WhatsApp OTP Scam: How to Stop Your Account Being Hijacked

The WhatsApp OTP scam is one of the fastest-spreading frauds in India, and it turns on a single detail most people misunderstand. The six-digit code WhatsApp sends you by SMS is not a password for you to share, it is the key that installs your account on a phone. Whoever types that code into WhatsApp gets your number. So when a scammer persuades you to read out or forward that code, you are literally handing over your account, and within minutes you can be locked out while they message everyone you know pretending to be you.

The good news is that this scam relies entirely on you sharing a code you were never meant to share. Once you understand the mechanics, and once you switch on one free setting, it becomes very hard for anyone to take your WhatsApp, even if they trick you for a moment.

What is the WhatsApp OTP scam?

It is an account-takeover scam. The fraudster starts the process of registering your phone number on their device. WhatsApp, working correctly, sends the verification code by SMS to your phone, because it belongs to you. The scammer’s whole job is to get that code out of you. They cannot complete the takeover without it.

To get the code, they lie. The most common story is a message from a friend or family member, often someone whose own account has just been hijacked, saying something like: “Sorry, I sent a code to your number by mistake, can you send it back?” Because it comes from a trusted contact, many people forward the code without thinking. That single forward is the whole scam.

How does a WhatsApp account get hijacked?

The takeover follows a short, repeatable chain. Seeing it laid out makes the trick obvious.

1. The scammer enters your number in WhatsApp on their phone and requests a verification code.
2. WhatsApp sends the code to you by SMS, exactly as designed, because it is your number.
3. You receive a message asking for that code, usually from a contact who is already compromised, or sometimes from a fake “WhatsApp support” or a stranger offering a prize or job.
4. You share the code. The scammer enters it and your account activates on their phone.
5. You are logged out. WhatsApp only allows one phone per number, so you lose access instantly.
6. They target your contacts. Posing as you, they ask friends and family for money, or ask them for their codes, spreading the scam through your circle.

This is why the scam grows so quickly. Each stolen account becomes a trusted launchpad to steal the next one. A message asking for a code feels safe precisely because it comes from someone you know.

What are the warning signs of a WhatsApp OTP scam?

A few clear signals tell you a takeover attempt is underway. If you notice any of them, do not share anything and verify through a separate channel.

How do I protect my WhatsApp from being hijacked?

Two habits protect you almost completely. The first is a rule, the second is a setting.

Never share your six-digit code with anyone, for any reason. Not a friend, not “support”, not a job, not a prize. There is no honest situation in which someone else needs the code WhatsApp sent to your phone. Treat it like the key to your front door.

Turn on two-step verification. This is the single most important protection, and it is free. It adds a personal PIN that WhatsApp asks for whenever your number is registered on a new phone. Even if a scammer somehow gets your SMS code, they still cannot complete the takeover without this PIN, which never appears in your SMS and which only you know.

To switch it on, open WhatsApp and go to Settings → Account → Two-step verification → Turn on. Choose a six-digit PIN you will remember but that is not obvious, and add a recovery email address so you can reset the PIN if you forget it. That email step matters, because without it a forgotten PIN can lock you out for days.

A few more sensible steps round out your safety:

• Set a phone lock (PIN, pattern or fingerprint) so a lost or borrowed phone cannot open your WhatsApp.
• Check linked devices under Settings → Linked Devices and log out any you do not recognise.
• Be wary of any code request, even from family. Confirm with a quick phone call before doing anything.
• Keep your SIM secure. A related attack involves porting or swapping your SIM, so treat any sudden loss of mobile signal as a warning sign worth checking with your operator.

These same instincts protect you across other threats too, from phishing messages to the fake customer care number scam, where sharing an OTP is again the fatal step.

What should I do if my WhatsApp is already taken over?

If you are suddenly logged out, or friends tell you that “you” are asking them for money, act quickly and calmly.

1. Reinstall or open WhatsApp and register your number again. WhatsApp sends a fresh code by SMS. Entering it on your phone signs the scammer out, because only one device can hold the account.
2. Enter your two-step PIN if prompted. If the scammer set one and you did not have two-step on before, you may need to wait out a security timer of up to a few days before you can reset without the PIN.
3. Email WhatsApp support at support [at] support.whatsapp.com with the subject “Lost/Stolen: Please deactivate my account”, including your full number in international format, if you cannot get back in.
4. Warn your contacts through calls, SMS or another app, telling them to ignore any money or code requests from your WhatsApp.
5. Report the fraud if money was lost or attempted: call the national cyber helpline 1930 and file at cybercrime.gov.in.
6. Turn on two-step verification the moment you are back in, if it was not already on.

Your old chats are end-to-end encrypted and are not stored on a server, so a scammer cannot read your message history. The real harm is impersonation, which is why warning your contacts fast is as important as recovering the account itself.

What other WhatsApp tricks should I watch for?

Account takeover through the registration code is the most common attack, but a few close cousins use the same instinct to trust a familiar app. Being aware of them rounds out your defence.

• The “hi mum, this is my new number” message. A stranger poses as your child or relative on a new number and, once you reply, asks for an urgent money transfer. Always call the person’s old number to confirm before sending anything.
• Fake WhatsApp support or verification badges. Messages claiming your account will be “suspended” unless you verify are designed to harvest your code or personal details. WhatsApp does not contact users this way inside chats.
• Malicious links promising features or gifts. “Get WhatsApp Gold”, free data, or a prize link can lead to phishing pages or malware. Treat any unexpected link with caution, even from a contact whose account may be compromised.
• Group-invite scams. You are added to a group hyping investments or jobs. These are staged to build false trust, much like the fake job offer WhatsApp scam. Leave and report the group.

The common defence is the same calm habit: do not act on urgency inside a chat, verify through a separate channel, and never share a code or PIN.

Why do scammers want a WhatsApp account at all?

A hijacked account is valuable because it comes with built-in trust. Your friends and family recognise your name and photo, so a request for an urgent money transfer, a “family emergency”, or “please pay this UPI for me” is far more believable coming from your account than from a stranger. The account is also a tool to harvest more codes and keep the chain going. In short, they are not really after your chats. They are after your relationships, which they can turn into money.

The bottom line

The WhatsApp OTP scam depends on one misunderstanding and one moment of haste: believing that six-digit code is something you can safely pass on, and forwarding it before you stop to think. Break either link and the scam fails. Keep your code to yourself, always. Switch on two-step verification today and add a recovery email. And treat any request for a code, even from someone you love, as a reason to pick up the phone and check. For more everyday habits that keep your chats and money safe, see our wider guides on WhatsApp safety and scam awareness.