WhatsApp Hacked? How to Recover Your Account and Secure It

If your WhatsApp was hacked, open WhatsApp on your own phone, sign in with your phone number and enter the six-digit code sent to you by text. Re-verifying your number on your phone logs the other person out of the account. Then remove any linked devices you don’t recognize, turn on two-step verification with a PIN only you know, and warn your contacts through another channel, because attackers often use a stolen account to ask friends and family for money.

A hacked WhatsApp can be frightening, especially when contacts start receiving messages you didn’t send. The good news is that recovery usually depends on something you still control: your phone number. The steps below use only WhatsApp’s own recovery routes.

How WhatsApp accounts usually get hacked

Knowing how it happened helps you close the gap. The most common routes are:

• The verification code scam. Someone, often posing as a friend whose own account was already stolen, says they sent you a code “by mistake” and asks you to forward it. That code is your WhatsApp registration code, and sharing it hands over your account.
• Voicemail interception. Attackers request the code by phone call when you’re unlikely to answer, then try to access your voicemail using a default or weak PIN.
• Linked device scams. A fake website or message persuades you to scan a QR code, which links the attacker’s computer to your WhatsApp as a WhatsApp Web session.
• SIM swapping. An attacker convinces your mobile carrier to move your number to their SIM card, then receives your codes directly.
• Physical access. Someone with your unlocked phone links a device or reads your chats.

Signs your WhatsApp has been hacked

• You’re logged out of WhatsApp and see a message that your number is registered on another phone.
• Contacts say you’ve been messaging them asking for money, codes or links.
• You see linked devices, such as a computer or browser, that you didn’t add.
• You’ve received verification codes you didn’t request.
• Your phone suddenly has no service, which can be a sign of a SIM swap.

WhatsApp hacked: how to recover your account step by step

1. Open WhatsApp on your own phone with your own SIM card. If you’ve been logged out, reinstall the app from your phone’s official app store if needed.
2. Enter your phone number and verify it with the six-digit code sent by text. WhatsApp’s help center says that when you re-verify your number, the person using your account is logged out.
3. If you’re asked for a two-step verification PIN you didn’t set, the attacker probably set one. WhatsApp’s help center describes a seven-day wait before you can verify without the PIN. The attacker is still logged out when you enter the text code, even while you wait.
4. If the code never arrives, check that your phone has service. If it doesn’t, contact your mobile carrier immediately in case your number has been moved to another SIM.
5. If you still can’t get in, contact WhatsApp support through the Help section of the app or its official help center, and explain that your account was stolen.

No outside company can recover a WhatsApp account for you. People who message you after a hack offering to “restore” it, often for a fee or in exchange for more codes, are running a second scam.

Once you’re back in: lock it down

1. Remove linked devices. In WhatsApp’s settings, open the linked devices list and log out of any computer or browser you don’t recognize. If in doubt, log out of all of them and link your own devices again.
2. Turn on two-step verification. Set a PIN only you know, and add an email address so you can reset the PIN if you forget it.
3. Add a passkey if your phone supports it. WhatsApp supports passkeys on many phones, which lets you verify with your fingerprint, face or screen lock instead of relying only on text codes.
4. Add an email address to your account if WhatsApp offers it on your phone. It can give you another way to verify.
5. Secure your voicemail. Set a strong voicemail PIN with your carrier, or turn voicemail off if you don’t use it.
6. Ask your carrier about account protection. Many carriers offer a PIN or passcode on your account, or a lock on number transfers, that makes SIM swapping harder.
7. Review privacy settings. Consider who can see your profile photo, last seen and about info, and who can add you to groups.

Warn your contacts and limit the damage

A hacked WhatsApp is often used to scam the people who know you best. Common messages include “I’ve lost my phone, this is my new number” and urgent requests for money for a bill or emergency. Our guide to WhatsApp scams covers these and other common tricks.

• Tell people through another channel such as a text, email, phone call or social media post that your WhatsApp was taken over and they should ignore any requests for money or codes.
• Check your groups. Attackers sometimes post in groups or add your account to new ones. Leave groups you didn’t join and let group admins know what happened.
• If anyone sent money, they should contact their bank or payment provider straight away and report it as fraud.
• Keep screenshots of messages sent in your name, in case you need them for a report to police or your bank.

What an attacker can see depends on the situation. Chat history is generally stored on your phone and in your own backup rather than handed to a new device, but an attacker may see messages that arrived while they had control, and anything shared in groups. If you think private photos or messages were taken, plan for the possibility that they could be misused.

A worked example

This is an illustrative scenario, not a real client.

Anita gets a WhatsApp message from her cousin: “Sorry, I sent a code to your number by mistake, can you send it back?” She forwards it. Within minutes she’s logged out, and her friends start receiving messages from her account asking to borrow money urgently.

• She reopens WhatsApp on her phone and re-verifies her number with the text code. The attacker is logged out.
• WhatsApp asks for a PIN she didn’t set. She realizes the attacker set two-step verification, so she follows the on-screen instructions and waits out the reset period. During that time the attacker can’t use her account.
• She posts on her other social accounts and texts close family saying her WhatsApp was stolen and not to send money.
• She calls her cousin by phone, who confirms his account was hacked too.
• Once back in, she checks linked devices, sets her own PIN, adds her email address and a passkey, and sets a voicemail PIN with her carrier.

One friend had already sent money. He reports it to his bank the same day, which gives him the best chance of recovering it.

Other accounts to check

If the attacker got into WhatsApp through a SIM swap, they may have tried to reset other accounts that use text codes, such as email, banking and social media. Change passwords on your most important accounts, check their security settings, and switch from text-message codes to an authenticator app or passkeys where you can.

If the same people targeted your other accounts, our guides on Instagram hacks and a Facebook account hacked cover those platforms’ official recovery routes. If someone set up a new WhatsApp or social account pretending to be you, see our guide on online impersonation.

Common mistakes after a hacked WhatsApp

• Forwarding a code “for a friend.” This is the most common way accounts are stolen, and it spreads from one contact to the next.
• Deleting the app and waiting. Re-verifying your number quickly is what logs the attacker out. If you want to leave WhatsApp, recover the account first, then follow our guide on how to delete a WhatsApp account.
• Forgetting linked devices. A WhatsApp Web session can let someone read new messages until you log it out.
• Paying a recovery service. Recovery only happens through WhatsApp itself.
• Only warning people on WhatsApp. If the attacker still controls the account, they can delete or reply to your warnings. Use another channel.
• Ignoring a sudden loss of phone service. That can be a SIM swap, and your carrier needs to know right away.

When the hack turns into threats or exposure

Sometimes a stolen account is used to threaten you, demand money to return it, or share private images. If you’re being threatened or extorted, don’t pay, keep evidence, and report it to the police. Our help resources page lists organizations that support people facing online abuse, and our guide to sextortion help covers what to do if intimate images are involved. If messages or material from the hack are spreading online or appearing in search results, our personal reputation management service can help with removal requests and the wider cleanup.

Frequently asked questions

My WhatsApp has been hacked, how do I recover it?

Open WhatsApp on your own phone and verify your phone number with the six-digit text code. That logs the other person out. Then remove unknown linked devices, turn on two-step verification with your own PIN, and warn your contacts through another channel.

What if the hacker set a two-step verification PIN on my account?

You’ll still log them out by re-verifying your number with the text code. Without the PIN, WhatsApp’s help center describes a seven-day wait before you can verify without it. Follow the on-screen instructions and don’t pay anyone who claims they can speed this up.

Can a hacked WhatsApp account read my old messages?

Generally, chat history is stored on your phone and your own backup, not transferred to a new device when someone registers your number. But an attacker may see messages that arrive while they have control, and a linked WhatsApp Web session can show new messages until you log it out.

How do I stop my WhatsApp being hacked again?

Never share your registration code or PIN, keep two-step verification on, add an email and a passkey if available, check linked devices regularly, set a strong voicemail PIN, and ask your carrier to protect your number against SIM swaps.