"I sent you a code by mistake": how your WhatsApp gets stolen

An SMS arrives with a six-digit code you never asked for and, almost at the same moment, a message from a friend, someone in the school parents' group or a "WhatsApp technician": "Sorry, I sent you a code by mistake, could you forward it to me?". It looks like a harmless favour, but that code is the key to your account. If you send it, someone else will register your WhatsApp or Telegram number on their own phone, you will lose access, and the criminal will start writing to all your contacts pretending to be you. The rule is simple and has no exceptions: you never share a verification code, with anyone.

How does the account takeover work?

WhatsApp and Telegram identify your account by your phone number. When someone installs the app on a new phone and enters a number, the service sends a code by SMS (or by a call, or inside the app itself) to the owner's phone to confirm it belongs to them. The criminal needs exactly what just landed on your phone.

The script usually follows these steps:

1. The criminal enters your number on their phone and starts the registration. You receive the official SMS with the code.
2. They message you to ask for it. Often from the account of a real contact that has already been stolen, which is why the message comes from someone you trust. Other times they pose as WhatsApp support, as the organiser of a prize draw or a vote, or as someone who "got the wrong number".
3. They pile on pressure. "It's urgent", "my account is going to be blocked", "it'll only take a second".
4. If you send the code, the account moves to their phone. Your WhatsApp is logged out, and they often switch on their own two-step verification so you can't easily get it back.
5. They use your identity. They write to your contacts and groups asking for urgent money, a bank transfer or instant payment (in Spain often via Bizum, the mobile payment service) or, once again, "the code I sent you by mistake". That keeps the chain going.

What are the warning signs?

• You get a code you didn't request. This is the clearest sign: someone is trying to get into your account.
• The SMS literally tells you not to share it. Official messages from WhatsApp, Telegram, your bank and almost every service say so.
• You're asked for it over chat, even by a friend. Nobody can "send you by mistake" a code for their own account: codes always go to the number being registered.
• "Technical support" messages you. WhatsApp and Telegram will not ask you for a code by chat, SMS or phone call.
• There's a rush or an odd excuse: a prize draw, a vote, an account that's "about to be blocked".

What do I do right now if someone is asking for it?

1. Don't forward the code or read it out over the phone. Not even part of it.
2. Check through another channel. If the message comes from a contact, call them on their usual number or ask them in person. Their account has very likely already been stolen; let them know.
3. Turn on two-step verification now (we explain how below). With it, even if someone gets hold of a code, they will also need a PIN that only you know.
4. Block and report the chat from within the app. If the message came from an unknown number, you can also report it in the spam number directory.
5. Warn everyone else: if a friend's account is being impersonated, tell your shared group so nobody else falls for it.

How do I turn on two-step verification?

It's the single most effective protection against this fraud, and it takes a minute:

• WhatsApp: Settings Account Two-step verification Turn on. Choose a six-digit PIN you don't use anywhere else and add an email address so you can reset it if you forget it.
• Telegram: Settings Privacy and Security Two-Step Verification. Create a password and add a recovery email.

Don't share that PIN or password either. Menus may vary slightly depending on the app version, but the option always appears under that name. While you're there, review your linked devices (in WhatsApp: Settings Linked devices; in Telegram: Settings Devices) and end any session you don't recognise.

What if I already sent the code?

Act fast. The sooner you do, the easier it is to get it back:

1. Register your number again on your own phone. Open WhatsApp, enter your number and verify it with the new code you'll receive by SMS. When you do, the criminal's session is closed.
2. If it asks for a PIN you don't know, the criminal has switched on their own two-step verification. They can't stop you recovering the account forever: after a waiting period of several days, WhatsApp lets you register it again without that PIN. Meanwhile, write to support from inside the app (Settings Help) explaining that your account has been stolen.
3. On Telegram, log in with your number, go to Settings Devices and tap "Terminate all other sessions". Then set your two-step verification password.
4. Warn your contacts another way (SMS, a call, social media or through relatives): "My WhatsApp has been stolen, ignore any message from me asking for money or codes".
5. If the code was from your bank or a payments app, immediately call your bank's official number (the one on the back of your card or on its website) to block transactions.
6. Keep evidence: screenshots of the messages, the number that contacted you and the time.

Where do I report it and who can help?

• Police: in Spain, the Policía Nacional (091) or the Guardia Civil (062); elsewhere, your national or local police. File a report with the screenshots, especially if your identity was impersonated or someone lost money. Having sent the code doesn't make you guilty: you are the victim of a deception.
• Cybersecurity helpline: in Spain, INCIBE's 017 line is a free, confidential cybersecurity helpline that will guide you step by step to recover the account and secure your devices, and INCIBE's Internet User Security Office (OSI) publishes guides on configuring WhatsApp and Telegram safely. Elsewhere, contact your national cybersecurity agency or fraud reporting service.
• 112: only if there's an emergency or an immediate threat (112 is the emergency number across the EU; elsewhere, use your local emergency number).

If any of your contacts were asked for money in your name, also read how the "child in trouble" WhatsApp scam works: it's the usual next step after this theft.

Frequently asked questions

I got a code I didn't ask for but I didn't give it to anyone. Am I in danger? No. Without the code they can't get in. It means someone tried your number; ignore the SMS, don't reply to anyone asking for it, and turn on two-step verification.

A real friend asked me for it, how can it be a scam? Because the person writing is probably not your friend, but whoever stole their account. Call them before doing anything.

Can they read my old conversations? In general, registering the account on a new phone does not download your old chats unless they have access to your backup. What they can do is write in your name and see new messages that arrive while they control the account.

Is there any point in changing my number? There's no need. Recovering the account and turning on two-step verification is enough.

In short

A code that arrives by SMS belongs to you and nobody else: not friends, not "technical support", not prize draws. If someone asks for it, don't send it, check through another channel and turn on two-step verification. If you already sent it, register your number again, warn your contacts and report it. And if the attempt came from an unknown number, report it in the NoCall spam number directory so others recognise it in time.