WhatsApp Account Hacked? How to Recover It Step by Step (2026)

WhatsApp suddenly logged you out. Or friends are asking why you messaged them for money. Or you open the app and it wants a six-digit PIN you never set. These are the classic signs of a WhatsApp takeover — and the good news is that WhatsApp accounts are tied to your phone number, so you can usually get yours back. Here’s exactly what to do, in order.

How to Tell If Your WhatsApp Has Been Hacked

• You’re suddenly logged out with a message that your number is registered on another device
• Contacts receive messages you didn’t send — often urgent requests for money or OTPs
• Unknown devices appear under Settings → Linked devices
• Your profile photo, name or about text has changed
• WhatsApp asks for a two-step verification PIN you never created
• You receive verification codes by SMS you didn’t request

How WhatsApp Accounts Usually Get Taken Over

Most WhatsApp hijacks aren’t clever hacks — they’re tricks to get your verification code. Common ones include:

• The “I sent my code to you by mistake” message from a friend’s (already hacked) account asking you to forward a 6-digit code
• Fake support or delivery calls asking you to read out a code “to verify” something
• Voicemail hijacks — attackers request a voice-call code and retrieve it from a voicemail with a default PIN
• Linked-device QR scams — getting you to scan a code that links your account to their WhatsApp Web
• SIM swaps — convincing your carrier to move your number to their SIM

For a deeper look at the tricks, see how WhatsApp accounts get hacked.

Step-by-Step: How to Recover a Hacked WhatsApp Account

1. Open WhatsApp on your own phone (reinstall it if you were logged out) and enter your phone number.
2. Enter the 6-digit SMS code WhatsApp sends to your number. According to WhatsApp, anyone using your account is logged out automatically once you verify with this code.
3. If asked for a two-step verification PIN you don’t know, the attacker set one. If you added a recovery email earlier, use the reset link. If not, you must wait 7 days — don’t keep re-trying, which can reset the timer. The attacker can’t use the account during this period either.
4. After 7 days, verify your number again. You’ll be able to get in without the PIN and set your own.
5. Check Linked devices (Settings → Linked devices) and log out of anything you don’t recognise.
6. Contact WhatsApp support from Settings → Help → Contact us, explaining your account was compromised.

Warn Your Contacts Straight Away

While the attacker has access, they’ll usually message your contacts asking for money, UPI payments or verification codes. Post a status or ask a family member to message your groups: “My WhatsApp was hacked — don’t send money or codes to messages from me until I confirm by phone.” This single step prevents most of the damage.

After You’re Back In: Lock It Down

1. Turn on two-step verification: Settings → Account → Two-step verification. Create a 6-digit PIN and add a recovery email.
2. Add a passkey if your phone supports it (Settings → Account → Passkeys) so logging in requires your device’s screen lock.
3. Set a voicemail PIN with your carrier so attackers can’t retrieve voice-call codes.
4. Review privacy settings — who can see your profile photo, last seen and add you to groups. Our guide to WhatsApp privacy settings to change walks through each one.
5. Check your backups are going to your own Google Drive or iCloud account.

If Money Was Taken in Your Name

If contacts sent money to the attacker, they should report it to their bank or UPI app immediately. In India, report cyber fraud on the national helpline 1930 or at cybercrime.gov.in as soon as possible — fast reporting improves the chance of freezing funds. Elsewhere, contact your bank and local police or cybercrime unit. Our guide on UPI scams in India explains what to do next.

If a Friend’s WhatsApp Is Hacked and Messaging You

You’ll often find out about a takeover from the other side: a friend’s account suddenly asks you for money or “a code sent to your phone by mistake.” Here’s how to handle it:

• Don’t reply with any code or money. Treat any request for an OTP as a hijack attempt.
• Call your friend on a normal phone call — not a WhatsApp call — to confirm.
• Report the account from the chat (tap the name → Report) so WhatsApp can act.
• Tell mutual groups that the account is compromised so others don’t fall for it.
• Send them this guide once you’ve confirmed it’s really them on another channel.

If It’s a WhatsApp Business Account

The recovery steps are the same — verify your number with the SMS code and wait out any unknown PIN — but the stakes are higher because customers may be targeted. Post a notice on your other channels (website, Instagram, Google Business Profile) saying your WhatsApp was compromised and customers shouldn’t pay any new payment links until you confirm. Once back in, review your catalogue, quick replies, away messages and business profile for any changes the attacker made, and check that payment details haven’t been swapped.

What If You Can’t Get Your Account Back?

If you’ve regained your SIM and waited the full seven days but still can’t log in, email WhatsApp support from the Help Center with your phone number in full international format and a clear description of what happened. Keep a record of when you first noticed the takeover and any screenshots of suspicious messages sent from your account. In rare cases where the number itself is lost for good, you may need to create a new account with a new number — tell your contacts through other channels so they don’t trust the old one.

• Verify your number with the SMS code to kick the attacker out
• Wait 7 days if the attacker set a PIN you don’t know
• Log out unknown linked devices and contact WhatsApp support
• Warn contacts not to send money or codes
• Turn on two-step verification, a recovery email and a passkey

Frequently Asked Questions

Can I recover WhatsApp without the 6-digit code?

No. You need access to your phone number to receive the SMS or voice code. If your SIM was swapped, get your number back from your carrier first.

Why do I have to wait 7 days?

If someone else enabled two-step verification on your number and you don’t have the PIN or a recovery email, WhatsApp requires a 7-day wait before you can reset it. It’s a security lock that also stops the attacker using the account.

Will I lose my chats?

Your chat history lives on your phone and in your own backup. If you reinstall, restore from your Google Drive or iCloud backup. Messages the attacker received while in control won’t be on your device.

Should I delete WhatsApp and start over?

Usually not. Recovering your existing account keeps your number, groups and contacts intact. Only start fresh if you’ve permanently lost the phone number.

Can hackers read my old WhatsApp messages?

An attacker who registers your number on a new phone typically doesn’t get your old chat history, because it’s stored on your device and your backup. Linked-device access is different, so always check Linked devices.

Can WhatsApp support restore my account faster?

Support can help with unusual cases, but they generally can’t skip the 7-day wait if someone else set a two-step verification PIN. Verifying with your SMS code and waiting it out is the standard route.

The Bottom Line

A hacked WhatsApp is scary, but because the account is tied to your number, the fix is usually to verify with the SMS code, wait out any PIN lock, and then lock things down with two-step verification. Warn your contacts early to stop money scams. For other accounts, see our recovery guides for Google accounts, Instagram and PayPal.

Last updated: October 8, 2026. Source: WhatsApp Help Center — How to recover a compromised account.