How to Recognize a WhatsApp Hijack Attempt
Understand why WhatsApp registration codes must stay private, how two-step verification helps, and what to do if someone takes control of your account.
Keep the registration code private
WhatsApp may send a six-digit registration code when someone tries to register your number. A scammer may ask you to forward it, claiming it was sent by mistake or needed for another purpose. Do not share it. An unexpected code can indicate an attempt, but it does not by itself mean the account was taken.
Turn on WhatsApp two-step verification
WhatsApp two-step verification adds a PIN used during account registration. This PIN is separate from the registration code sent to your phone. Enable the feature in account settings and add a recovery email you control when offered. Secure that email as well. Never give the PIN to someone who contacts you through a chat or call.
Check linked devices and unusual requests
Review WhatsApp's linked devices and remove any session you do not recognize. Be cautious when someone asks you to scan a QR code or link a device without a clear reason. If a contact suddenly requests money or codes, verify through another channel. Their familiar name and profile photo do not prove who is writing.
Use official recovery guidance
If you lose access, follow WhatsApp's current account recovery instructions and register your number again through the official app. Recovery can depend on account settings and security waiting periods. Warn contacts through another channel if your account is being used for scams. If your phone number was taken over, also contact your mobile carrier promptly.