WhatsApp takeovers are common in India, and nearly all of them work the same way. Understanding that one method, plus one setting, prevents almost all of them.
The scam behind most takeovers
You get a message from a contact — someone whose account is already compromised — saying they accidentally sent a code to your number and asking you to forward it. That code is the WhatsApp verification OTP for your account. Forward it and the attacker takes over, locks you out, then messages your contacts with the same trick.
Never share a WhatsApp verification code with anyone, including friends and family. WhatsApp never asks for it, and a genuine contact never needs it.
Enable two-step verification — the key step
This adds a six-digit PIN required to register your number on any device. Even if someone gets your OTP, they cannot complete registration without the PIN. Go to Settings, Account, Two-step verification, Turn on. Choose a PIN you will remember and add a recovery email. Two minutes, and it defeats the most common attack.
Check your linked devices
Open Settings, Linked devices and review the list. Log out anything you do not recognise. Worth checking every few months.
Privacy settings worth adjusting
- Profile photo: set to My contacts. Public photos are used to impersonate people.
- Groups: set to My contacts so strangers cannot add you directly.
- Last seen and online: restrict if you prefer not to broadcast your activity.
Scams to recognise
- Family emergency messages from an unknown number claiming to be a relative who lost their phone and needs money. Always verify by calling their known number.
- Job and part-time work offers promising easy income, leading to investment fraud.
- Fake support numbers found by search, where the agent asks you to install a screen-sharing app. No genuine support does this.
The consistent signals are urgency, a request for money or codes, and pressure not to verify elsewhere.
If your account is taken over
- Re-register immediately with your number — this logs the attacker out, since a number can only be active on one primary device.
- If they enabled two-step verification, WhatsApp's recovery process handles it, though it may take time.
- Tell your contacts through another channel to ignore messages from your account.
- Enable two-step verification once you are back in.
