WhatsApp scams: the verification code trick and other fake messages
Quick answer
Anyone who asks for your WhatsApp 6-digit verification code is a scammer. The FTC says so, and WhatsApp says never share it. Turn on two-step verification, and if a contact asks for money or a code, check with them by phone first.
- Pretends to be
- Last updated
How it works
To take over a WhatsApp account, an attacker needs the 6-digit SMS code sent to your number. So the scam is a trick to get you to hand it over. The FTC says scammers pretend to be someone you trust, say they've found a problem with one of your accounts and ask for the code. Its position is that anyone asking for your verification code is a scammer.
WhatsApp also warns about requests for payment. If someone asks for payment to use WhatsApp, or offers to unban your account for money, they're likely after your financial or personal information. If a contact sends something suspicious, their account may have been taken over.
WhatsApp sends a notification when someone tries to register your number. That could be a typo by someone else, or an attempted takeover.
Red flags
- Anyone asking for your 6-digit WhatsApp verification code
- A verification code you didn't request
- A contact suddenly asking for money or a code
- A message offering to unban your account for a fee
- A request for payment to use WhatsApp
Example message
Hi, sorry, I sent my code to your number by mistake. Can you send it to me? It's urgent. Also, can you transfer money to [account]?
What to do
- 1
Never share the code
WhatsApp says never share your verification code. The FTC says anyone who asks for it is a scammer.
- 2
Turn on two-step verification
WhatsApp recommends setting a PIN you never share. It also helps if someone gets your SIM or number.
- 3
Check with the person another way
If a friend asks for money or a code, phone them or use another channel before acting.
- 4
If someone took over your account, re-register
WhatsApp says the way to remove an intruder is to register again with the 6-digit code. Changing a password won't remove them. If an attacker set a two-step PIN you don't know, WhatsApp says to wait 7 days and try again.
- 5
If you sent money, call your bank
Ask your bank or payment app to stop the payment, then report it. Our guide on what to do after a data breach covers the steps.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers rarely pick targets at random. Your name, number, address and email are sold by data brokers, listed on people-search sites and leaked in breaches, and that is what lets a message use your real details. Serus finds where your details are listed and requests removal, and alerts you when your data shows up in a breach, so fewer scammers can reach you. Your phone number is the key to a WhatsApp account, and brokers list it next to your name.
More WhatsApp scams
Frequently asked
Why did I get a WhatsApp code I didn't ask for?
WhatsApp says it may be a mistyped number or an attempted takeover of your account. Don't share the code.
Is a message from a friend asking for money real?
It may be, but WhatsApp says their account may have been compromised. Confirm by phone.
Does WhatsApp charge to unban my account?
No. WhatsApp says people asking for payment to use WhatsApp or unban an account are likely after your financial or personal information.
I lost my account to a scammer. What do I do?
Register your number again with the 6-digit code. WhatsApp has a guide to recovering a compromised account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
