At a glanceYes, but the common version of “getting hacked” isn’t WhatsApp’s encryption being broken, it’s someone tricking you into handing over your own six-digit verification code. Once they have it, they register your number on their own device and lock you out. The fix is fast if you act immediately: re-register your own number to force them out, then turn on two-step verification so it can’t happen again.
Educational resource only. This explains how WhatsApp accounts are commonly compromised in India and how to recover one; it is not formal legal advice.
The situation
You suddenly can’t open WhatsApp, it’s asking you to verify your number again, or your contacts start getting strange messages asking for money that you never sent. It feels like a technical hack, but in the overwhelming majority of cases, nobody broke WhatsApp’s encryption. Someone got you to hand over the one thing that actually controls your account: the verification code.
How WhatsApp accounts actually get hacked
The standard method is social engineering, not a technical exploit: someone convinces you to forward your own six-digit code. It typically plays out like this: someone messages you, often appearing to be a contact you know or claiming to have “sent a code to your number by mistake,” and asks you to forward the six-digit code you just received by SMS. That code is actually WhatsApp’s own registration code for your number. The moment you share it, the attacker enters it on their device, registers your number there, and your own WhatsApp instantly logs out, since WhatsApp only allows one active registration per number at a time. From there, they have your account, your profile photo, your chat list of contacts, and your credibility to message people you know asking for money.
Less commonly, someone can gain access without ever contacting you at all: through a SIM swap or a cloned SIM, physical access to your unlocked phone, or spyware installed on your device. These bypass the verification-code step entirely, but they generally take more effort or access than sending a scam message, so they show up far less often in practice.
The warning signs
- You’re suddenly logged out and prompted to re-verify your number, when you didn’t request this yourself.
- You receive a verification code by SMS that you didn’t ask for, especially alongside a message from someone asking you to share or forward it.
- Contacts tell you they received odd messages from your number, often urgent requests for money or gift cards.
What you can do about it: recovering your account
Speed matters here, the fix itself takes only a few minutes.
- Reopen WhatsApp and re-enter your own number. Request a fresh verification code immediately.
- Enter the new code as soon as it arrives. This automatically logs the attacker’s device out, since your number can only be registered on one device at a time.
- Turn on two-step verification right away, under Settings → Account → Two-step verification, and set a PIN only you know. Without this, the same scam can be repeated on you again.
- Check Settings → Linked Devices and remove any session you don’t recognise.
- Tell your contacts what happened, especially if the attacker messaged anyone asking for money in the window your account was compromised, so they know not to trust those messages.
- Report it to WhatsApp directly (whatsapp.com/contact) and, if any fraud or harassment resulted, to cybercrime.gov.in or the 1930 cyber-fraud helpline.
Preventing it from happening again
Two-step verification is the single change that stops this specific scam cold. Once it’s on, an attacker with your six-digit SMS code alone can’t register your number without also knowing your separate PIN, which you never share with anyone, ever, no matter who’s asking or why. Beyond that: never forward a verification code to anyone, including someone claiming to be WhatsApp support, a contact, or a company, since WhatsApp never legitimately asks you to share your own code with another person.
FAQ
If I get my account back, is my chat history restored too?
Only if you had a backup. Re-registering your number restores your account and contacts, but your message history comes back only from a chat backup, so recent unbacked-up chats can be lost in the process.
Can someone hack my WhatsApp without ever contacting me directly?
It’s far less common. The verification-code scam depends on tricking you into an action, but an attacker with direct access to your phone or SIM (through theft or a SIM swap) could bypass that step, which is another reason to protect your phone and SIM itself.
Does two-step verification slow down my own logins?
Only occasionally. You’ll be asked for your PIN periodically to confirm you still know it, and always when re-registering your number on a new device, which is exactly when it’s protecting you.
Someone is asking me to forward a code right now. What should I do?
Don’t. Not to a contact, not to anyone claiming to be WhatsApp, ever. A legitimate need for your account never involves you forwarding your own verification code to another person.
What if I don’t recognise a Linked Device but I never got a hack warning?
Remove it immediately anyway and turn on two-step verification. An unfamiliar session is worth acting on whether or not you’ve noticed anything else unusual yet.