WhatsApp Account Hijacking

What is it?

Scammers hijack your WhatsApp account by tricking you into giving them your security verification code. Once they take over your account, they lock you out and immediately start messaging all your friends and family, pretending to be you in an emergency and asking them for money.

How it works (The Teardown)

1. The Compromised Friend: A scammer manages to hack into the WhatsApp account of someone you know (a friend or family member).
2. The Request: The scammer, pretending to be your friend, sends you a WhatsApp message saying: “Hey! I’m having trouble logging into my account. I accidentally told WhatsApp to send my 6-digit SMS verification code to your phone number instead of mine. Can you text it to me?”
3. The SMS: At that exact moment, you receive an actual text message on your phone containing a 6-digit code.
4. The Trap: Because you trust your friend, you text them the code.
5. The Reality: The scammer wasn’t trying to log into their account. They were trying to log into your account using your phone number on their device. The 6-digit code you received was WhatsApp confirming your identity. By handing it to the scammer, you just gave them the keys to your account.
6. The Lockout: The scammer logs in, immediately sets up a new PIN, and locks you out of your own account. They then use your account to try the exact same trick on all of your contacts.

How to identify this scam

• The “Accidental Code”: It is impossible to “accidentally” send an SMS verification code to the wrong number on modern apps. If anyone asks you for a 6-digit code sent to your phone, it is a scam attempt 100% of the time.

How to avoid it

• Never share codes: Treat SMS verification codes like your Social Security Number. Never give them to anyone, regardless of who is asking.
• Enable Two-Step Verification: Open WhatsApp, go to Settings > Account > Two-Step Verification and turn it on. This requires you to create a custom PIN. Even if a scammer tricks you into giving them the SMS code, they won’t be able to log in without this secret PIN.

What to do if you are affected

1. Warn your contacts immediately: Use normal text messages (SMS) or social media to tell your close friends and family that your WhatsApp was hacked so they don’t fall for the scammer’s requests for money.
2. Reclaim your account: Reinstall WhatsApp, enter your phone number, and request a new SMS code. When you enter the new code, the scammer will be automatically logged out of your account on their device.