WhatsApp two-step verification: stop account theft

A common way WhatsApp accounts get stolen is simple: someone convinces you to share the six-digit code that WhatsApp sends you by text message. Two-step verification adds a second secret that only you know, a password (a six-digit PIN on older setups), so the code alone is not enough to take your account. Turn it on in Settings, then Account, then Two-step verification. It takes two minutes.

How WhatsApp accounts get stolen

WhatsApp works with one phone number at a time. To set it up on a phone, you type your number and WhatsApp sends a six-digit registration code by SMS or phone call. Whoever enters that code gets the account on their phone, and the other phone is logged out.

So the scam is all about getting that code from you. The classic message is "Sorry, I sent you a code by mistake, can you send it back to me?". It often comes from a friend's account that was already stolen, which is why it feels trustworthy. Other versions pretend to be WhatsApp support, a prize draw, a delivery or a buyer on a sales app asking for "the verification code".

When someone requests a code for your number, WhatsApp also sends you a notification. It can be someone else's typing mistake, but it can also be an attempt to take over your account. Never share the code, not even with friends or family. Without it, nobody can register your number.

WhatsApp can also send the code by voice call, and an unanswered call may go to your voicemail. WhatsApp's own security tips recommend setting a voicemail password that is hard to guess.

What two-step verification does

With two-step verification on, WhatsApp asks for your password when your number is registered on a phone, after the code. A thief who tricks you out of the code still gets stuck at that screen.

WhatsApp used to protect this step with a six-digit PIN. It is now replacing the PIN with a password of at least 8 characters, with at least one letter and one number. If you set a PIN years ago, it still protects you, and WhatsApp's help center explains how to upgrade it to a password.

One limit is important: two-step verification protects an account you still control. It cannot remove someone who has already taken it. For that, see the section on stolen accounts below.

How to turn it on

The menus are almost the same on Android and iPhone. On Android, open the three-dot menu at the top and tap Settings. On iPhone, tap the Settings tab at the bottom, which newer versions show as your profile picture. From there:

1. Go to Account, then Two-step verification. In Spanish, WhatsApp calls these Cuenta and Verificación en dos pasos.
2. Switch on two-step verification.
3. Create a password and type it again to confirm it. Use one you don't use anywhere else, not a birthday or your ID number, and save it in your password manager.
4. Add an email address you can open and confirm it with the six-digit code WhatsApp sends there. You can skip this, but don't: the email is your way back if you forget the password.
5. WhatsApp may offer to mark this phone as a trusted device. That only makes signing in quicker on a phone you use every day.

WhatsApp's help page on managing two-step verification shows the current steps for each type of phone. Every so often WhatsApp will ask for the password to help you remember it.

Check your linked devices

Linked devices are computers and tablets where your WhatsApp is open through WhatsApp Web or the desktop app. Someone who had your phone for a minute, or tricked you into scanning a QR code, can read your chats from a linked device without stealing the account itself.

1. On Android, tap the three-dot menu, then Linked devices. On iPhone, go to Settings, then Linked devices. In Spanish the menu is Dispositivos vinculados.
2. Look at every device on the list.
3. Tap any device you don't recognize and choose Log out. Repeat for each one.

When you use WhatsApp Web on a shared computer, untick the option to stay logged in before you scan the QR code, so the session ends when the browser closes.

Passkeys: signing in with your fingerprint or face

WhatsApp now offers passkeys. A passkey links your account to your phone's own lock: fingerprint, face or screen lock. When you register your number again or restore your account, you can use it instead of waiting for an SMS code, and there is no code for anyone to trick out of you.

1. Go to Settings, then Account, then Passkeys (in Spanish, Llaves de acceso).
2. Tap Create passkey and follow the steps to confirm with your screen lock.

On Android you need Android 9 or later, a screen lock and a password manager account set up, such as the one from Google or Samsung. On iPhone you need iOS 16 or later. Keep two-step verification on as well.

If your account was already stolen

Don't start by changing the password: WhatsApp says that won't remove someone who is already using your account. What removes them is registering your number again on your own phone.

1. Open WhatsApp on your phone and log back in with your number. Enter the new six-digit code you receive by SMS or call. When you do, anyone using your account on another phone is logged out.
2. If it asks for a two-step password you never set, the thief turned it on. WhatsApp's help center says to wait 7 days and try again. The thief is still logged out once you enter the SMS code.
3. Warn your contacts through another channel: an SMS, a social network or a relative. The thief may write to your contacts and groups pretending to be you, usually asking for money or for their codes.
4. Once you're back in, turn on two-step verification, add your email and check your linked devices.
5. If your SIM card suddenly stopped working, call your mobile carrier. You need a working SIM with your number to recover the account.
6. Try to recover the account before reporting it. WhatsApp warns that a reported account may be banned.

WhatsApp's page on recovering a compromised account has the official steps. For the rest, open Scammed or hacked? What now, choose the hacked WhatsApp option and follow it in order. If someone used your account to ask your contacts for money, our guide on where to report a scam lists the official channels by country.

Checklist

• Never share a WhatsApp code, not even with a friend who "sent it by mistake".
• Two-step verification on, with a password you don't use anywhere else.
• An email added, so you can recover the password.
• Linked devices checked, and unknown ones logged out.
• A passkey, if your phone supports it.
• A voicemail password that is hard to guess.

Frequently asked questions

I got a WhatsApp code I didn't ask for. What should I do?

Don't share it with anyone. Someone typed your number, by mistake or on purpose. Without the code they can't register your account, so you stay in control. Check that two-step verification is on.

I forgot my two-step verification password. Can I get back in?

Yes. When WhatsApp asks for it, choose to verify another way, by email, SMS or voice call. If that isn't possible, an option to reset the account appears after a few days, but it may delete messages you received since your last login.

Can a thief read my old chats?

According to WhatsApp, no: messages are stored on your phone, so someone who registers your account on another phone can't read your past conversations. They can see new messages and write to your contacts and groups, so act fast.

Does two-step verification protect my account if someone already has it?

No. It only protects an account you still control. If someone already took it, register your number again on your own phone first, then turn on two-step verification.

Try it

• 1.2Scammed or hacked? What nowSteps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent.