there's nothing to configure per campaign.
Turning it on
On the campaign wizard's Review & launch step, next to the schedule:
- Check Send a WhatsApp companion nudge.
- Optionally set Delay after the email (minutes) — leave it blank to send the nudge right after the email. The nudge always goes out after the email, never before, so the "check your inbox" message lands once there's actually something in the inbox.
Targets without a phone number on file just get the email — the nudge is additive, never a replacement.
Multilingual nudges
The nudge sends in the campaign's language. English and French are both registered as Meta template versions of each theme, so a French campaign's nudge arrives in French automatically. A campaign in another language (for example Arabic) falls back to the English nudge so it still sends rather than silently failing.
Replies are a soft signal
The nudge doesn't ask for a reply, but if a recipient replies anyway, AfriPhish logs it as a soft engagement signal on that person's result — it feeds their risk score alongside the tracked funnel signals, without being a tracked outcome in its own right.
Sender identity
By default, nudges send from AfriPhish's shared WhatsApp Business number. If that's not convincing enough for your organisation, connect your own — see Bring Your Own WhatsApp Sender.