"I sent you a code by mistake": how your WhatsApp gets stolen

"I sent you a code by mistake": how your WhatsApp gets stolen

A text arrives with a six-digit code you didn't ask for. Seconds later, a WhatsApp message from a friend, a family member or someone in a group chat: "Sorry, I sent you a code by mistake, can you forward it to me?" It looks harmless. It isn't. That code is the key to your WhatsApp account, and whoever has it can take it over in seconds. Then they'll use it to message your contacts asking for money. Here's how it works and what to do.

How does the account takeover work?

1. They try to register your number on their phone. WhatsApp (or Telegram) then sends a verification code by text to your phone, because it's your number.
2. They ask you for the code. Usually from the account of someone you know whose WhatsApp they've already stolen, which is why it seems trustworthy. Other times they pose as WhatsApp support, a delivery company, a competition ("send us the code to confirm your prize") or a school or parish group.
3. You forward it and lose the account. Your WhatsApp is now on their phone. You're logged out.
4. They exploit your contacts. They message your friends and family from your account with urgent money requests ("I need to pay something today, can you send me €300?") or with the same code trick to steal more accounts. It's a chain.

What are the warning signs?

• A verification code you didn't request.
• Someone asking you to forward a code, whatever the excuse. Nobody needs your code.
• "WhatsApp support" contacting you by chat asking for codes or your PIN. WhatsApp doesn't do this.
• Urgency: "quick, it's about to expire".
• A known contact writing strangely: different style, urgent requests, refusing to talk.

What do I do right now if someone is asking for it?

1. Don't forward the code. Not to a friend, family member or "support". Ever.
2. Contact the person by another route. Ring them on their usual number: if their account has been stolen, they'll know nothing about it, and you can warn them.
3. Turn on two-step verification (see below) so that, even if someone gets a code, they can't take your account.
4. Report and block the account that asked you, and warn the group or your contacts if it's a contact's account that's been taken over.

How do I turn on two-step verification?

It's the most important protection, and it takes one minute:

• WhatsApp: Settings Account Two-step verification Turn on. Choose a six-digit PIN that isn't obvious and add an email address so you can reset it.
• Telegram: Settings Privacy and Security Two-Step Verification (a password).

With this on, anyone trying to register your number on another phone will need your PIN as well as the text code. Remember: the code and the PIN are never shared with anyone. You'll find the official steps in the WhatsApp Help Center.

What if I already sent the code?

Act straight away:

1. Open WhatsApp and register your number again on your phone. You'll receive a new code by text. When you verify your number, the other device is logged out.
2. If you're asked for a two-step PIN you never set, the scammer has set one. You'll have to wait for the period WhatsApp indicates before you can re-register without it; in the meantime, contact WhatsApp support from the app or the Help Center.
3. Warn your contacts (by text, social media or another app) that your account has been stolen and that they shouldn't send money or codes to anyone writing as you.
4. Turn on two-step verification as soon as you get the account back.
5. Check Linked devices (Settings Linked devices) and log out any you don't recognise.
6. If anyone sent money to the scammer thinking it was you, they should ring their bank immediately and report it to the Gardaí.

Where do I report it and who can help?

• WhatsApp: from the app (Settings Help Contact us) or the Help Center, explaining that your account has been stolen.
• Your phone provider, if you suspect something stranger is going on with your line (such as losing service: that could be a SIM swap, which is a different problem).
• An Garda Síochána, at your local station, especially if money has been lost or your account has been used to defraud others. Online crime is supported by the Garda National Cyber Crime Bureau.
• NoCall: report the number that asked for the code in the spam numbers directory.

The CCPC's guide to social media scams covers account takeover and impersonation if you want to share it with your family.

Frequently asked questions

The person asking was my sister. Isn't that safe? No: if her account was stolen, the person writing isn't your sister. Ring her before you do anything.

What can they do with my WhatsApp? Read new messages, write to your contacts as you, ask them for money, steal more accounts and join or message your groups. Older chats saved only on your phone usually aren't transferred, but the damage to your contacts can be serious.

Can they steal my bank account with that code? The WhatsApp code only gives access to WhatsApp. But if you're asked for a code from your bank, that's another scam: never share it either.

Does it happen with Telegram, Instagram or other apps? Yes. Any service that sends you a code by text can be targeted the same way. The rule is universal: codes are never shared.

In short

A code you receive by text is for you alone. If someone asks you to forward it, whoever it seems to be, they're trying to steal your account. Don't send it, ring the person on their usual number and turn on two-step verification today. If you already sent it, re-register your number, warn your contacts and report it. And report the number in the NoCall spam numbers directory.