It starts with a normal-looking message from a friend or someone in one of your WhatsApp groups. At about the same time, you get a text with a 6-digit WhatsApp code. Then the “friend” says they sent their code to you by mistake and asks you to send it back. It isn’t their code. It’s yours. The criminal is trying to log in to WhatsApp with your phone number, and that code is the key (Action Fraud).
How the WhatsApp code scam works
- A hacked account messages you. The criminal has already taken over another WhatsApp account that has you as a contact, and chats to you as that person (Action Fraud).
- Your code arrives. They start registering WhatsApp on their phone using your number, so WhatsApp sends you a 6-digit code by text.
- “Sorry, sent it to you by mistake.” They ask you to forward it. In another version, a caller says the code will “register you” for a group video call (Action Fraud).
- You’re locked out. With the code, they log in as you. They may turn on two-step verification so you can’t get straight back in (Action Fraud).
- Your contacts are next. They message your friends, family and groups, asking for urgent money or for their codes too (Action Fraud).
Unlock the full guide with ImposterWatch Personal, US$9/mo
Members read every guide in full, plus get breach and dark web alerts for up to three email addresses, an AI-powered romance scam check every month, and account recovery help.
Get protected for US$9/month, cancel anytime Already a member? Log in
Warning signs
- You get a WhatsApp code you didn’t ask for, and a contact messages you about it at the same time.
- Anyone asks you to forward, read out or screenshot a code, even a friend or a group admin.
- A friend or family member suddenly asks for money on WhatsApp but avoids a normal phone call.
- Someone says you need to share a code to join a group call, a giveaway or a vote.
How to protect your WhatsApp account
- Never share your registration code with anyone. WhatsApp says not even with friends or family (WhatsApp).
- Turn on two-step verification: Settings > Account > Two-step verification. This adds a PIN that’s needed when your number is registered on a new phone (WhatsApp).
- Add an email address to your account so you can reset that PIN if you need to.
- If a contact makes an unusual request, call them to check it’s really them (Action Fraud).
- Pass this on to parents and grandparents. A message from a “friend” is exactly why this scam works.
If you already sent the code
- Open WhatsApp on your phone (with your SIM in it), tap Log back in, enter your number and the new 6-digit code. WhatsApp says this logs out all other devices using your account (WhatsApp).
- If it asks for a PIN you didn’t set, the criminal set it. Wait 7 days and try again, or use the reset link if your email is linked (WhatsApp).
- Tell your family and friends straight away that your account was taken, so they don’t reply or send money.
- Once you’re back in, turn on two-step verification and check Linked devices for anything you don’t recognise.
- If anyone sent money, they should call their bank immediately, then report it (links below).
Where to report
- US: ReportFraud.ftc.gov and the FBI’s IC3.
- Australia: Scamwatch.
- UK: Action Fraud (or Report Fraud in Scotland via Police Scotland 101).
- Canada: the Canadian Anti-Fraud Centre.
- New Zealand: Netsafe.
Questions
My friend really did message me. How can it be a scam?
Their account has probably been taken over already. Action Fraud says the criminal messages people in the victim’s contacts and groups, so the message comes from a name you know.
What happens if I sent the code?
The criminal can log in to WhatsApp with your number on their phone and lock you out, then use your account to message your contacts, often asking for money.
Can they read my old messages?
WhatsApp says someone who re-registers your account on a new device can’t read your past conversations, because messages are stored on your device. They can send new messages as you.
They set a PIN and I can’t get back in. What now?
Log back in with the 6-digit code sent to your number. WhatsApp says anyone using your account is logged out as soon as you enter that code. If it asks for a PIN you don’t know, wait 7 days and try again, or reset it by email if you linked one.
Get free scam tips
Locked out of WhatsApp, or worried you’re next?
Follow the recovery steps below, then turn on two-step verification. ImposterWatch Personal (US$9/month, cancel anytime) adds AI-powered checks, breach alerts for up to three email addresses and account recovery help.
Hacked Facebook account? Read this guideGet protected for US$9/month, cancel anytimeMore guides
- How to check if an email is really from a company
- How to tell if a call is a scam
- Romance scam warning signs
- How to reverse image search a dating profile
- Military romance scams
- Crypto romance scams (pig butchering)
- Sent money to a romance scammer? What to do now
- Is my online match real? How to check
- Has my email been in a data breach?
- “I have your password” sextortion email scam
- How to tell if an email is a scam
- How to check if a website is fake
- Grandparent and family emergency scams
- Clicked a toll text link? What to do now
- Crypto romance scams: helping a parent
- Tech support pop-up scams
- “Hi Mum” text and WhatsApp scams
- Florida scams: Miami, Orlando and Tampa
- Facebook Marketplace buyer and seller scams
- Task job scams: “earn from home” texts and WhatsApp offers
- Fake bank fraud alert texts (“Did you attempt a purchase?”)
- All guides
General information only, not legal or financial advice. ImposterWatch is operated by Cloud Investments FZE (UAE) and is not a background check or private investigator service.