With more than two billion users worldwide, WhatsApp is one of the most trusted communication channels on the planet — and scammers know it. A message from your mother’s account asking for emergency money gets answered far faster than a cold call from a stranger. That is precisely why criminals work so hard to hijack WhatsApp accounts: once they control your number, they inherit your identity, your photo, and the trust of everyone you know.
The problem is global and growing. The FBI’s Internet Crime Complaint Center logged 971 SIM swap complaints with $17.37 million in losses in 2025 — and SIM swaps are a classic route into WhatsApp accounts. In the UK, fraud prevention service Cifas recorded nearly 3,000 unauthorized SIM swaps in 2024, a 1,055% jump in a single year. Ghana’s police cybercrime unit received 1,847 WhatsApp account hijacking complaints between January 2023 and December 2024, while in Singapore, at least S$18,000 was lost in cases where hijacked accounts were used to demand fake school fees from parents. Spain’s cybersecurity institute INCIBE found that over 60% of victims only discover the breach after contacts complain about suspicious messages.
Most WhatsApp takeovers need no hacking skill at all — just one moment of misplaced trust. Here is how the scams work and how to shut them out.
How WhatsApp Scams Work
Verification-code theft. The most common takeover starts when a scammer tries to register your phone number on their own device. WhatsApp sends a six-digit verification code to your phone by SMS. Moments later, you get a message — often from a contact whose account is already hijacked — saying something like “I accidentally sent you my WhatsApp code, can you forward it to me?” If you share the code, the scammer completes registration and takes over your account. You never gave them a password; the code was the key.
Linked-device phishing (“ghost pairing”). A more sophisticated variant abuses WhatsApp’s Linked Devices feature. Victims receive a message — frequently from a compromised contact — with a link to vote in a contest or view a photo. The link opens a fake page that asks for a verification code or a QR scan. Entering the code quietly links the attacker’s device to the victim’s WhatsApp, giving them full access to messages and contacts without ever stealing a password. In one 2023 outbreak in Southeast Asia, more than 12,000 users reported unauthorized access after receiving “account verification” texts. German police documented a 2026 wave using fake poll links and QR codes, with victims losing several hundred euros each.
Friend and family impersonation. Once an account is hijacked, the scammer messages the victim’s contacts with urgent money requests: a stranded traveler, a medical emergency, an unexpected fee. Because the message arrives from a real account — with the right name, photo, and chat history — recipients comply without the skepticism they would show a stranger. In Singapore, scammers used hijacked accounts to demand fake course fees from parents, netting at least S$18,000.
Fake investment and trading groups. Victims are added to WhatsApp groups promising extraordinary crypto or forex returns. The group is seeded with fake “members” posting screenshots of profits. After the victim deposits money — often repeatedly, as “fees” and “taxes” pile up — the group vanishes. These groups frequently overlap with pig-butchering operations that begin with a wrong-number message.
Red Flags of a WhatsApp Scam
- You receive a verification code you did not request — followed by anyone asking you to share it, for any reason.
- A contact asks you to vote, click a link, or scan a QR code for a contest, prize, or photo you know nothing about.
- An urgent money request from a friend or family member with pressure not to call and verify.
- Messages about investments with guaranteed returns or screenshots of effortless profits in a group chat.
- Being added to investment or trading groups by strangers.
- A “friend” messaging from a new number claiming their phone broke and asking for money or codes.
- WhatsApp says your number is “no longer registered” on your phone, or friends ask about messages you never sent.
- Anyone offering to recover your hacked account for money or asking for your verification code or PIN to “help.”
How to Stay Safe: Verification Steps
- Enable two-step verification now. In WhatsApp, go to Settings > Account > Two-step verification and set a six-digit PIN. This is the single most effective defense: even with your SMS code, an attacker cannot register your number without the PIN. Add a recovery email address when prompted.
- Never share verification codes or your PIN with anyone — not friends, not family, not “support.” WhatsApp’s own guidance is explicit on this point.
- Check linked devices regularly. Go to Settings > Linked Devices and log out any device or browser session you do not recognize.
- Verify money requests through another channel. If a contact asks for money, call them on their known number or ask a question only they could answer before sending anything.
- Do not scan QR codes or click links from unexpected messages, even from contacts — their account may already be compromised.
- Lock your SIM. Set a SIM PIN with your carrier and ask about number-transfer protections, since SIM swaps are a common route into messaging accounts.
- Keep WhatsApp updated so you always have the latest security fixes.
How to Recover a Hijacked Account
Act quickly — every hour gives the scammer more time to target your contacts:
- Re-register your number. Open WhatsApp on your phone with your SIM inside, tap “Log back in,” enter your number, and type the six-digit code that arrives by SMS or call. Re-registering logs the attacker out of every device automatically. Never share this code with anyone.
- If it asks for a PIN you never set, the attacker enabled two-step verification. You may need to wait seven days before you can re-register without it.
- Log out unknown devices. Once back in, go to Settings > Linked Devices and remove anything unfamiliar.
- Warn your contacts immediately — from another number, by call, or via a status update — that your account was compromised and they should ignore money requests.
- Contact WhatsApp support at support@whatsapp.com with your phone number in full international format if you cannot regain access.
- If your SIM was swapped, contact your mobile carrier immediately to secure your line.
How to Report WhatsApp Scams
- In the app: open the chat, tap the contact or group name, and use Report to flag scams, spam, or impersonation to WhatsApp.
- Block the account after reporting so it cannot contact you again.
- If you lost money: report to your local police or cybercrime authority, and in the U.S. to the FBI’s IC3 at ic3.gov and the FTC at ReportFraud.ftc.gov.
- Warn the impersonated person’s real contacts if a friend’s hijacked account targeted you — they may not know yet.
- Never pay “account recovery services” that demand money, personal information, or verification codes — regulators warn these are scams layered on top of the original hack.
The Bottom Line on WhatsApp Scams
A WhatsApp scam rarely involves real hacking — it involves one shared code, one scanned QR, or one moment of trust in a message that only looked like it came from a friend. The defense is three habits: turn on two-step verification today, treat every verification code like a house key, and verify every money request through a second channel. Do that, and the most common WhatsApp takeovers simply cannot touch you.
Sources
- Archyde/INCIBE, “Social Engineering Attacks Target WhatsApp Verification Codes, INCIBE Alerts” — https://www.archyde.com/social-engineering-attacks-target-whatsapp-verification-codes-incibe-alerts/
- eSIMpy, “Can Someone Steal Your WhatsApp With an eSIM Swap? How the Scam Works and How to Stop It” (2026) — https://esimpy.com/blog/esim-swap-scam-whatsapp
- Pakera, “Recover a Hacked WhatsApp Account in Pakistan: Steps” (2026) — https://pakera.pk/whatsapp-hacked-recover-pakistan/
- Techpoint Africa, “What to do if your WhatsApp account is hacked: step-by-step recovery guide” — https://techpoint.africa/guide/whatsapp-account-hacked-what-to-do/
- YourLifeChoices, “Could one six-digit code give away your WhatsApp account?” (2026) — https://www.yourlifechoices.com.au/technology/could-one-sixdigit-code-give-away-your-whatsapp-account/
- GoodyFeed, “Scammers Hijack Students’ WhatsApp Accounts and Ask Parents for Course Fees; At Least S$18,000 Lost” (2026) — https://goodyfeed.com/scammers-hijack-students-whatsapp-accounts-and-ask-parents-for-course-fees-at-least-s18000-lost/
- Digital Watch Observatory, “Malaysian regulator investigates WhatsApp account hacks” (September 2026) — https://dig.watch/updates/malaysian-regulator-investigates-whatsapp-hacks
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.