WhatsApp connects billions of people every day, and for many of us it’s where work, family and business all happen. That makes it a prime target. Criminals use fake messages, stolen verification codes and clever social engineering to take over accounts, then use them to scam everyone in your contacts.

The good news: most WhatsApp takeovers rely on tricking you, not on breaking the app. A few minutes with the right settings, and knowing what the common scams look like, will stop almost all of them. Here’s how.

How WhatsApp Accounts Actually Get Hacked

WhatsApp doesn’t use a password. Your account is tied to your phone number, and it’s confirmed by a six-digit code sent by text or voice call. Almost every account takeover comes down to someone getting that code, or linking their own device to your account.

1. The verification code scam

This is the most common one. You get a text with a WhatsApp code you didn’t ask for, followed by a message, often from a friend’s number, saying: “Sorry, I sent my code to you by mistake. Can you forward it to me?”

The friend’s account has already been taken over. The criminal has started registering WhatsApp with your number on their phone, and the code you’re being asked for is yours. Send it, and they have your account.

WhatsApp will never ask you for this code, and neither will a real friend. Never share it with anyone.

2. The voicemail trick

If you don’t respond to the text, an attacker can ask for the code by voice call instead, and call when you’re unlikely to answer. The code then lands in your voicemail. If your voicemail still has the default PIN, they can dial in and listen to it.

3. Device-linking scams

WhatsApp lets you link a computer or tablet by scanning a QR code or entering a pairing code. Scammers send links to fake pages, often “someone shared a photo of you” or a fake login page, that trick you into approving a link to their device. They can then read and send messages as you, without ever touching your phone.

4. SIM swapping

A criminal convinces your mobile provider to move your number to a SIM card they control. Your phone loses signal, and they receive your calls and texts, including WhatsApp codes.

5. Malware and fake WhatsApp apps

Unofficial “WhatsApp Plus”-style apps that promise extra features, and malicious attachments, can install software that spies on your phone.

Lock Down Your Account: The Settings That Matter

Turn on two-step verification

This is the single most important setting. It adds a six-digit PIN that’s needed whenever your number is registered on a new phone, so a stolen code alone isn’t enough.

  1. Open WhatsApp and go to Settings > Account > Two-step verification.
  2. Tap Turn on and create a six-digit PIN. Avoid obvious ones like 123456 or your birth year.
  3. Add an email address. It’s the only way to reset your PIN if you forget it.

WhatsApp will occasionally ask you for the PIN to help you remember it.

Add a passkey

WhatsApp now supports passkeys on both Android and iPhone. With a passkey, you confirm sign-ins with your face, fingerprint or phone’s screen lock instead of relying only on a text message code.

Go to Settings > Account > Passkeys and tap Create passkey.

Check your linked devices

Go to Settings > Linked devices. You’ll see every computer, tablet or browser connected to your account. If you don’t recognise one, tap it and choose Log out. Make this a habit: check once a month, and immediately if anything seems off.

Protect your voicemail and SIM

  • Set a voicemail PIN that isn’t the default, or turn voicemail off if you don’t use it.
  • Ask your mobile provider whether you can add a PIN or password to your account, so your number can’t be moved to a new SIM without it.
  • Add a SIM PIN on your phone, so a stolen SIM can’t be used in another phone.

Encrypt your chat backup

WhatsApp backs up your chats to Google Drive (Android) or iCloud (iPhone), but those backups aren’t end-to-end encrypted unless you turn it on.

Go to Settings > Chats > Chat backup > End-to-end encrypted backup, and protect it with a password or a 64-digit key. Store that password or key safely: if you lose it, WhatsApp can’t recover your backup.

Tighten your privacy settings

Go to Settings > Privacy. The built-in Privacy checkup walks you through the most important options. At a minimum:

  • Set Last seen and online, Profile photo and About to My contacts.
  • Set Groups to My contacts, so strangers can’t add you to scam groups.
  • Under Calls, turn on Silence unknown callers.

Scammers use your photo, name and status to make impersonation more convincing. The less they can see, the harder that gets.

Recognising Scams Before They Work

The scams to know

  • “Hi Mum / Hi Dad” impersonation: a message from a new number claiming to be your child or a friend with a new phone, who quickly needs money.
  • Verification code requests: any request for a code you received, from anyone.
  • Prizes and giveaways: “You’ve won!” messages that ask for a fee or your details to claim.
  • Fake bank or delivery alerts: urgent warnings with a link to “verify” your account or pay a small fee.
  • Job and investment groups: offers of easy money for liking videos or “trading”, which end with you sending money.

The warning signs are almost always the same: urgency, secrecy, and a request for money, a code or personal details.

What to do with a suspicious message

  • Verify through another channel. Call the person on the number you already have for them before you send money or codes.
  • Don’t tap links from unknown senders. On a phone, press and hold a link to preview where it goes without opening it. If the address looks odd, don’t open it.
  • Don’t open unexpected attachments, even from contacts, if the message doesn’t sound like them.
  • Report and block. Open the chat, tap the contact’s name, and choose Report and Block. Reporting helps WhatsApp shut scam accounts down.
  • Never share your verification code, two-step PIN, banking details or passwords over WhatsApp.

Keep Your Phone Secure

Your WhatsApp account is only as safe as the phone it’s on.

  • Install updates promptly. Turn on automatic updates for WhatsApp and your phone’s operating system. Updates fix security holes attackers already know about.
  • Use a strong screen lock: a six-digit PIN or longer, plus face or fingerprint unlock.
  • Turn on Find My (iPhone) or Find Hub (Android), so you can locate, lock or erase a lost phone remotely.
  • Only install WhatsApp from the App Store or Google Play. Avoid modified versions that promise extra features.
  • Use reputable security software on Android, such as Bitdefender, to catch malicious apps and links before they do damage.

If Your Account Is Hacked

Act quickly:

  1. Re-register WhatsApp on your phone with your number, using the code sent to you. This logs the attacker out of your account.
  2. If you’re asked for a two-step PIN you didn’t set, the attacker turned it on. You’ll need to wait (usually seven days) before you can reset it, but they’re still logged out once you re-register.
  3. Warn your contacts by another channel, such as SMS, social media or a call, not to send money or codes to your account.
  4. Check Linked devices and log out anything you don’t recognise.
  5. Turn on two-step verification and a passkey as soon as you’re back in.
  6. Contact WhatsApp Support through the Help Center in the app if you can’t get back in.

For Businesses on WhatsApp

If your business uses WhatsApp or WhatsApp Business to talk to customers, a hijacked account doesn’t just cost you messages. It can be used to scam your customers in your name. Apply every step above to each business phone, make sure two-step verification is set up with an email address the business controls (not a staff member’s personal one), and review linked devices regularly.

If you’d like help securing your team’s phones and accounts, get in touch.

Conclusion

Securing WhatsApp takes about ten minutes. Turn on two-step verification, add a passkey, check your linked devices, and never share a verification code with anyone. Keep your phone updated and your privacy settings tight, and treat any urgent request for money or codes as a scam until you’ve confirmed it another way.

Do it now, then share this with the people in your contacts who’d fall for “I sent my code to you by mistake.” Their account is the one most likely to be used to scam you.