How to Recover a Hacked WhatsApp Account (2026 Guide)


Last reviewed: October 1, 2026
Short answer: To recover a hacked WhatsApp account, open the official WhatsApp app on your own phone, enter your phone number and register again with the 6-digit code that arrives by SMS or phone call. According to WhatsApp's Help Center, once you enter that code, anyone else using your account is logged out automatically. Never share the code with anyone, whatever the story.
If the app then asks for a two-step verification PIN that you never created, the person who took the account may have set one. WhatsApp's Help Center says to wait 7 days and try again, and that there is no way to speed this up. In the meantime, tell family and friends that messages from your number may not be from you. Once you are back in, set your own two-step verification PIN, add a recovery email, review linked devices and check your phone number is safe with your mobile carrier.
This guide is for the legitimate owner of an account, or for someone helping a relative. It covers the signs of a takeover, the first ten minutes, a stolen phone or SIM swap, how to lock the account down afterwards, and what to do if money was lost. It draws on WhatsApp's Help Center and security page, the US Federal Trade Commission (FTC), the Federal Communications Commission (FCC), the FBI's Internet Crime Complaint Center (IC3), the UK National Cyber Security Centre (NCSC), the Canadian Anti-Fraud Centre and the Coalition Against Stalkerware. We do not recommend any commercial product or paid service.
This article is general information. WhatsApp features and menus change, so check the official Help Center for the latest steps.
In this guide
- Signs your WhatsApp account has been taken over
- The first 10 minutes: what to do, in order
- If the app asks for a PIN you never set
- Decision table: your situation and what to do
- Lost or stolen phone
- SIM-swap and port-out fraud
- How accounts get taken over, and how to defend against each method
- What the attacker could and could not see
- Securing the account afterwards
- Unknown apps, spyware and stalkerware
- Warning contacts and handling scams sent from your account
- If you or a contact lost money
- Recovery scams: nobody can "hack it back" for a fee
- Reporting to WhatsApp and what support can do
- WhatsApp Business accounts
- Helping an older relative recover
- Hacked, banned or temporarily locked: how to tell
- Prevention checklist
- What not to do
- FAQ
- Bottom line
- Sources
Signs your WhatsApp account has been taken over
The clearest sign is being logged out of WhatsApp on your own phone without doing anything, because your number has been registered on another device. Other signs are messages you did not send, linked devices you do not recognize, and friends telling you that "you" asked them for money or a code.
| What you notice | What it probably means | How urgent |
|---|---|---|
| You are suddenly logged out and the app asks you to register your number again | Your number was registered on another phone. This is a full takeover unless you did it yourself. | Act now |
| Contacts say you asked for money, gift cards, crypto or a 6-digit code | Someone is using your account, or a copy of your name and photo on another number, to scam people. | Act now |
| Messages in your chats that you did not write, or chats marked as read that you never opened | Someone may be reading and writing through a linked device, such as a WhatsApp Web session. | Act now |
| A device you do not recognize in the Linked devices list | A browser or computer is connected to your account. | Log it out immediately |
| A registration code arrives by SMS that you did not request | According to WhatsApp's Help Center, someone entered your phone number and requested the code. It can be a typo by a stranger or an attempted takeover. | Do not share it; stay alert |
| Your phone loses all service for no clear reason | Possibly a SIM swap or port-out. The FTC lists sudden loss of service as a warning sign. | Call your carrier now |
Impersonation is not the same as a hack
Sometimes nobody has broken into anything. A scammer copies your profile photo and name, uses a different phone number and messages your contacts saying "this is my new number." If your own app still works and the scam messages come from a number that is not yours, that is impersonation: warn your contacts, ask them to report and block the fake number inside WhatsApp, and limit who can see your profile photo.
The first 10 minutes: what to do, in order
Re-register your own number in the official app first, because that single step logs the other person out. Then deal with linked devices, the PIN, your contacts and your carrier.
- Open the official WhatsApp app on your phone. Use the copy from your phone's official app store. WhatsApp's security page warns that unofficial versions carry serious privacy and security risks. Do not use a link someone sent you.
- Enter your phone number and request the registration code. WhatsApp's Help Center explains that you confirm you own the number with a 6-digit registration code sent by SMS or phone call. If you previously added and verified an email address, the Help Center says you can also get a registration code by email.
- Enter the code yourself, on your own phone. According to the Help Center, when you re-register with the 6-digit code, all devices logged in to your account are logged out automatically, including the person who took it.
- Do not share that code with anyone. The Help Center is blunt: never share your 6-digit registration code. Not with a friend, not with someone claiming to be WhatsApp support, not with a caller who says it was sent to you by mistake.
- If you are asked for a two-step verification PIN you do not know, stop guessing. See the next section. This usually means the other person turned on two-step verification.
- Once you are in, check Linked devices. In WhatsApp settings, open Linked devices, tap anything you do not recognize and log it out. Re-registering should clear them, but confirm with your own eyes.
- Turn on two-step verification with your own PIN and add an email address. This stops the same trick working twice.
- Tell your contacts. The Help Center recommends notifying family and friends, because the person using your account could impersonate you in chats and groups. Use a phone call, SMS, email or another platform if WhatsApp is not yet back.
- If your phone has no service, call your carrier from another phone. A takeover that happened without you sharing a code may involve your phone number itself. See the SIM-swap section.
If you still have access but something feels wrong
If the app still works on your phone, you do not need to re-register. Go straight to Linked devices and log out everything you do not recognize, then turn on two-step verification, then review the security steps later in this guide. The NCSC gives the same general advice for any hacked account: log out all devices, turn on two-step verification, update your software and tell your contacts.
If the app asks for a PIN you never set
A PIN prompt after you enter the SMS code means two-step verification is switched on for the account. If you did not set it, the attacker probably did, and WhatsApp's Help Center says you should wait 7 days and try again.
What the Help Center says about the waiting period
- If you do not know the PIN and someone else using your account might have enabled it, wait 7 days and try again.
- If you cannot reset the PIN by email, you need to wait 7 days. The Help Center describes the 7-day period as beginning from the last time the account successfully connected to WhatsApp.
- For security reasons, there is no option to speed up the 7-day timeframe or to disable the account once two-step verification is enabled.
- Even while you wait, the Help Center explains that entering the 6-digit SMS code logs out anyone using your account. So the other person loses access as soon as you enter the code, even if you cannot get in yet.
If you set the PIN yourself and forgot it
If the PIN is yours, look for the option to reset it. The Help Center says that if you provided an email address when you set up two-step verification, or added one in WhatsApp settings, you can reset the PIN immediately with a reset link sent to that address. Only use a reset email that you requested yourself from inside the app.
What to do during the wait
- Warn contacts by other channels and ask one trusted person to post a warning in shared groups.
- Secure your phone number with your carrier and secure your email account, since both are routes back into WhatsApp.
- Set a reminder for the day the wait ends, then register again and set your own PIN straight away.
Decision table: your situation and what to do
The right first move depends on whether you still have the app, the phone and the phone number. Find your row and start there.
| Your situation | Do this first | Then |
|---|---|---|
| You still have access, but saw strange messages or an unknown linked device | Open Linked devices and log out every device you do not recognize. | Turn on two-step verification, add an email, set a screen lock and app lock, warn anyone who received odd messages. |
| You are locked out; your phone and SIM still work | Re-register in the official app with your number and the 6-digit code. | Check linked devices, set your own PIN, tell contacts. |
| You re-registered but are asked for a PIN you never set | Stop guessing. Follow the Help Center guidance to wait 7 days and try again. | Warn contacts by other channels; secure your carrier account and email while you wait. |
| Your phone was lost or stolen | Call your mobile provider to lock the SIM. | Get a replacement SIM with the same number and register WhatsApp on a new phone, or email WhatsApp support as the Help Center describes. |
| Your phone has no service and you suspect a SIM swap or port-out | Call your carrier from another phone and reclaim your number. | When the number is back, re-register WhatsApp, then check bank, email and other accounts that use SMS codes. |
Lost or stolen phone
If your phone is lost or stolen, call your mobile provider first and have the SIM locked, then move your number to a new SIM and register WhatsApp on another phone. That is the fastest way to cut off the old device.
Step 1: lock the SIM with your carrier
WhatsApp's Help Center guidance on lost and stolen phones says to call your mobile provider as soon as possible to lock your SIM card. Once the SIM is locked, the account cannot be verified again on that phone, because verifying requires receiving an SMS or a call.
Step 2: re-register on a new SIM with the same number
The Help Center describes using a new SIM card with the same number to activate WhatsApp on a new phone as the fastest way to deactivate the account on the stolen phone. Ask your carrier for a replacement SIM or eSIM, put it in another phone, install WhatsApp from the official store and register. The old phone is logged out when registration completes.
Step 3: if you cannot get a new SIM quickly, email WhatsApp
The Help Center also describes a second option: emailing WhatsApp support with the phrase "Lost/Stolen: Please deactivate my account" in the body of the email, together with your phone number in full international format. Find the current support address in the Help Center itself rather than from a search result or a message, since scammers publish fake support contacts.
According to that guidance, after deactivation your contacts can still send you messages, which stay pending for up to 30 days. If you do not reactivate the account within 30 days, it is deleted. So treat the email as a stopgap and get your number back on a SIM well inside that window.
Step 4: secure everything else on the phone
- Use your phone maker's official find-and-erase service to lock or wipe the device remotely.
- Change the password for the email and cloud account linked to the phone, and sign the lost device out of them.
- Tell your bank if banking or wallet apps were on the phone.
- Report the theft to the police if you need a reference number for insurance. Our guides on what renters insurance covers and what travel insurance covers explain when a stolen phone may be claimable.
SIM-swap and port-out fraud
The FCC describes two schemes. In a SIM swap, a bad actor convinces your wireless carrier to transfer your service to a phone they hold. In port-out fraud, they pose as you, open an account with a different carrier and have your number transferred to it. Either way, your verification codes start going to them.
The FTC explains why this matters: the scammer, not you, gets your text messages and calls, and with them access to accounts that rely on text-message codes. WhatsApp registration relies on a code sent to your number, which is why a two-step verification PIN is so valuable: it is a second lock that does not depend on your phone number. The FTC lists a phone that suddenly loses service as a warning sign.
What US rules require of carriers
On November 15, 2023, the FCC adopted rules aimed at these scams. According to its announcement, wireless providers must adopt secure methods of authenticating a customer before redirecting a phone number to a new device or provider, and must immediately notify customers whenever a SIM change or port-out request is made on their accounts. Ask your carrier which account locks it offers and how to switch them on.
How to protect your number
| Protection | What it does | Where to set it |
|---|---|---|
| Carrier account PIN or password | Makes it harder for someone to pose as you with the carrier. The FTC recommends setting one. | Carrier app, website or store |
| SIM-change or port-out lock, where offered | Blocks SIM changes and number transfers until you remove the lock yourself. | Carrier account settings; ask the carrier |
| SIM change and port-out alerts | Tells you immediately if a change is requested, so you can react. | Keep carrier contact details up to date |
| WhatsApp two-step verification PIN | Means the SMS code alone is not enough to register your account. | WhatsApp settings |
If your number has been taken
The FTC's steps are: contact your cellular provider immediately to take back control of your number; change your account passwords once you have access again; check your credit card, bank and other financial accounts for unauthorized charges or changes and report any you find; and, in the US, go to IdentityTheft.gov if sensitive information such as a Social Security or account number was exposed. When the number is yours again, re-register WhatsApp and set a PIN before doing anything else in the app.
How accounts get taken over, and how to defend against each method
Most WhatsApp takeovers do not involve breaking encryption or any clever software. They rely on tricking the owner into handing over a code, a scan or a setting. Knowing the patterns is the defense.
WhatsApp's Help Center explains the core point: someone trying to take over your account needs the verification code sent to your phone number, and without it they cannot complete verification. So nearly every scam is a story designed to get that code, or to get control of the number that receives it.
| Common trick | What it looks like to you | How to defend |
|---|---|---|
| "I sent you a code by mistake" | A message, often from a friend's already-compromised account, asking you to forward a 6-digit code that just arrived. | Never share a registration code. The FTC's rule: do not share a verification code with someone if you did not contact them first. |
| Fake support | A message or call claiming to be WhatsApp, Meta, your carrier or your bank, saying your account will be closed unless you confirm a code or PIN. | Real support does not need your code or PIN. Contact support only through the app or the official Help Center. |
| Malicious links | A link promising a prize, a parcel, a new feature or a "verification" page that asks for your number and code. | Do not enter WhatsApp codes on any website. Codes belong only in the official app on your own phone. |
| "Dial this code" calls | A caller asks you to dial a short code "to fix a delivery" or "to activate a service". | Never dial codes a stranger gives you. If you did, ask your carrier to cancel any call forwarding and set a voicemail PIN. |
| QR code and linked-device scams | A page, poster or person asks you to scan a QR code or enter a code "to join", "to vote" or "to verify". | Only link devices you own, starting from Linked devices in your own app. Review the list regularly. |
| SIM swap or port-out | Your phone loses service; codes go to someone else. | Carrier PIN, port-out lock, WhatsApp two-step PIN. |
| Unofficial WhatsApp versions | Modified apps that promise extra features. | Use only the official app. WhatsApp warns that unofficial versions create serious privacy and security risks. |
Why "from a friend" is the dangerous part
The request for a code usually arrives from someone you know, because their account was taken first. That is why one takeover in a family or school group tends to produce several. If a friend asks for a code, money or a vote through a link, call them on the phone before doing anything.
What the attacker could and could not see
Someone who registers your number on their own phone generally cannot read your past conversations, because those messages are stored on your device rather than on WhatsApp's servers. They can, however, receive new messages and write as you until you take the account back.
WhatsApp's Help Center states that WhatsApp is end-to-end encrypted and messages are stored on your device, so someone accessing your account on another device cannot read your past conversations. WhatsApp's security page makes the same point about re-registering: your past conversations remain secure on your device.
| Type of access | What they could likely see or do | What they likely could not |
|---|---|---|
| Registered your number on their phone (full takeover) | Receive new messages sent while they held the account; see the groups you are in and their members; message your contacts and groups as you; change your profile. | Read your earlier chat history, which stayed on your phone. |
| Linked a browser or computer to your account | See chats that sync to linked devices and send messages as you for as long as the link lasted. | Keep access after you log the device out. |
| Had your unlocked phone in their hands | Read anything visible in the app, including photos and documents in chats. | Open chats protected by chat lock or an app lock they could not pass. |
Practical consequences
- If you sent card details, passwords, ID photos or one-time codes in chats that could have been seen, treat them as exposed. Change the passwords and tell your bank.
- Messages that arrived while the attacker held the account may never have reached you. Ask close contacts whether they sent anything important during that time.
- Group members' names and numbers may have been visible. Let group admins know so they can warn members about follow-up scams.
Securing the account afterwards
Once you are back in, spend fifteen minutes on settings: two-step verification with a recovery email, linked devices, backups, locks, privacy and updates. Do the first three before anything else.
Two-step verification PIN and recovery email
WhatsApp's Help Center recommends two-step verification and advises providing an email address in case you forget the PIN. Look for it in the account section of WhatsApp settings. Choose a PIN that is not your birthday, not part of your phone number and not a bank card PIN. Do not share it with anyone, and do not enter it anywhere except the official app.
The email address matters as much as the PIN. With it, a forgotten PIN is a small inconvenience. Without it, a forgotten PIN means waiting. Protect the email account itself with a strong, unique password and two-step sign-in.
Passkeys
WhatsApp's Help Center describes a passkey as a secure way to protect your account that uses your device's built-in security, such as your fingerprint, face or screen lock, to verify your identity. It says that when registering your number or restoring your account, you can use your passkey instead of an SMS code. Availability can vary by device and region, so check the account section of your settings. A passkey cannot be read out over the phone to a scammer, which removes the most common trick.
Linked devices: check them regularly
According to the Help Center, you can link up to four devices to your primary phone. Open Linked devices in settings, tap any device you do not recognize and choose to log out. Make this a monthly habit, and do it immediately after using WhatsApp Web on any computer that is not yours.
End-to-end encrypted backups
A backup in cloud storage is a separate copy of your chats. WhatsApp offers end-to-end encrypted backup, which the Help Center says is protected by a password or a 64-digit encryption key. You will find it under the chat backup settings. Store the password or key somewhere safe. If you lose it, the backup may be impossible to restore.
App lock and chat lock
The Help Center describes app lock as an optional measure so that only you can open WhatsApp, using fingerprint or face recognition on Android, or Touch ID or Face ID on iPhone. Chat lock lets you lock your most personal chats, which are then hidden from the main chat list in a locked chats folder. Neither replaces a strong phone screen lock.
Privacy settings
According to the Help Center, privacy settings let you choose who can see your last seen and online status, profile photo, about information and status, and who can add you to groups. The options are Everyone, My Contacts, My Contacts Except, and Nobody. The Help Center notes that by default any user can see your profile photo and add you to groups. Setting both to My Contacts makes impersonation harder and keeps you out of scam groups.
Update the app and the operating system
The NCSC advises applying updates to your apps and your device's software as soon as they are available, and turning on automatic updates, because updates contain vital security fixes. Update WhatsApp only through the official app store.
Unknown apps, spyware and stalkerware
If someone seems to know what is in your chats even after you have recovered the account and cleared linked devices, consider whether something on the phone itself is reporting to them. Take safety into account before removing anything.
The FTC describes stalkerware as software installed without your consent that can let someone track your location, read your messages and see your photos. This is a different threat from a scammer after money. It usually involves someone who has had physical access to the phone, often a partner, ex-partner or family member.
Possible signs
- The FTC lists a battery that drains unusually fast, unexplained data use, overheating and unexpected shutdowns or restarts.
- The Coalition Against Stalkerware cautions that device signs are unreliable and that their absence does not prove the phone is clean. It considers behavior the more reliable signal: the other person knows things about your phone activity with no logical explanation.
Safety first
Both the FTC and the Coalition Against Stalkerware warn that removing stalkerware may be noticed and could lead an abuser to escalate. If you are in that situation:
- Use a different device that the person cannot access, such as a library computer or a trusted friend's phone, to look for help.
- Speak to a domestic violence advocate and make a safety plan before changing anything. In the US, the FTC points to the National Domestic Violence Hotline at 1-800-799-7233.
- Remember that deleting the software also deletes evidence. The Coalition advises keeping a log of incidents and thinking about evidence before removal.
- If you are in immediate danger, contact the police.
Cleaning the phone
When it is safe to act, the FTC's options are a full factory reset or a new phone, and it advises against restoring from a backup afterwards, because that could bring the stalkerware back. The Coalition also lists scanning with reputable security software and removing hidden apps manually. Afterwards, set a new screen lock that nobody else knows, set the phone to lock quickly, and turn on two-step sign-in for email and other accounts.
Warning contacts and handling scams sent from your account
Tell your contacts quickly, through a channel the attacker does not control, that any request for money, codes or favors from your number was not you. A short, clear message prevents most follow-on losses.
What attackers usually send
- Urgent money requests: "I am stuck, my banking app is down, can you send money to this account and I will repay you tomorrow."
- Code requests: "I sent you a 6-digit code by mistake, can you send it back?" This is how the takeover spreads to the next person.
- Gift cards: a request to buy cards and send photos of the numbers.
- Crypto and investment tips: a "can't miss" opportunity or an invitation to a trading group. Our guide on how to spot a crypto scam covers the red flags.
- Loan or grant offers: an "easy approval" link. See how to avoid loan scams and fake offers.
A message you can adapt
"My WhatsApp account was taken over today. If you got a message from my number asking for money, a code, gift cards or to click a link, it was not me. Please do not reply to it or send anything. If you already sent money or a code, call me and contact your bank right away. I will let you know when the account is safe again."
Send it by SMS, email and any other platform you share with your contacts, and ask one or two trusted people to post it in the groups you are in. When you regain access, post a short all-clear and delete any scam messages still visible in chats.
If a contact shared a code
Tell them to follow the same first-ten-minutes steps in this guide on their own phone, straight away. Their account is probably next.
If you or a contact lost money
Contact the bank, card issuer or payment service immediately, say it was fraud and ask for the payment to be reversed. Then report it to the national fraud reporting body. Speed is the biggest factor in whether money comes back.
The FTC sets out what to ask for by payment method.
| How the money was sent | Who to contact | What to ask for (per FTC guidance) |
|---|---|---|
| Credit or debit card | Your card issuer or bank, using the number on the card | Report the charge as fraudulent and ask for it to be reversed. |
| Bank transfer | Your bank or credit union | Report the transfer as fraudulent and ask the bank to reverse it. |
| Payment app | The app's own fraud team, and the bank or card that funded it | Report the transaction and ask for a reversal. |
| Gift card | The company that issued the card | Say the card was used in a scam and ask for a refund. Keep the card and the receipt. |
| Cryptocurrency | The exchange or service you used to send it | Report the fraud and ask for a reversal. The FTC warns crypto payments lack the legal protections of cards. |
For card payments, our US and UK guide to disputing a card charge explains the process and time limits.
Where to report
- United States: report to the FTC at ReportFraud.ftc.gov. You can also file a complaint with the FBI's Internet Crime Complaint Center (IC3), which describes itself as the central hub for reporting cyber-enabled crime.
- United Kingdom: the NCSC directs victims in England, Wales and Northern Ireland to Report Fraud at reportfraud.police.uk, the national fraud and cybercrime reporting service that many people still know as Action Fraud. In Scotland, the NCSC says to call the police on 101. Tell your bank immediately if money is involved.
- Canada: the Canadian Anti-Fraud Centre says victims should contact local police as soon as possible and also report to the Centre online or by phone at 1-888-495-8501.
- Elsewhere: report to your national police cybercrime unit or consumer protection body, and to your bank.
Keep evidence: screenshots of the messages, the numbers and account details the scammer gave, dates, amounts and transaction references. Take the screenshots before you delete anything.
Recovery scams: nobody can "hack it back" for a fee
Anyone who offers to recover your WhatsApp account or your lost money for an upfront fee is a scammer. This includes "ethical hackers", "recovery agents" and accounts replying to your posts on social media.
The FTC describes recovery scams as schemes that target people who have already lost money, promise to get it back, and ask for payment first under labels such as a processing fee or retainer. Its advice: never pay upfront for help getting money back, do not give out personal or financial information, and be wary of any request for cash, gift cards, cryptocurrency, wire transfers or payment apps.
IC3 adds a specific warning. It says it does not work with law firms, crypto services or other non-law-enforcement entities to recover lost funds, and that IC3 will never directly contact you for information or money. Anyone claiming otherwise is impersonating it.
The honest position is simple. The account is recovered by you, through the app, using your own phone number. The only unavoidable delay is the waiting period WhatsApp sets for a PIN you do not know, and no third party has a faster route.
Reporting to WhatsApp and what support can do
Contact WhatsApp only through the Help option inside the app, the help link on the registration screens or the official Help Center. Support can help with account problems, but it does not replace re-registering your number, and it cannot restore chats that are not in your own backup.
What support can and cannot do
| Support can generally | Support cannot |
|---|---|
| Explain the recovery steps and point you to the correct process | Speed up the 7-day wait for an unknown two-step verification PIN (the Help Center says there is no option to do so) |
| Deactivate an account after a lost or stolen phone request made as the Help Center describes | Read or restore your messages, which are end-to-end encrypted and stored on devices and in your own backups |
| Act on reports about accounts that are scamming people | Get your money back; that is for your bank and the authorities |
| Review a ban when the app offers a review option | Give your account to someone who cannot verify the phone number |
Reporting the scammer
WhatsApp's security page explains that you can report problematic messages, people or businesses and that the sender is not notified, and that blocking stops a contact from messaging or calling you. Ask contacts who received scam messages to report them from inside the chat. If the scammer used a separate number to impersonate you, reporting and blocking that number is the main tool.
WhatsApp Business accounts
A business number is recovered in the same way as a personal one, by registering the number again, but the cleanup is larger because customers, staff and payments are involved. For the WhatsApp Business app:
- Re-register the number and set a two-step verification PIN known only to the owner or a named manager.
- Check the business profile: name, description, address, website, email and catalog items. Attackers sometimes change payment details or links.
- Check automated greeting and away messages and quick replies for inserted links.
- Review Linked devices. Shared shop computers and former employees' laptops are common leftovers.
- Tell customers through your website, email list and social pages that messages sent during the affected period should be ignored, and state how you really take payment.
Businesses that use the WhatsApp Business Platform through Meta's business tools should also secure every admin's login and report the compromise through Meta's official business help channels. If customers were asked to pay a fraudulent account, tell your payment provider and bank. Our guide to card-not-present fraud prevention for small merchants covers related controls. A business may also have legal duties to notify customers or a data protection regulator, so take advice if customer data was exposed.
Helping an older relative recover
Sit with them, in person if you can, and do the recovery on their phone with their SIM. Do not ask them to read codes to you over the phone, because that is exactly the habit scammers exploit.
- Confirm it is really them asking. Call their landline or see them. A message saying "my WhatsApp was hacked, help me" could itself come from the attacker.
- Use their phone. Open the official app, enter their number and let the code arrive on their device. Enter it there.
- Set a PIN they can remember and add an email address. Write the PIN down on paper kept at home, not in the phone's notes. If they do not use email, consider with their agreement using an address they trust and can reach.
- Check Linked devices and privacy settings together. Set groups and profile photo to My Contacts.
- Check for money. Ask gently whether they sent money, codes, card details or ID photos to anyone. If so, call the bank with them.
- Warn their contacts. Family groups, community groups and faith groups are often targeted next.
- Agree a family rule. Nobody in the family will ever ask for a code or urgent money by message. Any such request means a phone call first.
Keep the tone calm. People who feel blamed stop reporting problems, and that helps the next scammer. These scams work on people of every age.
Hacked, banned or temporarily locked: how to tell
A hacked account works for someone else. A banned account works for nobody and shows a message that the number cannot use WhatsApp. A temporary lock shows a timer or a prompt and clears with time or the correct PIN.
| Situation | What you see | What to do |
|---|---|---|
| Taken over | You are logged out; contacts get messages from your number; registering works but may ask for an unfamiliar PIN. | Re-register with the SMS code; wait out the PIN period if needed. |
| Banned | A message that the phone number cannot use WhatsApp, with an option to request a review. | Use the review option. The Help Center says that if no review option is shown, the ban is final. |
| Waiting on a two-step verification PIN | A PIN prompt after the SMS code, with reset options. | Reset by email if the PIN is yours; otherwise wait 7 days and try again. |
| Too many code requests | A countdown before you can request another code. | Wait for the timer. Do not keep retrying. |
| Impersonation | Your app works normally; scam messages come from a different number. | Warn contacts; report and block the number. |
The Help Center's guidance on bans, written for the WhatsApp Business app, says the review is requested inside the app, that most reviews are completed within 24 hours, and that contacting WhatsApp outside the review process does not speed up the decision.
One link between the two problems: an attacker who sends spam from your account can get the number reported. If you recover the account and then find it restricted, use the in-app review and explain that the account was compromised.
Prevention checklist
Ten minutes today prevents most takeovers. Work down this list once, then revisit it every few months.
- ☐ Two-step verification is on, with a PIN that is not a birthday or a bank PIN.
- ☐ A working email address is added to the WhatsApp account.
- ☐ Linked devices show only devices I own.
- ☐ End-to-end encrypted backup is on, and the password or key is stored safely.
- ☐ The phone has a strong screen lock and locks quickly.
- ☐ Profile photo and group settings are limited to My Contacts.
- ☐ WhatsApp and the phone's operating system update automatically.
- ☐ My carrier account has a PIN or password, and any SIM-change or port-out lock is switched on.
- ☐ My email and cloud storage accounts have unique passwords and two-step sign-in.
- ☐ I only use the official WhatsApp app from the official store.
- ☐ My family knows: we never share codes, and money requests get a phone call first.
What not to do
The worst mistakes after a takeover are sharing another code, paying someone to "recover" the account, and guessing the PIN again and again.
- Do not share any code or PIN with anyone, including people claiming to be support.
- Do not pay a "hacker" or recovery service. It is a second scam.
- Do not try to break into the attacker's account or device. It is illegal, it will not work, and it can destroy evidence.
- Do not keep guessing an unknown PIN or hammering the resend button.
- Do not negotiate with or pay the person who took the account. Payment does not return it.
- Do not search for a "WhatsApp support number" and call it. Use the app and the official Help Center only.
- Do not stay quiet out of embarrassment. Your contacts are the next targets.
FAQ
How do I get my hacked WhatsApp account back?
Open the official app on your phone, enter your number and register with the 6-digit code sent by SMS or call. According to WhatsApp's Help Center, entering the code logs out anyone else using the account. Then check linked devices and turn on two-step verification.
Can someone hack WhatsApp with just my number?
Knowing your number is not enough. WhatsApp's Help Center says a person trying to take over your account needs the verification code sent to your phone number, and cannot complete verification without it. That is why scammers try to trick you into sharing the code or try to take control of the number through your carrier. A two-step verification PIN adds a further barrier.
How long does the WhatsApp PIN lockout last?
If you do not know the two-step verification PIN and cannot reset it by email, WhatsApp's Help Center says to wait 7 days and try again. It also says there is no option to speed up that timeframe.
Will I lose my chats?
Not necessarily. Your chat history lives on your phone and in your own backup. If you re-register on the same phone with the app still installed, your chats are normally still there. On a new phone you can restore from your backup if you have one.
Can WhatsApp support restore my account?
Support can guide you and can deactivate an account after a lost or stolen phone request, but recovery itself happens when you register your number again with the code. Support cannot shorten the PIN waiting period and cannot restore messages that are not in your own backup.
Can the hacker read my old messages?
According to WhatsApp's Help Center, messages are end-to-end encrypted and stored on your device, so someone accessing your account on another device cannot read your past conversations. A device that was linked to your account, or someone holding your unlocked phone, is a different case and may have seen synced chats.
I got a WhatsApp code I did not request. Am I hacked?
No, not from the code alone. It means someone entered your number and requested a code. Do not share it. If someone then messages or calls asking for it, that is the scam. Turn on two-step verification now.
I gave someone my code. What now?
Act immediately. Open WhatsApp, register your number again and enter the new code yourself. If you are asked for a PIN you did not set, follow the 7-day guidance. Warn your contacts at once by SMS or phone.
Does two-step verification stop SIM-swap attacks on WhatsApp?
It greatly reduces the risk. A SIM swap gives a criminal your SMS codes, but with two-step verification on they would also need your PIN. Add a carrier PIN and a port-out lock to protect the number itself.
My phone was stolen. How do I stop the thief using my WhatsApp?
Call your carrier to lock the SIM, then get a replacement SIM with the same number and register WhatsApp on another phone. The Help Center also describes emailing support with the phrase "Lost/Stolen: Please deactivate my account" and your number in full international format.
Should I change my phone number after a hack?
Usually not. Once you have re-registered, set a PIN and secured your carrier account, the number is safe to keep. Changing numbers causes its own problems with banks and other accounts. Consider it only if harassment continues or your carrier cannot secure the number.
Is it safe to pay someone online to recover my WhatsApp?
No. The FTC warns against paying upfront for recovery help, and IC3 says it does not work with outside services to recover funds. Offers to "hack back" an account are scams.
Where do I report a WhatsApp scam?
Report the chat or number inside WhatsApp. If money or personal data is involved, report to the FTC and IC3 in the US, Report Fraud in the UK (police on 101 in Scotland), the Canadian Anti-Fraud Centre and local police in Canada, or your national equivalent, and tell your bank.
Bottom line
A WhatsApp takeover feels alarming, but the route back is short. Register your own number again in the official app, enter the code yourself, and the intruder is logged out. If a PIN you never set blocks you, the wait is 7 days according to WhatsApp's Help Center, and nobody can sell you a shortcut. Tell your contacts early, because the real damage is usually the money they are asked to send.
Then make it hard to repeat: a two-step verification PIN with a recovery email, a clean linked devices list, encrypted backups, a locked-down carrier account and a family rule that codes are never shared. If money was lost, go to the bank first and the official reporting bodies second, and ignore anyone who offers to recover it for a fee.
Official sources referenced in this guide
Statements attributed to the WhatsApp Help Center come from its articles on recovering a compromised account, two-step verification, lost and stolen phones, linked devices, passkeys, encrypted backup, privacy settings and account bans. Confirm the current steps in the Help Center inside the app, as menus change.
- WhatsApp Help Center - How to recover a compromised account
- WhatsApp - Security
- FTC - How To Recover Your Hacked Email or Social Media Account
- FTC - Use Two-Factor Authentication To Protect Your Accounts
- FTC - SIM Swap Scams: How to Protect Yourself
- FTC - What To Do if You Were Scammed
- FTC - Refund and Recovery Scams
- FTC - Stalkerware: What To Know
- FCC - FCC Adopts Rules to Protect Consumers' Cell Phone Accounts (November 15, 2023)
- FBI - Internet Crime Complaint Center (IC3)
- NCSC (UK) - Recovering a hacked account
- NCSC (UK) - Top tips for staying secure online
- Canadian Anti-Fraud Centre - Report fraud and cybercrime
- Coalition Against Stalkerware - Information for survivors

