A WhatsApp account is tied to a phone number. Attackers commonly try to register that number on another device, trick the owner into sharing a verification code or keep access through a linked device.
The strongest protection combines account settings with careful behaviour. Turn on the security features before there is a problem.
Turn on two-step verification
Two-step verification adds a secret code or password to the registration process. Open WhatsApp settings, find the account security options and enable the feature. Add an email address that you control so you have a recovery path if you forget the code.
Do not use an easy number such as a birthday, repeated digits or part of the phone number.
Never share the registration code
WhatsApp may send a code when someone tries to register the number. That code is for the account owner. A friend, support agent or group administrator does not need it.
If an unexpected code arrives, someone may have entered your number by mistake or may be attempting a takeover. Do not forward the message or enter the code on a page opened from an unknown link.
Review linked devices
Linked devices can keep access to messages even when the main phone is elsewhere. Open the linked-devices screen and remove any computer, browser or phone you do not recognise. Repeat the check regularly, especially after using a shared computer.
Protect the phone and SIM
- Use a strong screen lock and app lock where available.
- Keep the phone operating system and WhatsApp updated.
- Add a SIM PIN if you can manage it safely.
- Do not leave an unlocked phone with an unfamiliar person.
- Contact the mobile operator quickly if the SIM unexpectedly stops working.
Be suspicious of urgent money requests
A stolen account is often used to impersonate the owner. The attacker may tell contacts that there is an emergency and request a transfer. If a familiar person makes an unusual request, call them through another channel before sending money.
What to do if the account is compromised
- Try to register the phone number again on the legitimate device using the code sent to you.
- Check and remove unfamiliar linked devices after access is restored.
- Warn close contacts through another channel so they do not trust requests from the compromised account.
- Secure the email account connected to two-step verification.
- Contact the mobile operator if the SIM may have been replaced or redirected.
- Use WhatsApp’s official recovery guidance rather than paying someone who claims they can recover the account.
The bottom line
A verification code should be treated like a key. Two-step verification adds another lock, while linked-device checks help you find access that should not be there. Set up the protection now, not after an impersonation message has been sent.
