How to Protect Your WhatsApp Account From Being Hacked

To hijack a WhatsApp account, an attacker doesn't need your password — they need the 6-digit SMS code sent to your phone. Most stolen WhatsApp accounts are taken by tricking the owner into handing over that code. The good news: preventing it takes two minutes.

How accounts get stolen

The most common scenario:

1. The attacker enters your phone number into WhatsApp on their own phone. WhatsApp texts you a 6-digit verification code.
2. At the same moment you get a message from someone you know (whose account is already hacked) or from "WhatsApp support", "your bank", "a courier" or "a giveaway": "I sent a code to your number by mistake, can you forward it?"
3. The moment you send it, your account moves to their phone and you're logged out. Then they message your friends asking for money in your name.

Golden rule: never send your WhatsApp code to anyone, ever. WhatsApp staff will never ask for it either.

1. Turn on two-step verification (most important)

This adds a 6-digit PIN. Even if an attacker gets your SMS code, they can't open the account without the PIN.

WhatsApp → Settings → Account → Two-step verification → Turn on

• Don't pick an easy PIN like your birth year, 123456 or 000000.
• Add an email address — you'll need it to reset the PIN if you forget it.

2. Turn on passkeys and email verification

In recent versions you can create a passkey under Settings → Account → Passkeys, so logins are confirmed with your phone's fingerprint or face unlock. Settings → Account → Email address lets you verify your account by email too.

3. Review linked devices

Attackers sometimes keep your account open on a computer (WhatsApp Web) and quietly read all your chats.

Open Settings → Linked devices. If you see a device you don't recognise, tap it and choose Log out. Checking this once a month is a good habit.

4. Tighten group and profile privacy

Under Settings → Privacy:

• Groups — choose "My contacts" so strangers can't add you to scam groups.
• Profile photo and About — choose "My contacts" so scammers can't copy your photo for fake accounts.
• Silence unknown callers — mutes calls from numbers not in your contacts.

5. Don't tap suspicious links or files

"Free data bundle", "WhatsApp Gold", "You've won a prize", "download this .apk" — these are almost always scams, even when they come from someone you know, because their account may be hacked. When in doubt, call them and ask.

Already hacked? Do this

1. Open WhatsApp on your phone and sign in again with your own number. You'll receive an SMS code — entering it automatically logs the attacker out.
2. If the attacker set up two-step verification, WhatsApp may ask you to wait 7 days. During that time the attacker can't send new messages, and after 7 days you can sign in without the PIN.
3. Warn your contacts through another channel (a call, Instagram) not to trust money requests sent in your name.
4. Once you're back in, turn on two-step verification with your own PIN right away.
5. If problems continue, email [email protected] with the subject "Lost/Stolen: Please deactivate my account" and your number in international format.

Quick checklist

• Two-step verification on, with a hard-to-guess PIN
• Email address added
• No unknown linked devices
• Only my contacts can add me to groups
• I never send codes to anyone — ever

Need to send someone a password? Don't paste it into WhatsApp — use a one-time secret link instead: it opens once and is then deleted.