A TikTok creator named Lucy has a simple message for anyone who uses WhatsApp: go and turn on two-step verification, right now. Her mother’s account was hacked over a weekend, and Lucy admits she had no idea the setting even existed. “It literally takes you less than 60 seconds and this could save you so much stress,” she said in the video, which UNILAD Tech picked up yesterday. The comments filled with people saying they’d done it on the spot.
She’s right, and it’s worth understanding why. Most WhatsApp takeovers don’t involve anything you’d call hacking. They involve talking you out of a six-digit code. Two-step verification is the setting that makes that code useless on its own. It won’t stop every attack, though, and the one it misses is getting more common.
The short version
- Turn it on: Settings, then Account, then Two-step verification, then Turn on. Pick a six-digit PIN.
- Add a recovery email. Without one, a forgotten PIN can lock you out for seven days.
- Never share the six-digit SMS code WhatsApp sends you. Not with friends, not with “support.”
- Check Settings, then Linked devices, and log out anything you don’t recognize. Two-step verification doesn’t protect against this.
How WhatsApp accounts actually get stolen
Your WhatsApp account is tied to your phone number. When someone installs WhatsApp on a new phone and enters your number, WhatsApp texts a six-digit registration code to you. Whoever types that code in gets the account. So the whole game for a scammer is getting that code out of you.
The most common trick starts with a message from a friend whose account has already been taken over. “Sorry, I sent you a code by mistake, can you forward it to me?” There is no legitimate reason a friend’s code would ever land on your phone. The code is yours, the scammer requested it, and the moment you forward it, your account moves to their device and you’re logged out. Then the scammer messages everyone in your contacts with the same line, or with a request for money, and the chain continues.
Other versions use fake “WhatsApp Support” messages, fake delivery notices, or a phone call asking you to read out a code for a prize or a verification check. Some attackers request the code by voice call instead of text while you’re busy, hoping it goes to a voicemail box that still uses a default PIN. The goal is always the same: get the code.
What two-step verification actually does
Two-step verification adds a six-digit PIN that you choose. Whenever your number is registered on a new phone, WhatsApp asks for the SMS code and then the PIN. A scammer who talks you out of the SMS code still hits a wall. That’s the whole trick, and it’s why security folks keep pushing it.
There’s a second benefit people miss. When an attacker takes over an account that doesn’t have a PIN, the first thing many of them do is set one. Now even if you re-register your number and get the SMS code back, you can’t get in, because you don’t know their PIN. Setting your own PIN first closes that door.
WhatsApp will occasionally ask you to type your PIN when you open the app. That’s on purpose, so you don’t forget it. It’s mildly annoying, and worth it.
How to turn it on
The steps are the same on iPhone and Android. The only difference is where Settings lives.
| Step | iPhone | Android |
|---|---|---|
| 1. Open Settings | Settings tab, bottom right | Three dots, top right, then Settings |
| 2. Find the option | Account > Two-step verification | Account > Two-step verification |
| 3. Set your PIN | Turn on, enter a 6-digit PIN twice | Turn on, enter a 6-digit PIN twice |
| 4. Add recovery email | Enter and confirm an email you can access | Enter and confirm an email you can access |
| 5. Check linked devices | Settings > Linked devices | Three dots > Linked devices |
Don’t use your birthday, 123456 or the last six digits of your phone number. And do add the email. If you forget your PIN and you didn’t add one, WhatsApp makes you wait seven days before you can reset it. That wait exists to slow attackers down, but it’ll slow you down too.
The attack a PIN won’t stop
This is the part Lucy got exactly right in her video: check your linked devices. WhatsApp lets you use your account on a computer, tablet or browser by linking it to your phone, either by scanning a QR code or by typing in a pairing code. Linking a device doesn’t ask for your two-step PIN.
Attackers have noticed. Late last year, researchers at Gen Digital documented a campaign they called GhostPairing, first seen in Czechia. Victims got a message from a hacked friend, something like “Hey, I found your photo!”, with a link to a fake Facebook-style viewer. The page asked them to “verify” by entering their phone number and then typing a code into WhatsApp. That code was a real pairing request, and typing it linked the attacker’s browser to the account. According to Malwarebytes, the victim’s phone kept working normally while the attacker read their chats in real time.
| Attack | How it works | Does the PIN stop it? |
|---|---|---|
| “Sent you my code by mistake” | You forward your SMS registration code | Yes |
| Voicemail code grab | Code delivered by voice call to an unsecured voicemail | Yes |
| SIM swap | Attacker moves your number to their SIM | Yes, for WhatsApp |
| GhostPairing / QR linking | You approve the attacker’s browser as a linked device | No. Check Linked devices |
| Malware on your phone | Spyware reads messages on the device itself | No. Keep your OS updated |
The rule that covers both kinds of attack is simple: WhatsApp codes are for typing into WhatsApp on a device you’re holding. If a website, a message or a caller asks you to read out, forward or enter a code somewhere else, it’s a scam.
[ ] Two-step verification …… on
[ ] Recovery email …………. added and confirmed
[ ] PIN …………………… not a birthday, not 123456
[ ] Linked devices …………. every entry recognized
[ ] Passkey ……………….. set up if offered (Account > Passkeys)
[ ] Voicemail ……………… custom PIN, not the default
[ ] Phone OS ………………. fully updated
If your version of WhatsApp shows a Passkeys option under Account, set it up too. A passkey lets you verify with your fingerprint, face or screen lock instead of an SMS code, which takes the code-phishing trick off the table entirely. If you’re on Android and want to go further, Google’s Advanced Protection mode locks down the phone itself.
If your account has already been taken
Move fast. Reinstall or open WhatsApp on your own phone and register your number again. When you enter the fresh SMS code, the attacker on the other device gets logged out. If they’ve already set a PIN, you’ll have to wait out the seven-day reset, which is exactly why setting your own PIN first matters. While you wait, warn your contacts through another app or a quick call, so nobody sends money to “you.” If you can’t get back in, contact WhatsApp support from the app’s Help section with your phone number.
Scale is the reason this keeps happening. Meta said it banned more than 6.8 million WhatsApp accounts linked to criminal scam centers in the first half of 2025 alone. Even if WhatsApp catches most of them, the ones that slip through only need one person to forward one code.
Sources and further reading
- UNILAD Tech: WhatsApp users urged to immediately turn on crucial setting that can protect against hackers
- WhatsApp Help Center: About two-step verification
- Malwarebytes: The ghosts of WhatsApp, how GhostPairing hijacks accounts
- Meta: New WhatsApp tools and tips to beat messaging scams
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
