You get a message from a friend or a family group member: "Hi, sorry, I sent a 6-digit code to your number by mistake. Please can you send it to me?" It sounds harmless. It isn't.
What is really happening
The person messaging you has usually already lost their own account to a scammer. The scammer is now trying to register your phone number on their device. WhatsApp sends a verification code to your phone. If you forward it, the scammer takes over your account and locks you out.
Next, the scammer messages your contacts as you: asking for urgent loans, selling fake goods, or repeating the same code trick to spread further.
Two settings that stop it
- Turn on two-step verification. Open WhatsApp → Settings → Account → Two-step verification → Turn on. Choose a 6-digit PIN that nobody knows and add a recovery email. Even if someone gets your SMS code, they'll also need this PIN.
- Protect your voicemail. Some attackers request the verification code by voice call when you don't answer, then listen to your voicemail. Set a voicemail PIN that isn't the default, or turn voicemail off.
Simple rules for everyone
- Never share a verification code with anyone, even family.
- If a friend suddenly asks for money on WhatsApp, call them on their usual number before sending anything.
- Be suspicious of group messages asking you to "vote" or "confirm" by sending a code.
If your account has already been taken
- Reinstall or reopen WhatsApp and register with your phone number. You'll receive a new code by SMS, and registering logs the other device out.
- If you're asked for a two-step PIN you never set, the scammer set it. You may need to wait before you can register again. Keep trying, and contact WhatsApp support from within the app.
- Warn your contacts by SMS, calls and other social media that your WhatsApp was hijacked and they shouldn't send money.
- Once you're back in, turn on two-step verification straight away.
Learn more ways to protect your accounts in our free Cyber Hygiene Quick Start.