How to Recover a Hacked WhatsApp Account (and Lock It Down Afterwards)

Discovering that your WhatsApp has been hacked — you are suddenly logged out, or friends message to say “your account” is asking them for money — is alarming, because WhatsApp holds so much of our lives. Take a breath. In most cases you can recover a hacked WhatsApp account quickly, and the steps are straightforward. This guide walks you through recovering it, warning the people at risk, and locking it down so it does not happen again.

First, understand why recovery usually works

A WhatsApp account is tied to your phone number, and a number can be active on only one phone at a time. That is the key to recovery: when you register your number again on your phone, the hacker’s session is automatically logged out. So the core of getting back in is simply re-verifying your own number.

Signs your WhatsApp may be hacked

The sooner you notice, the faster you can act. Watch for these signs:

• You are suddenly logged out and cannot log back in, or told your number is registered on another device.
• Friends report receiving money requests, odd links, or “I am in trouble” messages from you that you did not send.
• Messages in your chats are marked read when you did not open them, or messages you did not write appear as sent.
• You receive a WhatsApp verification code by SMS that you did not request — a sign someone is trying to register your number.
• An unfamiliar device shows up under Linked devices.

If you notice any of these, move to recovery straight away rather than waiting to be sure.

How accounts get hacked in the first place

Knowing the method helps you avoid it again. The most common ways are:

• The “send me the code” trick. A scammer, often posing as a friend in trouble, asks you to forward a 6-digit code you “received by mistake”. That code is actually your own WhatsApp verification code — sending it lets them register your number on their phone.
• OTP / verification-code phishing. A fake message or call tricks you into revealing the code.
• Physical access to your SMS. Someone who can see your phone’s messages reads the code.

The lesson threaded through all of these: never share your WhatsApp verification code or two-step PIN with anyone. WhatsApp itself never asks for them. Our reminder on why you should never share an OTP with anyone applies directly here.

Step 1 — Recover the account by re-registering

1. Open WhatsApp on your phone (reinstall it from the official app store if it was removed).
2. Enter your phone number to register.
3. WhatsApp sends a 6-digit code by SMS. Enter it in the app.
4. Once verified, you are signed back in — and the hacker is signed out, because your number is now active on your phone.

Do not share that code with anyone while you do this, even if a message claims to be from WhatsApp or a friend.

Step 2 — If two-step verification is blocking you

Sometimes the hacker turns on WhatsApp’s two-step verification with a PIN you do not know, to keep you out. In that case, when you try to register, WhatsApp will ask for a PIN you do not have. The safeguard is a waiting period — usually up to seven days — after which you can register without the PIN using the SMS code. It is frustrating, but it works. During the wait, do not share any codes, and let your contacts know your account may be compromised.

Step 3 — Warn your contacts immediately

While hacked, your account may have messaged friends and groups asking for money, an OTP, or promoting a scam link. As soon as you are back in:

• Post a clear message to affected chats and groups: any money request or odd link from you recently was a scam, please ignore it.
• Ask anyone who paid or shared a code to report at once — see how to report cyber fraud using 1930 and cybercrime.gov.in.

This protects the people who trust you, which is exactly who the hacker was targeting.

Step 4 — Lock it down so it cannot recur

Recovery is only half the job. Now secure the account:

Step 5 — Report the incident

You can email WhatsApp support from within the app or through their Help Centre to report a stolen account — mention “lost/stolen” and your number in the international format. If the hacker impersonated you to ask contacts for money, or if anyone lost money, also report to 1930 and cybercrime.gov.in. Reporting within the golden hour gives the best chance of a freeze, though recovery of any lost money is never guaranteed.

Do not overlook WhatsApp Web and linked devices

Sometimes an intruder does not take over your number at all — they quietly link your account as an extra device through WhatsApp Web or a linked-device QR code, and read along in the background. This can happen if someone briefly had your unlocked phone, or tricked you into scanning a QR. To shut this down:

1. Open Settings > Linked devices.
2. Review the list. If you see any device or browser you do not recognise, tap it and Log out.
3. Use “Log out from all devices” if you are unsure, then re-link only the devices you actually use.

Make this a habit: check your linked devices every few weeks, and never scan a WhatsApp Web QR code that someone else asks you to scan.

Watch for scams sent from the hijacked account

The reason takeovers matter so much is that your account is trusted by everyone who knows you. A hacker uses that trust to ask your contacts for urgent money, to request a “code” (repeating the same trick on your friends), or to push investment and job scams. If you have been hacked, assume your contacts may have been targeted, and warn them clearly. If you are on the receiving end of such a message from a friend, call them on the phone to verify before doing anything — see our guide on how to spot phishing messages.

What about your chats and backups?

Your message history is stored on your phone and in your own backup, not accessible to the hacker simply from taking over the number, so re-registering restores your normal WhatsApp. If you had a backup, WhatsApp will offer to restore it during setup. Going forward, keep your backup enabled so a future incident is less disruptive.

Helping seniors and less tech-confident family

The “forward me the code” trick is especially effective against older users and anyone who trusts a message that appears to come from family. A simple family rule helps: never send a WhatsApp code to anyone, ever, even to me — I will never ask for it. Pair this guide with our advice on WhatsApp safety for seniors and on recognising scam calls, and walk an older relative through turning on two-step verification today, before anything goes wrong.

Extra habits that keep your account safe

Beyond two-step verification, a few simple habits make a takeover far less likely:

• Lock your phone with a strong PIN, pattern or biometric, and hide message previews on the lock screen so codes are not visible.
• Never read out or forward any code — WhatsApp codes, bank OTPs, or app PINs — no matter who asks.
• Be suspicious of urgency. “Quickly send me the code, I am locked out” is the whole scam in one sentence.
• Review linked devices periodically and remove anything you do not recognise.
• Keep your app updated from the official app store so you have the latest security fixes.

If you use WhatsApp for business or payments

A hijack is more damaging if your account is tied to customers or money. If you run even a small business over WhatsApp, treat two-step verification as essential, not optional, and keep a separate record of customer contacts outside the app so a lockout does not cut you off entirely. If your account handles any payment features, contact your bank or payment provider as well the moment you suspect a compromise, in addition to recovering the account, and warn customers that any payment request sent during the hijack was not from you.

A calm recap

1. Reinstall and re-register your number with the SMS code — this logs the hacker out.
2. If blocked by two-step verification, wait out the reset period and register again.
3. Warn your contacts about any scam messages sent in your name.
4. Turn on two-step verification and add a recovery email.
5. Report to WhatsApp, and to 1930 / cybercrime.gov.in if money was involved.

A hacked account feels like a violation, but WhatsApp is designed so that you — the real owner of the number — can take it back. Move quickly, protect the people who trust you, secure the account, and you will be back in control.

Check what else shares that phone number

Your WhatsApp number is often the key to other accounts too, because many services send login codes by SMS to the same number. After a takeover attempt, it is wise to make sure the rest of your digital life is secure: confirm no one changed your email or phone recovery settings on important accounts, watch your bank and UPI alerts for anything unusual, and change passwords on any account that used SMS codes to that number. If you ever suspect your SIM itself has been compromised — for example your phone loses signal unexpectedly and codes stop arriving — contact your mobile operator at once, as that can be a sign of a SIM-swap attempt behind the account takeover.

This article is general information to help you recover and secure your account, not legal advice. For losses or serious impersonation, use the official channels above.