Security · 16 October 2026

WhatsApp account theft: how the scam works, and how to stay safe

A wave of WhatsApp account takeovers is spreading across several countries right now. The attackers do not break WhatsApp's encryption — they trick you into handing over the one code that unlocks your account. Here is exactly how the trap works, and the four steps that keep you out of it.

What is happening right now

Since early August 2026, security teams across Europe and Africa have tracked the same scam moving from one country to the next. In Italy, the Polizia Postale published an alert on 10 October 2026 about a fake dance-contest link that asks people to "vote for a child". In Zimbabwe, the government opened a multi-agency investigation in mid-October after a surge of WhatsApp Business takeovers that one minister called "unprecedented". In South Africa, a version aimed at parents, using a "new number" message, was reported on 16 October 2026.

The important part is what these attacks are not. Nobody is breaking WhatsApp's encryption, and your messages stay private. What the attacker wants is far simpler: the six-digit code WhatsApp sends to confirm it is really you. Hand that over, and they register your number on their own phone — and you are locked out of your own account.

The two traps to watch for

Almost every case comes down to one of two tricks.

  1. The code call. Someone phones you claiming to be from a brand, your mobile operator, or "WhatsApp support". While you are on the call, a six-digit code arrives by SMS. They ask you to read it out or type it in, to "confirm your identity" or "fix a problem". That code is the key to your account. The moment you share it, they register your number on their own phone and you are signed out.
  2. The fake "vote for my friend" link. A contact you trust, whose own account is already stolen, sends you a contest link: vote for their child in a dance competition, help a friend win a prize. The page asks for your phone number, then for a code to "link a device". That code hands the attacker a device connected straight to your account.

Never give the six-digit code to anyone — WhatsApp will never ask you for it.

What the stolen account does next

Once they are in, the attacker becomes you. They message your contacts — family, friends, customers — with an urgent story and a request for money: a quick transfer, a small favour, a code they need forwarded. Because the message comes from your name and your number, people believe it. That is the whole point of stealing the account rather than making a new one.

Four rules that keep your account safe

  1. Never share the six-digit code. Not with a caller, not with a friend, not with anyone claiming to be WhatsApp. WhatsApp never asks for it. If a code arrives that you did not request, someone is trying to take your number — ignore it.
  2. Turn on two-step verification. Open Settings > Account > Two-step verification and set a PIN that only you know. Even if an attacker gets your SMS code, they cannot register your number without this PIN. It is the single strongest thing you can do, and it takes a minute. WhatsApp's guide to two-step verification walks through it.
  3. Never enter a code from a link in a message. No real contest, prize or "device link" needs a WhatsApp code. If a message — even from a friend — sends you to a page asking for your number and a code, stop. That friend's account is most likely already stolen.
  4. Check your linked devices from time to time. Open Menu > Linked devices and look at the list. Remove anything you do not recognise. WhatsApp explains linked devices here.

A word for WhatsApp Business owners

If you run your business on WhatsApp, a stolen account is not just a nuisance — it is lost customers, lost conversations and lost trust, all in someone else's hands. Zimbabwe's investigation centred specifically on business-account takeovers. Turn on two-step verification today, and if more than one person uses the account, make sure every one of them knows never to share a code. If the worst happens, read how to recover a hacked WhatsApp account and follow WhatsApp's official recovery process straight away — the sooner you act, the better your chances.

Need help

ROSH™ Company Labs helps Moroccan professionals secure and recover their WhatsApp Business accounts, following WhatsApp's own official process. We cannot promise a guaranteed recovery — that depends on WhatsApp — but we can guide you through every step, in Arabic, French and English.

FAQ

Questions people ask about WhatsApp account theft

Can someone hack my WhatsApp without my phone?

Not by breaking the encryption. In the current scam they trick you into handing over the six-digit verification code, either during a phone call or by getting you to enter it on a fake page. Without that code — and without your two-step PIN — they cannot register your number on their phone.

Someone is asking me for the 6-digit WhatsApp code. Should I give it?

No, never. WhatsApp never asks for that code, and no real contest or support agent needs it. If someone requests it by call, message or on a web page, it is an attempt to steal your account. End the call or ignore the message.

I got a WhatsApp code by SMS that I did not request. What does it mean?

It usually means someone is trying to register your number on their own phone. Do not share it and do not enter it anywhere. Ignore the message, and turn on two-step verification so that the SMS code alone is never enough to take your account.

What is two-step verification and how do I turn it on?

It is a PIN that WhatsApp asks for before your number can be registered on a new phone. Open Settings, then Account, then Two-step verification, and choose a PIN only you know. It blocks an attacker even if they manage to get your SMS code.

A friend sent me a link to vote in a contest. Is it safe?

Be very careful. In the current wave, stolen accounts send 'vote for my friend' or 'vote for the child' links that ask for your number and a code to 'link a device'. Never enter a WhatsApp code on a page you reached from a link, even one sent by someone you trust.

How do I check if someone else is connected to my WhatsApp?

Open Menu, then Linked devices, to see every device linked to your account. Remove anything you do not recognise. Check this list from time to time, and especially after anything suspicious happens.

Why do attackers steal WhatsApp accounts instead of making fake ones?

Because your contacts trust your name and your number. Once inside, the attacker messages your family, friends or customers asking for money urgently, and people believe the request is really coming from you.

My WhatsApp account was already stolen — what do I do now?

Act quickly. Reinstall WhatsApp and re-register your number, which logs the attacker out, and warn your contacts not to send anything. See our guide on how to recover a hacked WhatsApp account for the full step-by-step process.