"I sent you a code by mistake": how your WhatsApp gets hijacked

"I sent you a code by mistake": how your WhatsApp gets hijacked

You get a text with a six-digit code you didn't ask for. Seconds later, a message on WhatsApp: "Hi! Sorry, I sent you a code by mistake, could you pass it on to me?" It might come from a stranger, or from a friend or someone in your family group. Don't send it. That code is the key to your WhatsApp account, and whoever gets it can take it over in seconds and use it to ask your contacts for money.

How does the account takeover work?

1. They try to register your number on their phone. WhatsApp (and Telegram) then sends a verification code by text to your phone, which is where your number lives.
2. They ask you for the code with an excuse. "I sent it to you by mistake", "it's for a competition, vote for me", "I'm verifying my account and it went to you". Sometimes they call pretending to be WhatsApp support or your phone network.
3. If you pass it on, they take your account. You're logged out, and they now control your profile, your groups and your name.
4. They use your account to scam your contacts. They send messages "from you" asking for an urgent transfer, or asking for more codes, and the chain continues. That's why the request often comes from a real friend: their account was hijacked first.

Some versions also try to get into your voicemail, because WhatsApp can deliver the code by voice call. If your voicemail still has the default PIN, change it.

What are the warning signs?

• A code arrives that you didn't ask for, and then someone asks you for it.
• The message says "by mistake" or gives an odd reason why you need to forward the code.
• Urgency: "quick, it expires in a minute".
• The request comes from a friend who doesn't normally write like that, or who won't answer a phone call.
• Someone claiming to be WhatsApp support contacts you. WhatsApp doesn't ask for your codes.

What do I do right now if someone's asking for it?

1. Don't send the code to anyone, ever, whatever the reason. The text itself warns you not to share it.
2. If the request comes from a friend, call them on their usual number to warn them that their account may have been taken over.
3. Block and report the sender in WhatsApp (open the chat, tap the name and choose "Report").
4. Turn on two-step verification now (see below).

How do I turn on two-step verification?

It's the most effective protection: even if someone gets your code, they'll need a PIN only you know.

• WhatsApp: Settings Account Two-step verification Turn on. Choose a six-digit PIN you'll remember and add a recovery email address.
• Telegram: Settings Privacy and Security Two-Step Verification set a password and a recovery email.

Do the same for your email and other important accounts: the National Cyber Security Centre explains how. If you can, use passkeys or an authenticator app rather than text codes.

What if I've already sent the code?

Act quickly: the sooner you do, the less damage.

1. Open WhatsApp and register your number again. You'll receive a new code by text. When you verify your number on your phone, the intruder is logged out. Follow WhatsApp's guide to recovering a compromised account.
2. If they've set up two-step verification, you may have to wait before you can get back in. Don't give up: keep the number active and try again when WhatsApp lets you.
3. Warn your contacts at once, by another route (calls, texts, social media): "My WhatsApp has been hacked, don't send money or codes to anyone writing as me."
4. Email WhatsApp support from the app or its help centre, explaining that your account was stolen, and include your number in international format (+44...).
5. If anyone sent money to the scammer believing it was you, they should call their bank straight away on 159 or the number on their card.
6. Check other accounts that might be linked to the same number or email and change passwords if needed. The NCSC has a guide to recovering a hacked account.

Where do I report it and who can help?

• Report Fraud (formerly Action Fraud) on 0300 123 2040 in England, Wales and Northern Ireland, or Police Scotland on 101, especially if anyone lost money. Keep screenshots of the messages and the number that asked for the code.
• Forward suspicious texts to 7726, free on most networks, as the NCSC explains.
• NoCall: report the number in the spam numbers directory.

Frequently asked questions

I got a code I didn't ask for but I didn't give it to anyone. Am I in danger? No. Without the code they can't get in. Someone tried, so it's a good moment to turn on two-step verification and ignore any message asking for that code.

A real friend asked me for it. How can it be a scam? Because their account was probably taken over first, and now the scammer is writing as them. Call your friend on the phone: you'll see they don't know anything about it.

Can they read my old conversations? In general, they won't see your previous chat history on their phone unless they also have access to a backup, but they will see new messages and groups and can write as you. That's why you need to recover the account and warn your contacts quickly.

Is there any point in changing my number? It's not usually necessary. Recovering the account and turning on two-step verification is enough. Changing number would make life harder for you and your contacts without adding much protection.

In short

That six-digit code is the key to your account: don't send it to anyone, for any reason. Turn on two-step verification on WhatsApp and Telegram, and if you've already sent it, register your number again, warn your contacts and report it. And if a number has asked you for a code, report it in the NoCall spam numbers directory: your warning could stop it happening to someone else.