Everyday tech · Security

How to stop your WhatsApp from being hacked

Most WhatsApp accounts in Pakistan aren't broken into with clever software. They're taken over when someone is tricked into sharing a six-digit code. Five minutes of setup makes that far harder.

Updated 2 November 2026 · 4-minute read

In short

Never share the six-digit code WhatsApp sends you by SMS, with anyone, for any reason.
Turn on two-step verification and add an email address.
Check your linked devices now and then, and log out anything you don't recognise.

How the scam works

A scammer starts setting up WhatsApp on their own phone using your number. WhatsApp then sends a six-digit registration code to your phone by SMS. The scammer calls or messages you, pretending to be a courier company with a parcel to confirm, a university checking your degree, a bank, or even a friend, and asks you to read out the code.

If you share it, they log in as you. They then message your contacts asking for urgent loans, or use your account to trick more people. Pakistan's cybercrime agency, the NCCIA, says sharing this code is the biggest reason WhatsApp accounts are hacked.

WhatsApp only ever asks for this code inside the app. No courier, bank, official or friend needs it. If anyone asks, it's a scam.

Step 1: Turn on two-step verification

Two-step verification adds a six-digit PIN that you choose. Even if someone gets your SMS code, they can't set up your number on another phone without the PIN.

Open WhatsApp and go to Settings, then Account, then Two-step verification.
Tap Turn on and choose a six-digit PIN you'll remember. Avoid your birthday or simple patterns like 123456.
Add an email address when asked. If you ever forget your PIN, WhatsApp can send a reset link there.

WhatsApp asks for the PIN now and then so you don't forget it. Without an email address, a forgotten PIN means waiting seven days before you can set up WhatsApp again, and messages that arrive in that time can be lost.

Menu names can differ slightly between Android and iPhone and between app versions.

Step 2: Add a passkey if your phone offers it

Newer versions of WhatsApp let you sign in with a passkey: your phone's fingerprint, face recognition or screen lock. It's quicker than typing a code and can't be read out over the phone. Look for Passkeys under Settings, then Account. It works alongside two-step verification.

Step 3: Check your linked devices

WhatsApp can also run on a computer or tablet linked to your phone. Some scams skip the SMS code and instead trick you into scanning a QR code or typing a pairing code, which links the scammer's device so they can read your chats.

Go to Settings, then Linked devices.
Tap any device you don't recognise and choose Log out.

Never scan a WhatsApp QR code or enter a pairing code because a message or a website asked you to.

Step 4: Tighten your privacy settings

Under Settings, then Privacy, you can choose who sees your profile photo, "About" and last seen, and who can add you to groups. Choosing "My contacts" keeps strangers out of your groups. You can also turn on Silence unknown callers in the calls section, which mutes calls from numbers not in your contacts.

If your account is taken

Open WhatsApp on your own phone and register your number again with the SMS code. Once you enter that code, whoever is using your account is logged out.
If WhatsApp asks for a two-step PIN you never set, the scammer added one. You'll need to wait seven days before you can get back in, but they lose access as soon as you've entered the SMS code.
Warn your contacts by SMS, a call or another app that your account was taken, and that they shouldn't send money to anyone using it.
Report it to the National Cyber Crime Investigation Agency (NCCIA), which handles cybercrime complaints in Pakistan, or to the PTA's complaint line on 0800-55055.