"I sent you a code by mistake": how your WhatsApp account gets stolen

"I sent you a code by mistake": how your WhatsApp account gets stolen

A text arrives with a six-digit WhatsApp code you didn't ask for. A minute later, a message from a friend (or a stranger): "Sorry, I sent my code to your number by mistake, can you forward it to me?" It seems harmless. It isn't. That code is the key to your WhatsApp account, and whoever has it can register your number on their phone and lock you out. The same trick works with Telegram, Signal and other apps that verify your number by text. Here's how it works and how to protect yourself.

How does the account takeover work?

1. They start registering your number. The scammer installs WhatsApp on their own phone and enters your mobile number. WhatsApp sends a verification code by text to your phone.
2. They ask you for it. With an excuse: "I sent it to you by mistake", "it's for a competition", "I'm verifying members of the group", "I'm from WhatsApp support". Often the message comes from a friend's account that has already been stolen, so it looks trustworthy.
3. You forward it. With that code, your WhatsApp opens on their phone and closes on yours.
4. They use your account. They message your contacts pretending to be you, ask for urgent money (the classic "Hi Mum" scam), and ask your friends for their codes to repeat the trick. If you haven't set up two-step verification, they can set their own PIN and make it harder for you to get back in.

What are the warning signs?

• A verification code arrives that you didn't request. Someone is trying to register your number.
• Someone asks you for a code, whoever they are: friend, family member, "WhatsApp support", a "competition".
• The excuse is odd: nobody can send their own code to your number "by mistake".
• Urgency: "quick, it expires in a minute".
• The person won't take a call to explain.

What do I do right now if someone is asking for it?

1. Don't send the code. Not to anyone, not even a family member. WhatsApp support never asks for it.
2. Phone the friend who asked you, on their normal number, not through the chat. If their account has been stolen, they'll have no idea and you'll be warning them.
3. Ignore the unrequested code. If you don't share it, the attempt fails.
4. Turn on two-step verification now (see below).
5. Report and block the contact if it's a stranger, and report the number in the spam numbers directory. If the code request arrived by text and you're with Telstra, you can forward it to 7226 as Telstra explains; other carriers have their own reporting options.

How do I turn on two-step verification?

It takes a minute and blocks this attack even if someone gets the text code:

1. Open WhatsApp and go to Settings Account Two-step verification.
2. Tap Turn on and choose a six-digit PIN that's not your birthday or an obvious sequence.
3. Add an email address so you can reset the PIN if you forget it.
4. Don't share that PIN with anyone either.

WhatsApp's help page on two-step verification explains the details. Do the same for your partner, parents and grandparents: they're often the next target.

What if I already sent the code?

Act fast:

1. Open WhatsApp on your phone and register your number again. You'll receive a new code by text. When you verify it, the session on the scammer's phone closes.
2. If it asks for a two-step PIN you never set, the scammer has added one. Follow WhatsApp's steps for recovering a compromised account and keep requesting codes; you may have to wait before you can get back in.
3. Warn your contacts immediately by another channel (SMS, calls, social media): "My WhatsApp has been hacked, ignore any request for money or codes."
4. Turn on two-step verification as soon as you're back in.
5. If anyone sent money to the scammer thinking it was you, they should call their bank straight away and report it.
6. If you think other accounts or your identity could be affected, contact IDCARE on 1800 595 160 for free advice.

Where do I report it and who can help?

• WhatsApp: email support from within the app (Settings Help) explaining your account was stolen.
• Police, through ReportCyber, if money was lost or your account was used to commit fraud.
• Scamwatch, to help the National Anti-Scam Centre track the campaign.
• Your carrier, if you suspect someone has also tried to take over your phone number itself (if your phone suddenly loses service, read our guide to SIM swap in the guides).

Frequently asked questions

I got a code I didn't ask for but didn't give it to anyone. Am I in danger? No. Without the code they can't get in. Just ignore it and turn on two-step verification so it can't happen even if you slip up in the future.

A real friend asked me for it. How can it be a scam? Because their account was probably stolen first. The scammer is using their WhatsApp to message you. Call your friend on their normal number to check.

Can they read my old conversations? Generally, chat history is stored on your device and in your backup, not transferred when someone registers your number on a new phone. But they will receive new messages sent to you while they control the account and can see your groups and contacts.

Is there any point in changing my number? Usually not. Recover your account by registering it again and turn on two-step verification. Changing your number doesn't stop the scammer using the account they already hold until you've recovered it.

In short

A verification code is a key, and keys aren't shared, no matter who asks. Don't forward it, phone the friend who asked, and turn on two-step verification today. If you already sent it, re-register WhatsApp immediately, warn your contacts and report it. And if a number has tried this on you, report it in the NoCall spam numbers directory.