How to protect your WhatsApp account from scams
An unexpected message does not itself take over your account. Scammers try to obtain codes or persuade you to approve an unknown linked device.
Reviewed: · Official sources
“Can you vote for me?” The message may arrive from someone you know. The page looks ordinary but asks for a WhatsApp code. Reading the message is not what takes over your account; sharing a secret or approving an unknown device is the danger. Meta documented fake voting contests used to trick people into linking WhatsApp sessions.
Two different routes to a compromised WhatsApp account
In March 2026, Meta described fake competitions that ask people for their number and a device-linking code. Scammers can also try to obtain the registration code sent by SMS or phone call. These are different techniques:
- Registration takeover. Someone tries to register your WhatsApp number on another phone and asks you to forward the code you receive. Giving it away may allow them to take control of the registration.
- Unauthorised linked session. Someone persuades you to scan a QR code or enter a device-linking code. Your phone may still work normally while an unrecognised session is connected.
An unexpected message or link alone is not proof of compromise. Check whether you actually shared a code or authorised a session. Read Meta’s explanation.
Five warning signs worth checking
- A friend sends you a voting link requesting WhatsApp credentials, a code or a QR scan.
- You get a registration or device-linking request that you did not initiate.
- Someone pretending to provide support asks for your PIN, verification code or screen-sharing access.
- An unknown phone, browser or computer appears in Linked devices.
- Your account is logged out unexpectedly or contacts receive messages you did not send.
A single warning may have a harmless explanation. Check promptly, but do not disclose any further codes while investigating.
Five practical checks to protect WhatsApp
- Never share account or linking codes. Reject requests you did not initiate, even when they appear to come from a friend or supposed support.
- Review linked sessions. In WhatsApp, open Settings → Linked devices (or the three-dot menu on some Android versions). Log out any session you do not recognise.
- Enable two-step verification. Check Settings → Account → Two-step verification. WhatsApp is upgrading the six-digit PIN method to a password for some accounts; use the option available in your app. Add a recovery email you control and protect it.
- Lock and update your phone. Keep WhatsApp and the operating system updated and use a secure device passcode, plus biometric access where supported.
- Verify unusual requests independently. If a contact suddenly asks for a vote, money or a code, phone them using a number you already know.
If you shared a code or lost access
You can still open WhatsApp
Review Linked devices, sign out any unknown sessions, and check your two-step verification and recovery email. Warn contacts if your account may have sent fraudulent messages.
You have been logged out
Follow WhatsApp’s official recovery steps. Re-registering with the six-digit code sent to your number normally signs out other registrations. If an unknown two-step verification method is requested, follow the recovery process; a waiting period may apply.
If your SIM or mobile number is also inaccessible, contact your carrier. Preserve relevant evidence and secure connected accounts. Report financial fraud to the appropriate authorities or cybercrime support service.
Do not pay strangers to recover your account or give them more codes. If you suspect the entire phone is compromised, seek reliable technical assistance before deleting evidence.
Mistakes worth avoiding
- Assuming end-to-end encryption prevents any account abuse. If an attacker controls an authorised device or session, that protection alone does not solve the problem.
- Trusting a request purely because it came from a friend's chat; their account may also be misused.
- Entering a code just because a page displays the WhatsApp logo or uses HTTPS. HTTPS encrypts that connection, not the website's intentions.
- Installing dubious apps that promise instant account recovery.
For broader device protection, see our essential iPhone security guide.
Frequently asked questions
Can somebody take over my WhatsApp account just by messaging me?
The scams described here rely on sharing a code, approving a device link or taking another action. Sophisticated software vulnerabilities can also exist, so keeping the app updated matters, but an unsolicited message is not evidence of a successful intrusion.
How do I check linked devices?
Open Linked devices, review every session and sign out those you cannot identify. Follow WhatsApp’s official guide if needed.
What if the message comes from a friend?
Confirm by calling them or using an independent channel rather than the same suspicious chat.
Is two-step verification enough?
No. It is another layer of protection, not a substitute for securing your device or reviewing linked sessions. Protect your recovery email as well.
What if someone else set a PIN or password?
Follow the official recovery instructions. WhatsApp may require a waiting period; unsolicited paid “recovery” offers are not a reliable shortcut.
Sources and editorial review
Reviewed on using official Meta, WhatsApp and INCIBE information. We have not attempted to compromise any account or investigate an individual case. Menu names can change between app versions.