The scam relies on manipulating WhatsApp’s registration process. When you set up WhatsApp on a new device, the app sends a six-digit registration code via SMS to the phone number associated with the account to verify ownership.
Here is a real world example: Have You Been Phoned by These Numbers – 0844024264 and 0846585660?
The scam works in three main phases:
PHASE 1: THE INITIAL CONTACT
The scammer registers your phone number on their device. WhatsApp automatically sends the official six-digit verification code to your phone.
PHASE 2: THE SOCIAL ENGINEERING TRICK
The scammer must convince you to give them that code. They usually do this by impersonating someone you trust or an official entity.
Common tactics used in 2026 include:
The “Friend in Need” Scenario: You receive a message from a contact (whose account has likely already been compromised) saying, “Hey, I’m locked out of my account and I accidentally set my recovery number to yours. You’re about to get a code from WhatsApp—can you please send it to me quickly so I can log in?”
Fake Technical Support: A message appears from an account posing as “WhatsApp Security” or “Meta Support,” often using an official-looking logo. It claims, “Our systems detected a security breach on your account. To verify your identity and prevent immediate deletion, please provide the six-digit code just sent to your device.”
The “Wrong Number” Gimmick: A random, polite message arrives: “Oops, sorry, I think I sent my login code to your number by mistake. Could you please send it back? I need it for my new phone.”
[Image illustrating the step-by-step process: (1) Scammer requests code, (2) Victim receives SMS, (3) Victim forwards code via WhatsApp message, (4) Victim is locked out.]
PHASE 3: THE TAKEOVER AND EXPLOITATION
The moment you send the six-digit code to the scammer, they enter it on their device. WhatsApp logs you out immediately, as the account can only be active on one primary phone at a time.
Once in control, the scammer:
Locks You Out: If you haven’t set up Two-Step Verification, the scammer immediately creates their own 6-digit PIN, effectively barring you from recovering your account for at least seven days.
Defrauds Your Contacts: They message your friends, family, and colleagues, usually with urgent requests for money, claiming an emergency (e.g., “I’m stranded, need cash for a tow truck, please e-wallet me R5000”).
Steals More Accounts: They use your account to launch the same scam against your contacts, rapidly expanding the network of compromised accounts.
HOW TO PREVENT A WHATSAPP TAKEOVER
Preventing this scam requires a combination of technical settings and behavioural scepticism.
1. THE GOLDEN RULE: NEVER SHARE THE VERIFICATION CODE
This is your primary defence. Never, under any circumstances, share the six-digit SMS registration code with anyone, not even friends, family, or people claiming to be from official support. WhatsApp will never ask you for this code via a chat message.
2. ENABLE TWO-STEP VERIFICATION (ESSENTIAL)
This is the single most effective technical defence. Two-Step Verification adds a secondary, user-created 6-digit PIN that is required whenever your number is registered on a new device.
To enable it: Go to WhatsApp Settings > Account > Two-Step Verification > Enable.
Why it works: Even if a scammer manages to steal your SMS registration code, they cannot complete the login without your unique secondary PIN.
3. BE HIGHLY SKEPTICAL OF URGENT OR UNUSUAL REQUESTS
If a contact makes an unusual request (especially involving money or security codes), even if it sounds like them, be suspicious.
April 2026 Warning: Be aware that sophisticated scammers are now using AI-cloned voice notes, derived from short clips on social media, to add legitimacy to their “emergency” claims before switching to text to manage the fraud.
4. VERIFY IDENTITY VIA A SECONDARY CHANNEL
If a friend messages you via WhatsApp asking for money or a security code, call them on their actual cellular number or a different messaging app to confirm the request is genuine. Do not rely on the chat window that might already be compromised.
WHAT TO DO IF YOUR ACCOUNT IS TAKEN OVER
If you have fallen victim to this scam, take immediate action:
Try to Re-Register Immediately: Open WhatsApp on your phone and try to register your number again by entering the new SMS code you receive. If the scammer has not enabled Two-Step Verification on their end, you will log them out and regain control instantly.
Contact WhatsApp Support: If the scammer has enabled 2FA (and you are asked for a PIN you don’t know), you will be locked out for seven days. You must contact WhatsApp support immediately via their in-app help (Settings > Help > Contact Us) or website to report the compromised account.
Warn Your Contacts: Use SMS, social media, or phone calls to alert your friends and family that your account has been hacked and that they should ignore any requests for money or codes coming from your WhatsApp number.
WhatsApp Account Takeover Scam