- How a WhatsApp account really gets taken over
- What WhatsApp says protects your messages and calls
- Turn on two-step verification to protect your WhatsApp account
- Check your WhatsApp linked devices for anything you don't recognise
- What to do if your WhatsApp account has been taken over
- When your WhatsApp number is the weak point
- Quick WhatsApp safety checklist
- Frequently asked questions
Can WhatsApp be hacked? WhatsApp says personal messages and calls are end-to-end encrypted, but an account can still be taken over if someone gets the six-digit code sent to your phone. Never share it, turn on two-step verification and check your linked devices.
It's a worry that comes up the moment a friend's account starts sending odd messages, and it matters even more if WhatsApp is how your customers reach you. The honest answer is in two parts: WhatsApp says your personal messages and calls are protected with end-to-end encryption, but accounts can still be taken over when someone gets hold of the six-digit code WhatsApp sends to your phone. Below is what WhatsApp's own help centre says about how that happens and the steps that protect you. I'm keeping this to safety, so you won't find any how-to-break-in material here.
How a WhatsApp account really gets taken over
According to WhatsApp's help centre, the thing a person needs to take over your account is the six-digit registration code that is sent to your phone by SMS or by an automated call. They don't need to read your chats or guess a password. They enter your phone number on their own phone, WhatsApp sends you a code, and if you hand that code over, the account moves to them. WhatsApp's help pages are clear that you should never share that code, not even with friends or family.
That's why the common scam looks so ordinary. A message arrives, often from a contact whose account has already been taken, saying something like "I sent you a code by mistake, can you send it back?" It sounds harmless. It isn't. WhatsApp's page on suspicious messages and scams advises treating requests for your code as a red flag.
- You receive a code you never asked for. WhatsApp's help page says this usually means someone has typed your number into their phone, either by mistake or because they're trying to take over the account.
- Someone asks you to forward or read out the code, by message, call or email. Treat the request as a scam, whoever it appears to come from.
- You're suddenly logged out and asked to register again. That can mean someone else has registered your number.
What WhatsApp says protects your messages and calls
Separately from account takeover, WhatsApp says personal messages and calls are secured with end-to-end encryption, which means only you and the person you're talking to can read or listen to them. Two caveats from WhatsApp's own pages are worth knowing. Chats with a business aren't treated as end-to-end encrypted, because many businesses use Meta as their storage provider. And anything you choose to share with Meta AI is received by Meta.
Turn on two-step verification to protect your WhatsApp account
Two-step verification is the single most useful setting here. WhatsApp's help centre describes it as an extra layer of protection: even if someone gets your code, they're asked for the second factor when they try to register your number. WhatsApp says you can choose a phone number, a password or an email address as that second factor, and it's upgrading the older six-digit PIN to a password. On the phone, the route is More (the three dots) on Android or Settings on iPhone, then Account, then Two-step verification. Menus vary by app version.
Add a recovery email address while you're there. According to WhatsApp, that email is what lets you reset your PIN if you forget it. Without one, you could be locked out of your own settings.
Check your WhatsApp linked devices for anything you don't recognise
A linked device is another phone, tablet or computer connected to your account, such as WhatsApp Web. WhatsApp's help page on linked devices says you can link up to four devices to your main phone, and that you can review them at any time.
- Open WhatsApp on your phone.
- On Android, tap the three dots then Linked devices. On iPhone, tap Settings then Linked devices.
- Look through the list. If you see a device you don't recognise or no longer use, tap it.
- Tap Log out.
If you're a small-business owner and several staff have used a shared login on a computer, this list is worth a regular look.
What to do if your WhatsApp account has been taken over
WhatsApp's help page on recovering a compromised account is direct about this. The way back in is to register again with your own phone number.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
- Open WhatsApp. If you've been logged out, tap Log back in.
- Enter your full phone number.
- Enter the six-digit code that WhatsApp sends you by SMS or call.
- If you're asked for a two-step verification PIN you don't know, someone else may have turned it on. WhatsApp's help page says to wait seven days and try again.
The help page also says that registering again logs out all the other devices linked to your account, and that it's the way to remove someone else from it. Turning on security settings afterwards helps, but it can't push out someone who's already in, so recover the account first. Then tell your contacts through another channel, such as a phone call or text, that messages sent from your account while it was compromised weren't from you.
When your WhatsApp number is the weak point
Because the code goes to your phone number, anyone who controls that number can ask for it. WhatsApp's help pages cover lost and stolen phones, and the advice there is to contact your mobile provider to deal with the SIM. My own tip, not WhatsApp's, is to ask your provider what protections they offer against someone moving your number to another SIM, and to set a strong voicemail PIN if you use voicemail. A code can arrive by call as well as by text.
The same habits apply to your other accounts. If you worry about another platform too, my guide to spotting a hacked Facebook account lists the signs to watch for, and my explainer on what a changed security code means in WhatsApp is useful when a chat shows that notice.
Quick WhatsApp safety checklist
| Habit | What WhatsApp's help pages say |
|---|---|
| Never share the six-digit code | Not with friends, family or anyone claiming to be support. |
| Turn on two-step verification | Adds a second factor. Add a recovery email. |
| Review linked devices | Log out of anything you don't recognise. |
| Re-register if taken over | Registering again logs out every other device. |
| Use chat lock and app lock | Recommended in the account security tips. |
Frequently asked questions
Can WhatsApp be hacked?
WhatsApp says personal messages and calls are protected with end-to-end encryption, but accounts can be taken over if someone gets the six-digit registration code sent to your phone. Never share that code and turn on two-step verification.
What should I do if I get a WhatsApp code I didn't ask for?
Don't share it. WhatsApp's help page says it usually means someone typed your number in by mistake or is trying to take over your account. Turn on two-step verification as an extra safeguard.
How do I remove someone else from my WhatsApp account?
Register again with your own phone number and the six-digit code WhatsApp sends you. According to WhatsApp, that logs out every other device. If you're asked for a PIN you don't know, WhatsApp says to wait seven days and try again.
Does WhatsApp ever ask for my verification code?
No. WhatsApp's help pages say the code is for you only and shouldn't be shared with anyone, including people who say they're from support.
How do I check which devices are linked to my WhatsApp?
On Android, tap the three dots then Linked devices. On iPhone, tap Settings then Linked devices. Tap any device you don't recognise and choose Log out.
