.jpg) |
| WhatsApp Logo | Community resource |
Your friends start asking why you sent them a weird link. Or you open WhatsApp and find yourself logged out with a verification code you never requested sitting in your messages. A hijacked WhatsApp account is unsettling because it's tied directly to your phone number and your closest contacts — but the good news is that recovery is usually fast, and the process is entirely in your hands, provided you still have your original SIM.
Here's exactly what to do, in order.
How WhatsApp Accounts Actually Get Hacked
Understanding the mechanism helps you act correctly. Attackers typically:
- Register your number on their own device, then use social engineering to trick you into reading out the 6-digit verification code sent to your phone.
- Exploit a SIM-swap, convincing your mobile carrier to port your number to a SIM they control.
- Add themselves as a linked device through WhatsApp Web or Desktop if they've had brief physical access to your unlocked phone.
The single most important fact to know: WhatsApp only allows one active session per phone number. Whoever successfully verifies that number is logged in and everyone else is automatically logged out. This is what makes recovery possible.
Step 1: Re-register on Your Own Phone Immediately
If your SIM card is still in your possession (it usually is, since most hacks happen remotely):
- Open WhatsApp (reinstall it if needed) on your own device.
- Enter your phone number with the correct country code.
- Request your 6-digit SMS verification code (a voice-call fallback is available if the SMS doesn't arrive within about a minute).
- Enter the code to log back in.
This single action immediately logs the attacker out, everywhere WhatsApp Web, Desktop, and any other device they had linked.
Step 2: If You're Asked for a PIN You Didn't Set
If the attacker enabled Two-Step Verification with their own PIN after gaining access, you'll be prompted for a PIN you don't know when you try to re-register. Don't panic you've already logged them out by entering the SMS code, even though you can't fully get back in yet.
Tap "Forgot PIN?" From here, two scenarios apply:
- If you had a recovery email set up before the hack, WhatsApp will send a reset link to that email, letting you reset the PIN and regain full access right away.
- If no recovery email was set (or the attacker replaced it), you'll need to wait 7 days before the PIN requirement is automatically lifted. Importantly, WhatsApp confirms that nobody, including the attacker can access the account during this waiting period, so the clock is working in your favour, not against you.
Step 3: Log Out All Other Sessions
Even after re-registering, check for any devices still linked to your account:
- Android: Tap the three dots (⋮) in the top right → Linked Devices → tap each device → Log out.
- iPhone: Tap Settings → Linked Devices → tap each device → Log out.
This closes any lingering access through WhatsApp Web or Desktop that a simple re-registration might not have caught.
Step 4: Warn Your Contacts
While your account was compromised, an attacker may have messaged your contacts asking for money, sent suspicious links, or impersonated you in an emergency. Send a quick heads-up, a broadcast message or a few personal calls to close family so nobody acts on messages sent during the hack.
Step 5: Lock the Account Down for Good
Once you've regained control, take these steps immediately:
- Enable Two-Step Verification yourself: Settings → Account → Two-step verification → set a 6-digit PIN you'll remember.
- Add a recovery email address under the same menu, this is what lets you reset your PIN instantly if you're ever locked out again, instead of waiting 7 days.
- Consider enabling Passkeys (Settings → Account → Passkeys), which use your device's biometric login (face or fingerprint) instead of an SMS code, this makes SIM-swap attacks far less useful against you.
- Never share a verification code or PIN with anyone, even someone claiming to be from WhatsApp support. WhatsApp never asks for this information.
If Your Number Gets Banned After a Hack
Sometimes an attacker uses a hijacked account to send spam, which can trigger an automatic ban on the number. If you regain access and see a "banned" message, tap Request a Review inside the app and explain that the account was compromised. Reviews are typically processed within about 24 hours.
Frequently Asked Questions
How do I recover my WhatsApp account if it's been hacked? Reinstall WhatsApp (or open it) on your own phone, enter your number, and verify with the SMS code sent to your device. This immediately logs the attacker out.
What if the hacker set a Two-Step Verification PIN I don't know? Tap "Forgot PIN?" If you had a recovery email set up beforehand, you can reset it immediately. Otherwise, you'll need to wait 7 days, during which no one, including the attacker can access the account.
Is there an official WhatsApp support team that can recover my account faster? No. Re-registering with the SMS code is the only official, WhatsApp-sanctioned recovery method, there's no separate recovery form or support agent who can bypass this process. Be cautious of any third party or "recovery service" promising a faster fix.
How can I stop this from happening again? Enable Two-Step Verification with a PIN and a recovery email, and never share your verification code with anyone, no matter how convincing the request sounds.
Will I lose my chat history when I recover my account? No, provided you have backups enabled (Google Drive on Android or iCloud on iPhone). Your chats remain private to your own device and aren't visible to the attacker even while they had access to the account.
Source: WhatsApp Help Center (faq.whatsapp.com).
Related reading: How to Spot Online Scams in Nigeria
More on Technology Guides