Everything here is general guidance, not professional advice. We research carefully and can still be wrong or out of date, so treat it as suggestions to check rather than instructions to follow, and accept that you act on it at your own risk. Full terms.

Disaster Lab
PlaybooksWhatsApp account hacked
Accessserious15 minutes to prepare

WhatsApp account hacked

Someone else is on your WhatsApp, messaging people as you, or your number was registered on a phone you do not have.

01DetectConfirm the signal
02ContainStop more damage
03RecoverRestore control
04VerifyProve it works

What do you need right now?

Your preparation

0 of 0 safeguards ready
0%
Continue the prevention checklist

What this means

WhatsApp is tied to your phone number. Someone else can take it in two ways. They can register your number on their phone, which kicks you out. Or they can link an extra device, so you keep chatting while they read along and message people as you.

The damage is usually the messages, not the chat history. WhatsApp says messages are end-to-end encrypted and stored on the device, so a person who re-registers your number on a new phone cannot read your old conversations. What they can do is text your family and ask for money or a code. People trust a WhatsApp message from you.

This is separate from Instagram, Facebook, X, or TikTok. The recovery is also different from a stolen phone. You need the SIM for this number in a phone you control. WhatsApp says it is not possible to recover the account without that SIM. If the number itself was moved, start with Phone number stolen in a SIM swap.

Warning signs

  • WhatsApp says your phone number was registered on a new device.
  • You are logged out, and the registration code goes somewhere you cannot see.
  • Friends get messages from you that you did not send, often a request for money or a code.
  • Linked devices shows a phone or browser you did not add.
  • You get an email you did not request about resetting a PIN or a registration code.

Recover now

First 15 minutes

  1. Put the SIM for this number in a phone you control. WhatsApp sends the registration code by SMS or phone call to that number. An email address does not replace the SIM. If the SIM is dead or the number has no service, call your carrier before you do anything else in the app.
  2. Re-register the number. Do not start by reporting the account. WhatsApp says that if you report the account you are trying to recover, they might ban it, and you could lose the account or the data. Recover first.
  3. Follow the on-screen recovery if you see it. When the message is “Your phone number was registered with WhatsApp on a new device,” tap Log back in, then Continue. If asked, enter your full international number and tap Next, then Ok.
  4. Enter the 6-digit code from the SMS or the call. WhatsApp says that entering this code logs every other device out of the account, whether or not you know a PIN. Never read that code to anyone, including someone who claims to be from WhatsApp support.
  5. If it asks for a two-step verification PIN you did not set, wait. WhatsApp says that in rare cases the other person turned the PIN on. If you do not have it, wait 7 days and try again. Entering the SMS code still logs them out. Changing a WhatsApp password does not. WhatsApp says passwords and other security features protect an account you still have. Re-registering with the code is what removes the other person.
  6. Tell family and close friends, from another app. WhatsApp’s own recovery page says to do this, because the other person may already be impersonating you in chats and groups.

Today

  1. Open Linked devices and log out anything you do not recognise. Tap the device, then Log Out. WhatsApp recommends this review after you get the account back.
  2. Turn on two-step verification and add an email address you can open, so a forgotten PIN can be reset. The PIN is not the 6-digit registration code. Do not use an email that is already compromised. If that mailbox is suspect, follow Personal email account hacked first.
  3. If WhatsApp is in your Accounts Center or Meta Account, check for a profile you did not add. WhatsApp says another Meta account in that center can be a way back in. Remove WhatsApp from the center until the other accounts are yours again.
  4. Ignore emails you did not request that offer to reset a PIN or send a registration code. WhatsApp says not to click those links.
  5. If you had a Google or iCloud backup, restore chats from that backup only after the account is back on your phone. A backup is optional. The account recovery does not depend on it.
  6. If money was sent because of a message from “you,” treat that as its own incident: Scammed or fraudulent bank charge.

Verify recovery

  • You can open WhatsApp on your phone and send a message that arrives.
  • Linked devices lists only computers and browsers you added.
  • A test registration attempt, if you have a spare phone, demands your PIN or other check, and you can cancel it.
  • A friend confirms they are not still getting requests you did not write.

After recovery

WhatsApp says it cannot tell you who opened the account, or when, or from where. Write down what friends received, and when you re-registered, in case a bank or the police asks later. Block and report the specific chats that were scams. WhatsApp will not block contacts for you.

Prepare now

Access

  • Two-step verification is on, and the email address on the account is one you can still open.
  • You have never saved the registration code or the PIN in a chat, a screenshot, or a note on the lock screen.
  • Linked devices has been checked this month, and old browsers are logged out.
  • WhatsApp is not sitting in a Meta Account next to a profile you do not use.

The number underneath

  • The carrier account has a PIN or an equivalent lock, so the number cannot be moved while you are fixing WhatsApp. The steps live in Phone number stolen in a SIM swap.
  • Voicemail has its own password, so a registration call cannot be picked up by someone else.

Practice

  • You know where Linked devices is, and you have logged a test browser out once.
  • One person you trust knows to ignore a WhatsApp message from you that asks for money or a code, and to reach you another way.

Common mistakes

  • Reading the 6-digit code to a caller. That code is the login. WhatsApp says not to share it with friends or family either.
  • Reporting the account before you re-register. WhatsApp warns that a report can get the account banned while you are trying to get it back.
  • Changing the password and stopping there. WhatsApp says a password change does not remove someone who already has the account.
  • Trying to recover without the SIM. WhatsApp says recovery needs a SIM with the same number. Order a replacement from the carrier. Do not buy a “recovery service.”
  • Assuming your old chats were read. On a fresh registration they were not, unless they were in a backup the other person could open, or a linked device was already connected.

Sources

Last reviewed October 31, 2026Guidance changes. Confirm provider-specific actions in the linked official sources.