WhatsApp Account Takeover Through a Shared Verification Code
A stranger or contact asks for the six-digit WhatsApp code you just received. It lets them take over your account and ask your friends for money.
You get a WhatsApp code by SMS that you never asked for. Minutes later a message arrives, often from a person in your contact list, saying 'I sent my code to your number by mistake, please forward it.' It sounds harmless. In truth, the code is the key to your own account. Whoever enters it on a new phone becomes you on WhatsApp, reads your chats and messages your family asking for emergency money.
How the scam works
The scammer first needs a way to reach you and a reason for the code. He starts WhatsApp registration using your phone number, which makes WhatsApp send a code to you by SMS. Then he contacts you, sometimes from a hijacked friend's account, with a quick excuse such as a mistaken code, a contest entry or an offer of verification. The code and the story arrive within minutes of each other.
The pressure is politeness and speed. You are told that a sibling needs the code to log in for an urgent job, or that you have been selected for a free recharge. Because the message comes from a name you know, refusing feels rude. If you hesitate, the sender says it will expire in seconds and sends a second message of thanks. Once you send the digits, WhatsApp moves to his phone and logs you out.
The payoff begins at once. He reads your chats, copies your photos, and sends messages to your contacts and groups claiming an accident or a stuck payment, asking for UPI transfers. He may also set a two-step PIN so that you cannot take the account back easily. Meanwhile each friend who pays loses money, and the chain continues from their accounts too.
An example of what you may see
Example WhatsApp message (invented): 'Hi, sorry to disturb you. I accidentally typed your number when I was logging in and a 6-digit code came to you. Please forward it to me quickly, it will expire in a minute and I need it for my office work. Thanks a lot, you are saving me!' Ten minutes later your phone shows a message that says 'This number is now registered on another phone', and your cousin calls to say you asked him for Rs 15,000.
This example is written for illustration. Real messages change their wording, names and links all the time.
Red flags
- You receive a verification code you did not request.
- Someone asks you to forward or read out that code.
- The message claims it was sent to you by mistake.
- A contact suddenly sounds rushed and cannot take a normal call.
- Your WhatsApp logs out and says the number is registered on another phone.
- Friends report that you asked them for money, but you did not.
What to do right now
- Never share a verification code with anyone, however well you know them.
- Turn on two-step verification in WhatsApp settings with a PIN only you know.
- If you lost access, reinstall WhatsApp, register your number again and enter a fresh code yourself.
- Warn family and groups from another number that your account was misused.
- Tell your contact whose name was used so they can check their own account.
If you already paid or shared a code
- If you sent money, call 1930 and report at cybercrime.gov.in quickly.
- If friends sent money, ask them to call 1930 and tell their banks with the UPI references.
- Change your email password and review which devices are linked to your account.
- Save screenshots of the fake requests and the sender details before they vanish.
National Cyber Crime Helpline: 1930. Report online at cybercrime.gov.in. Do it fast: the sooner your bank is told, the better the chance that money can be held.
Where this scam shows up
Read how it looks on each channel:
How Safeavio helps
Paste the message into Scam check in Safeavio Sentinel to see the reasons it looks risky, such as a request for a code. The Family code word in Money Shield helps you verify that a relative who asks for money is really your relative, even if his WhatsApp looks genuine. Safeavio does not read your messages by itself and cannot restore a hijacked WhatsApp account, which must be done in WhatsApp.
Check it before you tap or pay
Safeavio Sentinel is a made-in-India Android app: paste a message or link, or scan a QR code, and get a plain verdict with the reasons. It helps you spot a scam; it does not promise to stop every one.
Download for AndroidWhat the app does
Google Play listing: coming soon. Today the signed APK is on safeavio.com/download. Android 7.0 or later.
Questions people ask
Why does WhatsApp send a code I did not ask for?
Someone typed your number when trying to register or log in. Do not share the code. Ignoring it is enough, but if a person is pushing you to forward it, you are probably being targeted.
Can I stop someone from taking my account again?
Yes. Switch on two-step verification inside WhatsApp and set a PIN that you do not share. That PIN is asked again when your number is registered on a new phone, which blocks most code-only takeovers.
My account was taken. How do I get it back?
Install WhatsApp again, enter your number and the new code that arrives by SMS, and complete the PIN step if asked. This logs the other person out. Then warn your contacts that messages from the period were not from you.