WhatsApp hacked: what to do in the first 10 minutes and how a business keeps its customers

If your WhatsApp was hacked, log in again with your own number right away and enter the 6-digit SMS code: this kicks the intruder off any device. Then warn your customers and contacts, turn on two-step verification and check your linked devices. Changing a password does not help; only logging in again with the code does.

Below we go step by step: how to tell that your account was taken over, what to do in the first 10 minutes, why you sometimes have to wait 7 days, and how a business can keep customers whom scammers are already messaging in its name.

It usually starts with a harmless message: "You got a code, please read it out, it's for the delivery" or "Vote for my daughter in a contest". A person sends 6 digits, and a minute later WhatsApp says the number has been registered on another device. For a personal account this is unpleasant. For a business number that receives orders, it means lost money and customers who send prepayments to scammers.

How do you know your WhatsApp was hacked?

The main sign: WhatsApp on your phone logged out by itself and says the number is being used on another device. There is also a quiet hack, when you keep chatting while someone reads your chats in parallel.

• the app asks you to verify your number again, although you changed nothing;
• friends and customers ask about messages you never sent, most often requests to transfer money;
• "Linked devices" shows a computer or browser you do not recognize;
• you received an SMS with a WhatsApp code you did not request;
• you were added to groups, or messages were sent from your account to other chats.

An SMS code that arrives without your request is not a hack yet. It means someone is trying to log in with your number. The key thing at this moment: never share the code with anyone, even if they claim to be "support", "the bank" or "a friend".

What to do in the first 10 minutes if your WhatsApp was hacked?

Act fast: while the scammer holds the account, they message your contacts in your name. Do it in this order:

1. Open WhatsApp on your phone and log in again with your number. If the app was deleted, install it from the app store.
2. Enter the 6-digit SMS code. According to the WhatsApp Help Center, this code logs out whoever is using the account, even if they know the PIN.
3. If the app asks for a two-step verification PIN you never set, the intruder set it. The next section explains what to do.
4. Open "Settings", "Linked devices" and log out of every computer and browser you do not recognize.
5. Turn on two-step verification ("Settings", "Account", "Two-step verification") and add your email to reset the PIN.
6. Warn your contacts: in your status, on Instagram, on your website, and message or call your most important customers personally.

You can only recover the account with a SIM card of the same number. If the SIM is lost or the number was reissued, restore the SIM with your mobile operator first, otherwise the SMS code will not arrive. If you cannot log in, contact support through "Help" in the app. Where a business in Kazakhstan can turn for help is covered in our article about WhatsApp support.

Why do you sometimes have to wait 7 days after a WhatsApp hack?

You have to wait if the intruder managed to turn on two-step verification with their own PIN. You enter the SMS code and they are logged out, but you cannot fully log in without the PIN. In this case WhatsApp advises waiting 7 days and trying again.

During these 7 days the account works neither for you nor for the scammer: the SMS code has already disconnected their device. Use this time to warn customers through other channels and temporarily redirect orders to a second number or Instagram. Changing your email or phone password does not help here: WhatsApp states plainly that it does not remove someone else from the account.

What can the intruder see in a hijacked WhatsApp?

Old chats are stored on your phone and in your Google or iCloud backup, so the scammer's new device usually does not have them. But every message that arrives while they hold the account, they see and can reply to.

They also see your name, profile photo and list of groups, and can write there in your name. That is why the danger of a hack is not losing old chats but what is done with the account next: asking your contacts for money, codes, links to a "vote". WhatsApp also warns that it does not disclose who accessed your account or from where.

How do scammers trick people into sharing the WhatsApp code?

Almost every hack rests on one thing: the person shares the SMS code themselves or scans someone else's QR code. Technically complex hacks are rare; the rest is social engineering.

• "Read me the code". They call or write on behalf of a delivery service, a bank, government services or a mobile operator and ask for the digits from the SMS.
• "Vote for me". A friend (already hacked) sends a link to a contest where voting requires your number and a code.
• "I sent you a code by mistake". The scammer requests a code to your number and asks you to forward it, as if they mistyped.
• A QR code "to log in". You are asked to scan a QR code, which is actually a WhatsApp Web login: the scammer gets your account on their computer.
• A lost or someone else's phone. A work smartphone without a screen lock left with a former employee also opens all the chats.

The rule is simple: real WhatsApp support, a bank or a courier never asks for an SMS code. Whoever asks for the code is the scammer.

Why is a hacked business number more dangerous than a personal one?

With a personal number your friends suffer; with a business number your customers and revenue suffer. Customers trust the number they have already chatted with and calmly send prepayments to the details sent "by you".

The second problem: orders that arrive during the hack are seen by the scammer, not your manager. A customer writes, nobody answers or the wrong person answers, and they go elsewhere. The third: if spam goes out from the hijacked number, recipients' complaints hit the number itself, and it may get banned. What to do then is covered in our article "WhatsApp banned: what to do".

How do you warn customers that it is not you writing?

Warn them immediately and in every channel where customers see you: WhatsApp status, Instagram stories and bio, a banner on your website, an email newsletter. Keep the text short and specific so people read it to the end.

Example: "Attention! Our WhatsApp has been temporarily hacked. We never ask you to transfer money to a card and never send payment links in chats. If someone writes to you in our name with such requests, they are scammers. You can reach us by the phone number on our website".

And for the future: state in your profile and on your website how you accept payment. When a customer knows you only invoice in a certain way, a request to "transfer to a card" immediately looks suspicious.

How do you protect WhatsApp from hacking?

Five settings close almost every way to hijack an account. Each takes a minute:

What to do	Where to turn it on	What it protects against
Two-step verification with a PIN and email	Settings, Account, Two-step verification	Without the PIN a scammer cannot log in even with the SMS code
Check linked devices	Settings, Linked devices	Logins via WhatsApp Web with someone else's QR code
Screen and app lock	Phone settings and Privacy in WhatsApp	Access to chats from a lost phone
Never share the SMS code	A rule for the whole team	The most common hacking scheme
Ban on reissuing the SIM without a passport	At your mobile operator	A SIM card being reissued to a scammer

For a business, add one more rule: the work number should not live in one manager's personal phone. When an employee leaves or loses the phone, access to the chats and the customers leave with them.

Why is official WhatsApp for business more reliable than a manager's phone?

In official WhatsApp (WhatsApp Business API, WABA) the company number is not tied to an app in someone's pocket. Managers reply to customers from a shared account or CRM, each with their own login, and the chats stay with the company.

What	App on a manager's phone	Official WhatsApp (WABA)
Where chats are	On the employee's phone	In the company account
Who replies	Whoever holds the phone	Several managers, each with their own login
An employee left	Takes the number and customers	Removed from the team, chats stay
Phone lost	Chats at risk	Work does not stop
Company name for customers	Anything, unchecked	A name approved by Meta

If you do not want to give up the WhatsApp Business app on your phone, you can keep it and connect the number to a CRM at the same time in Coexistence mode. The differences between regular WhatsApp, WhatsApp Business and the API are explained in our article "How WhatsApp Business differs from regular WhatsApp and the API".

In WazzaBee, connecting official WhatsApp takes 15 minutes: you log in with Facebook, choose your business and number, and the line is ready. The process is described step by step in the WABA connection guide, and how chats turn into deals is covered in our article about a CRM with WhatsApp.