WhatsApp Account Takeover Through a Shared Verification Code by SMS

How it looks by SMS, the red flags and what to do.

SMS scams lean on short, urgent lines and a shortened link. The message looks official because the sender name (header) is shaped to resemble a real organisation. WhatsApp Account Takeover Through a Shared Verification Code is one of the ways this shows up: A stranger or contact asks for the six-digit WhatsApp code you just received. It lets them take over your account and ask your friends for money.

What whatsapp account takeover through a shared verification code looks like by SMS

• A sender name that resembles a bank, courier, tax or utility, or an ordinary mobile number.
• A very short message with a deadline such as "today" or "within 24 hours".
• A shortened or oddly spelled link that does not match the real website.

The scammer first needs a way to reach you and a reason for the code. He starts WhatsApp registration using your phone number, which makes WhatsApp send a code to you by SMS. Then he contacts you, sometimes from a hijacked friend's account, with a quick excuse such as a mistaken code, a contest entry or an offer of verification. The code and the story arrive within minutes of each other.

Red flags to check on the text message

• You receive a verification code you did not request.
• Someone asks you to forward or read out that code.
• The message claims it was sent to you by mistake.
• A contact suddenly sounds rushed and cannot take a normal call.
• The link domain is not the one you type yourself for that organisation.
• The message asks for an OTP, PIN, card number or password.

What to do

1. Never share a verification code with anyone, however well you know them.
2. Turn on two-step verification in WhatsApp settings with a PIN only you know.
3. If you lost access, reinstall WhatsApp, register your number again and enter a fresh code yourself.
4. Delete the message and tell family members who may get the same text.
5. Do not reply, do not tap the link and do not call the number in the message.
6. Open the official app or type the official website yourself to see if there is any real notice.

You can report suspicious SMS and calls on the Sanchar Saathi portal (Chakshu facility) of the Department of Telecommunications.

If money or a code is already gone

1. If you sent money, call 1930 and report at cybercrime.gov.in quickly.
2. If friends sent money, ask them to call 1930 and tell their banks with the UPI references.
3. Change your email password and review which devices are linked to your account.
4. Save screenshots of the fake requests and the sender details before they vanish.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

Paste the message into Scam check in Safeavio Sentinel to see the reasons it looks risky, such as a request for a code. The Family code word in Money Shield helps you verify that a relative who asks for money is really your relative, even if his WhatsApp looks genuine. Safeavio does not read your messages by itself and cannot restore a hijacked WhatsApp account, which must be done in WhatsApp.

Full guide: WhatsApp Account Takeover Through a Shared Verification Code: how it works, signs and what to do. Other channels: WhatsApp, phone call, social media.

Questions