WhatsApp code scam: someone's asking for your code
2 November 2026 · Secordit Intelligence
Picture a sole trader who runs a cleaning business from her phone. A message arrives from a regular customer: "Sorry, I sent you a code by mistake. Can you send it back?"
A text has just landed with a six-digit WhatsApp code. She sends it. Within minutes she's logged out of WhatsApp, and her customers start getting messages asking for money.
That's the WhatsApp code scam. It's not a mistake by the customer. Their account was taken over first, and the code was for her account.
Why does a WhatsApp code matter so much?
The six-digit code is how WhatsApp checks that a phone number belongs to you when it's set up on a new phone. Whoever has the code can register your number on their device.
Once they're in, they can message everyone in your chats as you. For a small business, that means customers, suppliers and family. All of them trust your name.
The message asking for the code often comes from a contact you know, because that contact was hacked the same way. That's why it feels safe.
Someone's asking for my WhatsApp code. What should I do?
Don't send it. No genuine friend, customer or WhatsApp itself needs it.
Then check with the person by another route. Ring them, or text their usual number outside WhatsApp. If their account has been taken over, they may not know yet.
How do I stop my WhatsApp being hacked?
Turn on two-step verification in WhatsApp. It adds a PIN or password that you choose. WhatsApp's help page How to manage two-step verification settings explains how to set it up on your phone.
With that PIN or password on, the six-digit code alone usually isn't enough to register your number elsewhere. Add an email address when you set it up, so you can reset the PIN or password if you forget it.
Write the PIN or password down and keep it somewhere safe, away from the phone. A PIN or password you can't remember becomes its own problem.
Do the same for anyone who answers customer messages for you. One weak account on the team is enough.
My WhatsApp has been hacked. How do I get it back?
Work through it in this order.
- Warn your contacts. Use another channel: a text, a call, or a post on your business page. Tell people not to send money or codes to your WhatsApp until you say it's safe.
- Try to get it back. Reinstall WhatsApp on your own phone and register your number. You'll get a fresh code by text. If the attacker set a two-step PIN or password, WhatsApp may make you wait before you can get back in.
- Check your other accounts. If the same phone or email was involved, change passwords and turn on 2-step verification there too. The NCSC's guide to recovering a hacked account covers the main steps.
- Report it. If anyone lost money, they should ring their bank. Report it to Report Fraud (which replaced Action Fraud).
Keep a short note of what happened and when. It helps if a customer or the bank asks later.
Why do small businesses get hit hard?
A personal account that's hijacked embarrasses you. A business account can cost you customers.
Many sole traders run their whole business through one phone number. Bookings, quotes, payments and reminders all go through the same chats. Losing that number for a few days can mean missed jobs and confused customers.
In our view, the account matters more than the app. WhatsApp is one door. Your email, your phone provider and your banking apps are others, and they often reset each other. If you're worried about someone moving your number itself, our guide to SIM swap fraud explains how that works.
What's the one habit worth keeping?
Treat any code you didn't ask for as a key, not a message. Codes are for you to type, never to send.
Say it to your team, and say it to your older relatives. It's a short sentence, and it covers a lot of scams.
WhatsApp code scam: common questions
Is a WhatsApp verification code scam the same as being hacked?
The scam is how it starts. If you send the code, the scammer can register your number on their phone, and that's the account takeover.
What if I sent the code but I'm still logged in?
Turn on two-step verification with a PIN or password, and check Linked Devices in WhatsApp for anything you don't recognise.
Will WhatsApp ever ask me for my code?
No genuine person or company needs the code you were sent. It's for you to type into the app.
Who do I report it to?
If money was sent, ring the bank first. Then report it to Report Fraud (which replaced Action Fraud).
Want the rest of your accounts done too?
If this has made you think about your other accounts, the Account Lockdown Kit takes you through them in order. It covers your email, Apple or Google account, banking apps, WhatsApp and social media. It's a £19 plain-English UK guide. It can't stop every attack, but it shows you how to make the common ways in harder to use.
Sources
- National Cyber Security Centre, Recovering a hacked account
- WhatsApp Help Center, How to manage two-step verification settings
- WhatsApp Help Center, About linked devices
- Report Fraud
Secordit Intelligence Ltd, company no. 17050740