Recovering a hacked WhatsApp account: first steps

A WhatsApp account is usually taken in one of two ways: someone obtains the six-digit registration code and registers the number on their own phone, or links an unknown computer to the account. In both cases, the owner of the phone number is in a stronger position than the attacker, as long as they act quickly.

Signs of a hacked account

• WhatsApp logs out, and the message “Your phone number was registered with WhatsApp on a new device” appears;
• a registration code arrives unexpectedly by SMS or call, or a notification that someone is trying to register with the number;
• contacts report that they were asked for money, a code or a vote from the account;
• sent messages, new groups or chats marked as read appear that the owner knows nothing about;
• when re-registering, WhatsApp asks for a two-step verification password that the owner never set;
• an unknown browser or computer is listed among the linked devices.

1. Taking the account back by re-registering

A WhatsApp account can only be registered on one phone at a time. Whoever registers again with the code sent to the number automatically logs out every other device using the account. Changing the password does not replace this: according to the help, a password only protects an account that is still accessible; it does not remove the attacker.

1. If the phone has been logged out, tap “Log back in” or “Log in”, then “Continue”.
2. Enter the phone number in full international format, then tap “Next” and “OK”.
3. Enter the six-digit code received by SMS or call. The code must never be passed on to anyone, not even a family member.
4. If the code does not arrive: The WhatsApp registration code doesn't arrive.

2. If the attacker set a two-step verification password

Attackers often turn on two-step verification so that the owner cannot take the account back. Even this is not fatal: once the six-digit code is entered, the attacker is logged out even if the password is unknown, so they can no longer use the account. Instead of the password, the option to verify another way can be tried. If the attacker entered their own email address, the account can be reset after waiting a few days; the help article on compromised accounts says seven days. Details: Forgotten WhatsApp two-step verification password or PIN.

3. Checking linked devices

If the account works on the phone but a stranger is reading the messages, a linked device (WhatsApp Web or the desktop app) is probably in the background. In this case, re-registering is not needed:

1. On Android, open “Linked devices” from the menu at the top right (three dots); on iPhone, from the “Settings” tab.
2. Tap the unknown device and choose “Log out”. Repeat this for every suspicious device.
3. On a shared or unfamiliar computer, it is a good idea to untick the option to stay logged in on that browser before scanning the QR code.

4. Securing the account

• Two-step verification: under “Settings” → “Account” → “Two-step verification”, set your own password and an email address you can access, replacing the attacker's.
• Passkey: once created under “Account” → “Passkeys”, it allows signing in with a fingerprint or face.
• Voicemail: WhatsApp may also read out the call code to voicemail. If the voicemail is protected with a default or easy-to-guess PIN, it is worth changing it with the carrier.
• Mobile carrier: if the phone suddenly lost signal, someone may also have swapped the SIM card. In that case, call the carrier immediately.

5. Warning contacts

The person who took over the account can write in chats and groups in the owner's name, and typically tries urgent requests for money or codes. It is worth telling family and friends through another channel (SMS, phone, another social network) not to respond to requests coming from the account. Common tricks: Common WhatsApp scams and how to spot them.