Political campaigners in Brazil have used software that scrapes Facebook for citizens' phone numbers, and then automatically sends them WhatsApp messages and adds them to WhatsApp groups.

Almost three weeks ago, 147 million voters in the country went to the polls for legislative elections and the first round of the presidential elections.

This Sunday, they will decide between far-right candidate Jair Bolsonaro and the left-wing Workers' Party candidate Fernando Haddad, in the second round of the presidential election.

A BBC investigation has discovered that efforts to support various parties and candidates - covering state, federal and senate votes - have used the bulk message technique.

Why is WhatsApp being targeted?

WhatsApp is not just used as a private messaging app in Brazil. Many mobile phone networks allow unlimited WhatsApp access to subscribers, so even people who cannot afford an internet plan can use it.

As a result, the platform has taken on some of the roles filled by social networks in other countries. Many people join interest-based WhatsApp groups to talk about politics and hobbies with people they have not met.

WhatsApp claims 120 million Brazilians currently use its service. It is commonly used to share news - and misinformation.

How is WhatsApp being misused?

Some of the devices involved in the data scraping can send up to 300,000 messages at a time. They are sold via the internet and some sellers claim their use is hard to trace.

The method is not limited to politics. Marketeers have also used it to promote cosmetics and foods, among other products, to Brazilians.

BBC News Brasil interviewed people linked to different campaigns, on condition of anonymity. They included activists and marketeers, who reported how they used the scraping and bulk-messaging tools.

In addition, the team spoke to companies selling the software as well as to people who had recently been added to politically linked WhatsApp groups without their consent.

The scheme violates WhatsApp-owner Facebook's rules. In the view of some experts, it could also constitute an electoral crime.

For its part, Facebook says it has banned hundreds of thousands of suspicious WhatsApp accounts and closed several Facebook pages and accounts linked to a marketing group believed to be supportive of Bolsonaro.

1,000 numbers in 10 minutes

The scraping software allows its clients to choose a target audience by searching for keywords, pages or public groups on Facebook.

In fewer than 10 minutes and 10 clicks, it is possible to gather almost 1,000 phone numbers. Data can be group by city, gender and interests.

Contacts can also be gathered by:

• using details voluntarily provided by a candidate's supporters
• buying databases sold legally in Brazil
• using information stolen or bought illegally from telephone service providers

One woman in the Sao Paulo neighbourhood of Grajau remembers discovering that she had been added to four WhatsApp groups.

"I don't know where they found my phone number," the woman, who asked to remain anonymous, told the BBC.

"The administrators and some people had foreign numbers. I got scared, I left all of the groups and reported all of them to WhatsApp."

She added that after a day or two, she was added to a further eight groups.

She said she had not provided her number to any political campaign but had made it public on Facebook.

A 23-year-old university student living in Campinas reported having been added to three groups, in which four individuals dominated the conversation.

"They sent dozens of memes and videos against PT (the Workers' Party) every day," said the young man who also asked not to be named.

"Other people were sending lots of content too, and it was crazy."

Bulk WhatsApp messaging

Luiz Rodrigues Junior, of Agency Genius Publicidade, is one marketeer who acknowledged having tested adding people to WhatsApp groups in order to distribute political messages in bulk.

But he said he had only used databases that had been legally compiled, and had opted not to pursue the strategy because it was not efficient.

He declined to reveal which candidates he had acted on behalf of.

"I can't create a group that [explicitly] supports my candidate because that may expose him, people may attack him in the group and I'll have no control over it," he explained.

"So we set up election groups, with names like 'End corruption in the election', invited a lot of people through the software and put them in the group.

"Half of those who were added left and half stayed.

"Within this group, we placed two or three of our own professionals, who began to post content supporting our case and started debates.

"Then we would replicate this in many other groups, maybe 50 or 100."

In some cases, groups could be limited to residents of a neighbourhood who were facing a specific problem for which his candidate offered a solution, he said.

But he explained that to make the strategy work he would have required an army of employees to keep discussions on track.

How do bulk messaging programs work?

The mass delivery of WhatsApp messages generally involves the use of "click farms".

But some services do not require special equipment any more, just Sim card details to be entered into a computer running relevant software.

Several strategies are employed to avoid detection.

One trick is to list the telephone numbers being used in ads posted to classified sites. When members of the public try to contact them, they "legitimise" the numbers and fool WhatsApp's bot detectors.

Because the market is relatively new, the price, structure, and complexity of the tools vary greatly.

In the interior of Sao Paulo state, for example, it is possible to find services that sell a package of one million WhatsApp messages for the equivalent of £6,200.

WhatsApp limits

In WhatsApp, each user can be a member of as many groups as he or she wants, but there are some limits.

One is that each member can only create up to 9,999 groups.

Another is the number of messages forwarded simultaneously to different conversations. This was reduced from 256 to 20 in August as part of efforts to tackle fake news.

Some researchers are now calling for the number to be further reduced. They point to India, where the limit has been cut to five.

But WhatsApp has said there would not be enough time to make the change before the weekend's vote.

"We have advanced spam detection technology that identifies accounts with abnormal behaviour so they cannot be used to spread spam or misinformation," said a statement from WhatsApp.

"We are also taking immediate legal action to prevent companies from sending bulk messages via WhatsApp and have already banned accounts associated with these companies."

Brazil's Electoral Court said that "there is no specific electoral legislation for WhatsApp" or similar apps, but added that the law does cover electoral advertising via the internet.

But part of the problem with applying this to WhatsApp is its use of end-to-end encryption, explained one expert at the University of the State of Rio de Janeiro (UERJ).

"The content is not on the platform's servers, but on users' devices," said Prof Carlos Affonso Souza.

And because WhatsApp cannot unscramble the encrypted messages itself to read them, it is unable to vet the content in the same way other social media platforms can, he added.

"I'm afraid that this debate will make us return to discussions of blocking the application or forcing it to give up its cryptography."