Security · 16 October 2026

Recover a hacked WhatsApp account calmly, step by step

If your WhatsApp account was just taken over, in most cases you can get it back — and the first step is simple. Reinstall WhatsApp, re-register your own number, and the 6-digit code that arrives by SMS will log the attacker out. Do that before anything else. This page walks you through it in order, using WhatsApp's own official recovery process.

Act now: reinstall and re-register your number

You do not need to wait, and you do not need anyone's permission. If WhatsApp was removed from your phone, reinstall it from your official app store. Open it and register with your own phone number, exactly as before. WhatsApp sends a 6-digit verification code by SMS. Enter it on your phone.

The moment you enter that 6-digit code on your own phone, the attacker's session is logged out. Re-registering your number is what takes the account back.

  1. Reinstall WhatsApp from the official app store if it is gone.
  2. Open it and enter your own phone number.
  3. Wait for the 6-digit code to arrive by SMS and type it in. Do not read it out or share it with anyone — not even someone who says they are WhatsApp support.

You are not alone in this. Italy's Polizia Postale published an alert on 10 October 2026, and Zimbabwe opened a government probe in mid-October 2026 after a wave of WhatsApp account takeovers. The attack is common right now, and it is recoverable. WhatsApp's official guide for a stolen account is here: Recover a compromised account.

Why re-registering works

A WhatsApp account is active on only one phone as its main device, and registering the number is how WhatsApp decides which phone that is. When the attacker stole your account, they registered your number on their phone. When you register it again on yours, the account moves back and their session ends. No one broke WhatsApp's encryption — the attacker tricked someone into handing over a code, and the same code system now hands the account back to you.

If a PIN you never set is blocking you

Sometimes the attacker turns on two-step verification and sets a PIN of their own. When you re-register, WhatsApp then asks for a 6-digit PIN you have never seen. You cannot guess it, and you should not try. Re-register anyway, and wait.

WhatsApp enforces a 7-day wait before it will let the number back in without that PIN. Seven days after your attempt, register again and you will be let in without it. The wait is frustrating, but it is WhatsApp's built-in protection, and it cuts both ways: it is the very rule that stops the attacker from keeping you locked out forever. WhatsApp explains the PIN and this wait here: Two-step verification.

Recover before you report it

It is tempting to report the stolen account to WhatsApp straight away. Do the opposite. Reporting the number first can get it banned, which makes getting back in harder, not easier. Recover the account yourself using the steps above, and only consider reporting afterwards. Recovery comes first.

Warn your contacts

A stolen WhatsApp account is used to message the owner's contacts asking for money, urgently. While you are recovering yours, tell your contacts — by a phone call, a text, or another app — not to send anything, not to pay anyone, and to ignore any urgent money request that appears to come from you. One quick warning can stop the scam from spreading through the people who trust you.

Once you are back in: lock it down

Getting the account back is not the end. Close the door the attacker came through so this cannot happen again:

  1. Set your own two-step PIN. Settings > Account > Two-step verification. Choose a PIN only you know. This is the single strongest protection.
  2. Remove unknown linked devices. Menu > Linked devices. Remove anything you do not recognise — a linked device is how the fake "vote for my friend" trick keeps a foothold on your account.
  3. Review your account activity and profile in case anything was changed while the account was out of your hands.

WhatsApp's guides for both steps: Two-step verification and Linked devices. For the habits that keep this from recurring, read the four rules that stop this happening again.

Need help?

ROSH™ Company Labs helps Moroccan professionals secure and recover their WhatsApp Business accounts, following WhatsApp's own official process. We cannot promise to get an account back — recovery depends on WhatsApp's process — but we can guide you through every step, in Arabic, French and English.

FAQ

Questions people ask about WhatsApp account theft

Someone hacked my WhatsApp — how do I get it back right now?

Reinstall WhatsApp, re-register your own phone number, and enter the 6-digit code that arrives by SMS. Entering that code on your phone logs the attacker's session out and moves the account back to you. Do this before anything else, and never share the code with anyone.

Do I need the 6-digit code to recover my account?

Yes. The code WhatsApp texts to your own number is what proves the account is yours, and entering it on your phone logs the attacker out. Never give that code to a caller or type it into a link, even one that seems to come from a friend — that is how the account was taken in the first place.

It is asking for a PIN I never created. What do I do?

The attacker turned on two-step verification and set their own PIN. You cannot guess it, so do not try. Re-register your number anyway, then wait 7 days — after that WhatsApp lets you back in without the PIN. The wait is annoying, but it is the same built-in rule that stops the attacker from keeping you locked out forever.

How long is the 7-day wait, and can I skip it?

It is exactly seven days from your registration attempt, and there is no way to skip it — it is WhatsApp's built-in protection when a two-step PIN is set. Wait the seven days, register again, and you will be let in without the PIN.

Should I report the hacked account to WhatsApp first?

No. Recover the account first. Reporting the number before you recover it can get the number banned, which makes getting back in harder. Re-register, take the account back, and only consider reporting afterwards.

The hacker is messaging my contacts for money. What should I do?

Warn your contacts right away by a phone call, a text, or another app: tell them not to send anything and to ignore any urgent money request that looks like it is from you. A stolen account is used for exactly this, so a quick heads-up stops the scam spreading while you recover.

Did the hacker break WhatsApp's encryption or read my chats?

No. These attacks do not break WhatsApp's encryption. The attacker tricked someone into handing over a 6-digit code — by a phone call or a fake "vote for my friend" link — and registered the number on their phone. Re-registering on your own phone reverses that.

How do I stop this from happening again?

Once you are back in, set your own two-step PIN (Settings > Account > Two-step verification) and check Linked devices to remove anything you do not recognise. Never give the 6-digit code to anyone, and never enter a code that arrived from a link. Our prevention guide covers the four rules that stop this happening again.