WhatsApp Hacked? What to Do in the First Hour

If your WhatsApp has been hacked, the fix is to take your number back: open WhatsApp, tap Log back in, enter your full phone number and the 6-digit code sent by SMS or phone call. WhatsApp says re-registering logs out every other device on the account, which is how the intruder is removed. Then check your linked devices, warn your contacts, and switch on two-step verification. This guide walks through the first hour in that order.

Most takeovers are not "hacks" in the movie sense. They usually start with someone persuading you to hand over a code or to link a device. That is good news, because it means a few habits close most of the door.

Do this now: the first hour

1. Keep your SIM and your phone number safe. WhatsApp says you need a SIM with the same number as the account to recover it. If you have lost the SIM, contact your mobile provider first to get the number back.
2. Re-register. Open WhatsApp, tap Log back in, then Continue. If asked, enter your full international phone number. Enter the 6-digit code sent by SMS or call. WhatsApp's instruction is to keep this code private, even from people you trust. Re-registering logs out all devices linked to the account.
3. Do not change your password and stop there. WhatsApp says password changes do not remove someone who has taken over the account. Only re-registering does.
4. Review linked devices. In WhatsApp, open the three-dot menu (or Settings on iPhone) and choose Linked devices. To remove one, tap it and tap Log out. WhatsApp also logs linked devices out after 30 days of inactivity and allows up to four linked devices. Remove anything you do not recognise.
5. If two-step verification blocks you. If the intruder set a PIN and you do not know it, WhatsApp says to wait 7 days and try again. It also says entering the SMS code logs the other person out regardless. If an email address was added to the account, you can request a reset link from Forgot PIN.
6. Warn your contacts, outside WhatsApp. WhatsApp notes someone could impersonate you in chats and groups. Text or call close contacts and tell group admins, so nobody sends money or codes to "you".
7. Turn on the security features (see the prevention list below) so the same trick does not work twice.
8. Report scams, not your own account. WhatsApp advises trying recovery before reporting, because reporting your account may get it banned and cost you access to your account or data.

Practise these decisions in the WhatsApp Hacked Recovery Lab, a scenario with fictional people where nothing real is at stake.

How to tell if your WhatsApp was hacked

WhatsApp's recovery page does not list a fixed set of warning signs, and it states that WhatsApp cannot tell you who accessed your account or when or where. So rely on what you can see yourself:

• You are suddenly logged out and asked to verify your number again.
• A 6-digit code arrives that you did not request. Someone may be trying to register your number on another phone.
• Contacts report strange messages from you, often asking for money, codes or a "quick favour".
• Linked devices you do not recognise. If you keep push notifications on, WhatsApp says a notification showing a device you do not recognise can be tapped to review and remove it.
• A "friend" asks you to forward a code. A common pattern is a message from someone you know, often from an account that is already taken over, saying they sent a code to your number by mistake and asking you to send it back. That code lets the sender register your account on their phone. Treat it as an attack, even when the name is familiar.
• A prompt to scan a QR code or link a device that you did not start. WhatsApp tells people to link only through its official apps and sites, because unofficial apps and websites can put the account at risk.

The two ways accounts are usually taken

1. The registration code request

To sign in on a new phone, WhatsApp texts a 6-digit code to your number. Anyone who has that code and your number can register the account on their own phone. Scams are built around getting you to read it out, forward it, or type it into a "verification" page. The defence is simple: that code is for you alone, always.

2. A linked device

WhatsApp lets you link additional devices, such as WhatsApp Web or a desktop app, usually by scanning a QR code. If you are talked into scanning a code or approving a link, a stranger's device can sit on your account and see your new messages. Check the Linked devices list now and then, and treat any unexpected request to link as suspicious.

What the person who took the account can and cannot see

WhatsApp says messages are end-to-end encrypted and stored on your device, so someone who re-registers your number cannot read your past conversations. After you re-register, restoring from a Google or iCloud backup may bring back your own history. The real risk is impersonation going forward: the intruder can message your contacts as you until you take the number back. A linked device is different, since it can follow your conversations while it stays linked, which is why removing it matters.

Prevent it next time: a checklist

• Never share the 6-digit registration code, with anyone, for any reason. WhatsApp says to keep it private even from people you trust.
• Turn on two-step verification and add an email address, so you have a way to reset a forgotten PIN without the 7-day wait. WhatsApp's help notes the PIN is being upgraded to a password in some versions, so the on-screen wording may differ.
• Add an email address to your WhatsApp account. WhatsApp says it lets you recover the account without SMS or a phone call.
• Consider a passkey, which WhatsApp describes as tying the account to your device's fingerprint, face or screen lock. See our Passkey Lab for how they work.
• Use app lock and chat lock so a borrowed or stolen phone cannot open your chats.
• Protect your encrypted backup with a password or key, per WhatsApp's account security page.
• Check Linked devices regularly and keep notifications on.
• If you may be a target, look at WhatsApp's strict account settings.
• Use a strong, unique password for the email account tied to your phone number and other accounts; check yours with the Password Strength tool. Keep your phone number's SIM protected with your mobile provider's account PIN.

WhatsApp is clear that these features cannot restore lost access or remove someone who is already using your account. Recover first, then lock it down. For the wider picture, see the Account Takeover Lab.

Frequently asked questions

How do I know if my WhatsApp has been hacked?

Signs include being logged out unexpectedly, a code arriving by text that you did not request, contacts saying they got odd messages from you, and linked devices you do not recognise. WhatsApp says it cannot tell you who accessed your account or when or where, so check the Linked devices list yourself.

Can I get my hacked WhatsApp account back?

Usually, if you still control the SIM with your phone number. WhatsApp says to open the app, tap Log back in, enter your full number and the 6-digit code sent by SMS or call. Re-registering logs out every other device, which removes the intruder. Without the SIM for that number, WhatsApp says you cannot recover the account.

Will changing my password remove the hacker?

No. WhatsApp says changing a password does not remove someone who has taken over the account; only re-registering does. After you are back in, turn on two-step verification and review linked devices.

Can the hacker read my old chats?

WhatsApp says messages are end-to-end encrypted and stored on your device, so a person who re-registers cannot read past conversations. Restoring from a Google or iCloud backup may bring your own history back. They can still pretend to be you, so warn your contacts.

What if I forgot my two-step verification PIN?

WhatsApp says that if you added an email address you can request a reset link from the Forgot PIN option. With no email, you must wait 7 days before you can reset the PIN. WhatsApp says entering the SMS code logs the other person out regardless.

Should I report the hacked account to WhatsApp?

Try recovery first. WhatsApp warns that reporting the account may get it banned, which could cost you access to your account or data. Re-register, then report any scam messages or accounts you received.

Sources

• WhatsApp Help Center: How to recover a compromised account
• WhatsApp Help Center: Linked devices, viewing and logging out
• WhatsApp Help Center: Account security tips
• WhatsApp Help Center: About email verification codes and resetting two-step verification
• WhatsApp Help Center: How to reset your two-step verification PIN

This is general guidance, not legal advice. WhatsApp's menus and wording change; follow the official help pages above for the current steps in your version of the app.