A message lands from a friend or relative: they supposedly sent a verification code to the wrong number by mistake and need you to forward it. Or the phone rings inside WhatsApp itself, and a calm voice claiming to represent technical support wants to “verify” your account. In both scenarios the caller is fishing for the single key that unlocks your identity on the app — and once it is handed over, someone can be messaging your contacts under your name within minutes. The mechanics are unglamorous, the payload is devastating, and the defence takes about ten minutes to configure.
- The core vulnerability: a six-digit SMS registration code is all an attacker needs to install your WhatsApp account on their own handset.
- The fix is optional: two-step verification and passkeys close the gap, but WhatsApp leaves both switched off until the user turns them on.
- Recovery is possible: re-registering your number usually restores access, and past conversations stay on your original device.
- Speed matters: notifying contacts through another channel quickly is what stops the scam from spreading through your address book.
Why one code is enough to lose an account
The number a victim is asked to share is the verification code that WhatsApp sends by SMS to activate the service on a new device. Whoever holds it can complete registration in their own phone, and if no second barrier stands in the way, nothing else is required.
Spain’s cybersecurity institute, INCIBE, has documented the script repeatedly. In a 2020 advisory it described the most widespread version: the request arrives over WhatsApp from a trusted contact who has already fallen victim, which is precisely why the fraud propagates in chains, spreading from one address book to the next.
A more elaborate variant appears in a real case handled by INCIBE’s cybersecurity helpline in September 2024. The victim received a call placed from within the application, coming from a number with a United States prefix. The person on the line introduced themselves as technical support, asked about the brand and model of the handset, and announced that a “six-digit code” would be sent which the user needed to read back. The caller then asked whether a second authentication factor was enabled. Hearing that it was not, they hung up — and from that moment the user lost control of the account.
That final exchange is the most instructive detail of the whole episode: the attacker verified whether a second barrier existed before pressing on. Two-step verification is not a bonus feature. It is what turns a stolen code into a useless one.
The two settings that shut the door
Enable two-step verification and, where the handset supports it, add a passkey. Both are free, both are configured once, and both cover the exact gap this con exploits.
Two-step verification is no longer a PIN. On 25 August 2026 WhatsApp announced that the protection previously delivered by a six-digit PIN becomes a full password — longer, alphanumeric and including symbols. According to the company, it safeguards the account even if somebody obtains a one-time code, and WhatsApp itself joked that this is the signal to stop using “123456”. The change arguably arrives late: a six-digit PIN looked uncomfortably similar to the code users were already handing to fraudsters. Where the app still offers a PIN option, it should be enabled regardless; the announcement gave no deployment timetable.
Passkeys let users sign in with a fingerprint, face or screen lock. In the same announcement WhatsApp stated that more than 1 billion people have already configured one, and that it is now possible to attach several passkeys to a single account — useful for anyone juggling Android and iPhone. The route is Settings, then Account, then Passkeys.
A third layer sits outside the user’s control. Since April 2023, the Account Protect feature lets WhatsApp request confirmation on the old handset whenever somebody tries to migrate the account to a new device. An unexpected prompt means somebody is attempting exactly that.
Already locked out? The recovery playbook
Re-register the number as soon as possible and warn contacts through a different channel. Everything else follows afterwards.
- Register the number again. WhatsApp’s security guidance states that users who have lost access should re-register their phone number, receiving a verification code by SMS — the same class of code the attacker requested. Previous conversations remain on the original phone and cannot be read by the intruder.
- Alert your contacts by call, another app or social media. INCIBE recommends this in both its 2020 advisory and the 2024 case, because the attacker will use the account to request money or further codes from your address book.
- Contact WhatsApp support if recovery fails. INCIBE cautions that the process can take days; in the 2024 case, the helpline also suggested writing to the app’s data protection officer and, if there is no response or a negative one within a month, escalating to Spain’s data protection authority, the AEPD.
- Report the number that contacted you, keep evidence such as screenshots, numbers and timestamps, and file a complaint with the Policía or the Guardia Civil where impersonation or damage has occurred.
- Never pay. Demands for money in exchange for returning an account are discouraged by INCIBE, since payment guarantees nothing and funds the operation.
- Once access is restored, switch on two-step verification — otherwise the same trick can work twice.
For immediate doubts, INCIBE’s 017 line is free and confidential.
What makes this fraud unsettling is not its sophistication, which is minimal, but its strike rate among people who have never encountered it. A six-digit code looks harmless, and the person asking for it is usually somebody you want to help. The technical protection exists, and WhatsApp has just strengthened it, yet it remains strictly opt-in. If you have parents, grandparents or children using the app, this week’s assignment is not explaining the scam to them — it is taking their phone and enabling two-step verification with them watching. Ten minutes of setup outweighs any number of warnings.