WhatsApp Account Hijacking: How the Verification-Code Scam Works and How to Lock Your Account

Last checked: 10 October 2026. This guide summarises security advisories from police and cyber-security agencies in Singapore, Ghana and the UK, plus media reports. I did not find a Nigerian official advisory with Nigerian figures, but the method is the same everywhere. WhatsApp’s menus can change, so follow the labels on your own phone.

Your WhatsApp account is more than a chat app. For many people it holds customers, family, church groups and business contacts, and often links to money requests. That makes it a target. The most common attack needs no hacking skill at all: the scammer simply asks you to hand over a six-digit code. This article explains how the trick works in its main versions, how to lock your account in two minutes and what to do if you have already lost access.

How the verification-code scam works

When someone tries to log in to WhatsApp with your phone number on a new device, WhatsApp sends a six-digit code by SMS to you. The scammer cannot finish logging in without it, so they need you to read it out or forward it. UK fraud reporting centre Action Fraud described the usual pattern: the criminal controls the account of one of your contacts, messages you pretending to be that friend, says they sent you a code by mistake and asks you to send it back. Once you do, the scammer has your account and can lock you out. Singapore’s police say WhatsApp does not ask users to share this code.

The disguises scammers use

• The “I sent it to you by mistake” friend. Described by Action Fraud and in reports from several countries. If the message comes from a contact, it may be a hijacked account.
• The fake “support” or “security” message. Ghana’s Cyber Security Authority reported cases where victims were told a code had been sent to protect their account and were asked to share it.
• The money story. The same Ghana advisory describes victims told they had received a mobile money transfer and had to reveal the code to collect it.
• The group-link trick. Victims were also sent links in WhatsApp groups and asked to enter or share a code to “update” their information. Another police warning describes a fake screenshot of a code posted in a group, so that members who replied received real codes of their own.
• The voicemail trick. Singapore’s Cyber Security Agency explains that scammers can force a voice call with the code and then get it from your voicemail if you still use the default voicemail PIN.

Ghana’s authority said it had recorded 187 such reports by April 2024, equal to the whole of 2023. That is a Ghanaian figure and not a Nigerian one, but it shows how fast the method spreads.

Lock your account in two minutes

1. Open WhatsApp and go to Settings, then Account, then Two-step verification, and choose Enable.
2. Create a six-digit PIN that is not your birth year, phone number or a simple pattern.
3. Add an email address you can access. Guides recommend this so that you can reset the PIN if you forget it, and it helps protect the account.
4. Write the PIN somewhere safe. Do not share it with anyone either.

With two-step verification on, a stolen SMS code alone is not enough to take over the account, because the scammer also needs your PIN.

Other habits that help

• Treat the six-digit code like your bank PIN. Authorities in Ghana advise treating it like a password.
• If a code arrives and you did not request it, do not respond. Someone may be trying to register your number.
• If a friend asks for money, a code or a link, call them or send a voice note. Do not rely on text alone.
• Change the default PIN on your voicemail if your network provides one, as advised by Singapore’s agency.
• Do not click links from unknown senders, since scam messages can lead to fake pages or malware.

If you have already lost the account

1. Install WhatsApp again on your phone and register with your number. You will get a fresh SMS code. Entering it logs the scammer out, according to Singapore’s agency.
2. If the scammer turned on two-step verification and you do not know the PIN, WhatsApp may make you wait seven days before you can register without it. The agency’s advisory mentions this wait.
3. Tell your contacts through another channel that the account was hijacked, so they ignore requests for money or codes.
4. Turn on two-step verification as soon as you regain access.
5. If money was sent, contact your bank or mobile money provider immediately and report to the police.

What we could not confirm

• Nigerian statistics for WhatsApp hijacking. I did not find a recent official Nigerian figure, so I used examples from other countries.
• The exact current wording of WhatsApp’s menus on your phone and the current length of any waiting period, which can change in app updates.
• Whether your mobile network supports voicemail PIN changes, which depends on your provider.

Frequently asked questions

Can WhatsApp staff ask for my code? According to the Singapore police advisory, no. WhatsApp does not ask users to share the six-digit code.

I forwarded the code. Is it too late? Not necessarily. Re-register your number to get a new code, which logs the scammer out, and then enable two-step verification.

Does two-step verification stop all scams? No. It protects against code theft, but it does not stop scams that persuade you to send money or click bad links.

Key takeaways

Never share a WhatsApp verification code, even with someone you know. Turn on two-step verification now, add a recovery email and confirm any money request by a voice call. If you are locked out, re-register your number straight away and warn your contacts.

Sources checked

• Cyber Security Agency of Singapore, advisory on protecting yourself from WhatsApp hijacking
• Singapore Police Force, “New variants of scam involving takeover of WhatsApp accounts” (January 2021)
• Graphic Online and Modern Ghana, reports on Ghana’s Cyber Security Authority advisory on verification codes
• Yorkshire Evening Post, “WhatsApp users warned over scam as Action Fraud advise how to change app settings”
• Telecom Review Africa, report on a police warning about verification-code screenshots
• The Quint, “Six-digit OTP code trap: how scammers hack your WhatsApp account”