- The recovery steps, in order
- A two-step PIN you never set
- Why a new password won't get them out
- What you're seeing and what it means
- A code you didn't ask for
- What the intruder can and can't read
- Don't report it before you recover it
- What to switch on once you're back in
- Telling your contacts and customers
- My verdict
- Frequently asked questions
If your WhatsApp account has been hacked, re-register your number on your own phone: tap Log back in, then Continue, and enter the 6-digit code WhatsApp sends by SMS or phone call. That one step logs every other device out of your account automatically, something a new password can't do, and as of Nov 2026 it's the only way WhatsApp gives you to get someone else out.
This page is for the moment after it's happened: you've been logged out, someone's chatting as you, or a code turned up you never asked for. If you're still wondering whether it can happen at all, my explainer on whether WhatsApp can be hacked covers that. Here I'm sticking to what WhatsApp's own Help Center says about getting back in.
The recovery steps, in order
WhatsApp's recovery article sets out a short sequence. You need the phone with the SIM for your number in it, because that's where the code goes.
- Open WhatsApp on your phone and tap Log back in, then Continue.
- If WhatsApp asks, type your full international phone number and tap Next, then Ok.
- Enter the 6-digit code that arrives by SMS or phone call.
- If you're asked for a two-step verification PIN and you know it, enter it. If you don't, read the next section before you do anything else.
Here's the part that matters most. WhatsApp says that whether you know the PIN or not, anyone using your account is logged out automatically once you enter the 6-digit SMS code. So even if a PIN stops you finishing the job today, you've already pushed the other person off.
Two notes from the same Help page. In some cases WhatsApp can verify your number automatically without an SMS or a call, so don't panic if the code screen skips past. And never share the registration code with anyone, not even friends or family. If a message asking for a code has you worried, my rundown of WhatsApp scams is the place for that.
A two-step PIN you never set
Here's the catch that throws people. You re-register, and WhatsApp asks for a two-step verification PIN you've never heard of. WhatsApp says that in rare cases someone else using your account may have turned two-step verification on. If you don't have the PIN, the Help Center's answer is plain: wait 7 days and try again.
It isn't the disaster it looks like. Your code has already logged the intruder out, and the PIN screen only keeps you out for a week. Put a note in your diary and go again then.
Why a new password won't get them out
This is the insight most people miss, and WhatsApp states it flatly. Changing your password won't remove someone else from your account. Passwords, two-step verification and the other security features are designed to protect an account you still have access to, not to win back one you've lost. The only way to remove a person who has taken over is to re-register with the 6-digit code sent to your number.
WhatsApp's security tips page says the same thing from the other direction: turning these layers on can't restore lost access or remove someone who's already using your account, so recover first. Do the code first; everything else comes after.
What you're seeing and what it means
| What you notice | What it means, per WhatsApp | What to do |
|---|---|---|
| A code or notification you didn't ask for | Someone typed your number to register, often by mistake, sometimes as a takeover attempt | Keep the code to yourself; without it they can't finish |
| You're logged out and asked to register again | You've lost access to the account | Tap Log back in and enter the 6-digit code |
| A two-step PIN you don't know | In rare cases the other person turned two-step verification on | Wait 7 days and try again; they're already logged out |
| Contacts say you've sent odd messages | Someone may be impersonating you in chats and groups | Recover first, then warn family, friends and customers |
| You switched to a new SIM but kept the old number's account | The account is still tied to the old number | Use the change number feature, or you could lose access for good |
A code you didn't ask for
Plenty of people land here after a text with a WhatsApp code arrives out of nowhere. WhatsApp sends a push notification when someone tries to register an account with your number, and its Help article says this often happens because another user typed your number by mistake while entering their own. It can also be an attempted takeover.
Either way, you're still in control as long as you keep the code to yourself. WhatsApp says anyone trying to verify your number needs the SMS code sent to your phone to finish. Without it, they can't complete verification and can't use your number on WhatsApp. So an unexpected code is a warning, not a breach. Don't forward it to anyone.
What the intruder can and can't read
Because WhatsApp is end-to-end encrypted and messages are stored on your device, WhatsApp says someone who re-registers your account on a new device can't read your past conversations. They can send new messages as you, which is the real risk, but your history stays on your phone.
If you're the one who ends up on a fresh phone, a Google Account or iCloud backup might let you restore your chat history. If you'd set up an end-to-end encrypted backup, WhatsApp protects it with a password or a 64-digit encryption key, so you'll need whichever one you chose.
There's a separate way in that has nothing to do with re-registering: a linked computer. If you suspect someone's reading along in a browser, how to tell if someone's using your WhatsApp Web walks through what to look for. WhatsApp's own advice after recovery is to review the devices linked to your account.
Don't report it before you recover it
This one sounds backwards. If you report the compromised account you're trying to get back, WhatsApp says it might ban it for violating its Terms of Service, and you could lose the account or your data. Its recommendation is to try recovery first.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
A few more limits from the same page, so you know where the edges are as of Nov 2026:
- You can't recover an account without a SIM card with the same phone number.
- An account can only be registered with one phone number at a time.
- WhatsApp can't deactivate accounts for other people.
- WhatsApp can't tell you who accessed your account, or when, or from where.
- If you started using a new SIM but still use the account tied to your old number, you need the change number feature, or you could permanently lose access.
The SIM point is the one that bites small businesses. If the business WhatsApp sits on a number that lives in a drawer, or left with a former employee, recovery depends on getting that SIM back into a phone.
What to switch on once you're back in
Once you're back, WhatsApp recommends turning on its security features and reviewing linked devices. Its security tips page lists the layers, and these are the ones I'd look at first:
- Two-step verification, which can use your phone number, a password or an email address for the extra check. The settings are in my step-by-step on WhatsApp two-step verification.
- An email address on the account, which WhatsApp says lets you recover it without needing SMS or a phone call.
- A passkey, which ties the account to your phone's fingerprint, face or screen lock.
- App lock, plus chat lock for any conversations you'd want hidden behind an extra check.
- Linked devices: go through the list and unlink anything you don't recognise.
There's also Strict account settings, which applies WhatsApp's strictest privacy and security controls. WhatsApp says it's built for people who may face elevated risk and should only be switched on if you believe you're being targeted, so most business owners can leave it alone.
Telling your contacts and customers
WhatsApp's advice is to tell family and friends, because whoever had your account could impersonate you in chats and groups. For a business, widen that list. Post a short note in your customer groups and message your regular clients directly, so nobody acts on a request that only looked like it came from you.
Keep it calm and short: your account was briefly used by someone else, it's back under your control, and anything odd sent in that window wasn't from you.
My verdict
I'd do the code first, every time: Log back in, enter the 6-digit code, and let WhatsApp log everyone else out. Then warn your contacts, review linked devices and turn on two-step verification plus an email address. Skip the password change as a fix, and skip reporting the account until you've tried to recover it, because that's the step that can cost you the account.
If your team or your customers run on WhatsApp, deciding who holds the business number and which security settings are switched on is part of the workflow planning I help businesses with. I run AI training and workshops for teams, and help businesses with AI enablement and workflow automation, so the busywork runs itself and people get time back. Most of that work is with SaaS marketing teams and small businesses. Here's how we can work together.
Frequently asked questions
How do I get my hacked WhatsApp account back?
Open WhatsApp on your phone, tap Log back in, then Continue, and enter the 6-digit code sent by SMS or phone call. WhatsApp says this logs out every device that was logged into your account.
Will changing my password remove the hacker?
No. WhatsApp says changing your password won't remove someone else. The only way is to re-register with the 6-digit code sent to your number.
What if WhatsApp asks for a PIN I never set?
WhatsApp says someone using your account may have turned on two-step verification. If you don't have the PIN, wait 7 days and try again. The other person is still logged out once you enter the SMS code.
Can the hacker read my old WhatsApp messages?
WhatsApp says no. Messages are end-to-end encrypted and stored on your device, so someone re-registering your account on a new device can't read your past conversations.
Should I report my hacked WhatsApp account?
Try recovery first. WhatsApp says reporting the account you're trying to recover might get it banned, and you could lose access or data.
