"I sent you a code by mistake": how your WhatsApp gets stolen

"I sent you a code by mistake": how your WhatsApp gets stolen

Your phone receives an SMS with a six-digit code you did not ask for. Seconds later, a message arrives, often from a friend, a church member or someone in one of your groups: "Abeg, I sent a code to your number by mistake, please forward it to me." It feels harmless, even polite. It is not. That code is the key to your WhatsApp account, and whoever has it can take your account, read your new messages and ask all your contacts for money in your name. The rule is absolute: never share a verification code with anyone, not even someone you know.

How does the account takeover work?

1. They try to register your number. The scammer installs WhatsApp (or Telegram) on their own phone and types your number. WhatsApp sends a verification code by SMS, to you.
2. They ask you for the code. The request often comes from a contact whose account they have already stolen, so it looks trustworthy. Other times it is a stranger posing as WhatsApp support, a "promo" organiser or a vote in a "competition".
3. They take over your account. With the code, they activate your WhatsApp on their phone and you are logged out. If you have not set up two-step verification, they can even set their own PIN to lock you out for longer.
4. They exploit your contacts. They message your family, friends and groups asking for urgent transfers, selling "investments" or asking for more codes to steal more accounts. The chain continues.

Sometimes, instead of asking by message, they call pretending to be your network or WhatsApp itself and ask you to read out the code "to verify your line" or "to stop your account being deleted". Same trap, different channel.

What are the warning signs?

• An SMS code you did not request, followed immediately by someone asking for it.
• A story about a "mistake": "I typed your number instead of mine."
• Urgency or emotional pressure: "please quick, I need it now", "it's for a competition, vote for me".
• Someone claiming to be WhatsApp support. WhatsApp does not contact you by chat or call to ask for codes.
• The text of the SMS itself usually says "do not share this code". That is your answer.

What do I do right now if someone is asking for it?

1. Do not send the code. Not by message, not by voice note, not by reading it out on a call.
2. Call the contact who asked, on their normal number. If their account has been stolen, they will not know anything about the request, and you can warn them.
3. Turn on two-step verification now (see below). It is the most effective protection.
4. Block and report the number that asked for the code. In WhatsApp: open the chat, tap the name and choose "Report".
5. Warn your groups if the request came from a member: others may be receiving the same message.

How do I turn on two-step verification?

In WhatsApp, go to Settings Account Two-step verification Turn on, choose a six-digit PIN you will remember and add an email address in case you forget it. From then on, anyone who tries to register your number on another phone will need that PIN as well as the SMS code. WhatsApp explains it in its guide on two-step verification. Telegram has a similar option under Settings Privacy and Security Two-Step Verification.

Do the same for the people around you, especially older relatives who may not know these settings exist.

What if I already sent the code?

Act quickly; you can usually recover the account:

1. Open WhatsApp and register your number again. You will receive a new SMS code. When you enter it, the scammer is logged out.
2. If WhatsApp asks for a two-step PIN you do not know, the scammer set it. You may have to wait before you can register again; keep trying when the app allows it. Follow WhatsApp's guide to recover a compromised account.
3. Warn your contacts immediately, by SMS, calls, another social network or through a relative: "My WhatsApp was hacked, ignore any request for money from it."
4. Turn on two-step verification as soon as you get back in.
5. Check linked devices (Settings Linked devices) and log out any you do not recognise.
6. If someone sent money because of messages from your account, they should call their bank immediately and report it.

Where do I report it and who can help?

• WhatsApp: report the account from within the app, or contact WhatsApp support from Settings Help.
• The police, if money was lost or your account was used for fraud, at a station or through the Nigeria Police Force's National Cybercrime Centre (NPF-NCCC) e-reporting portal.
• The Economic and Financial Crimes Commission (EFCC), which takes reports of financial fraud.
• Your network, if you also notice strange activity on your SIM, such as losing service: that may be a SIM swap, which needs a different response.
• NoCall, reporting the number in the spam numbers directory.

Frequently asked questions

The person who asked is my close friend. Can I send it? No. If your friend's account has been stolen, it is the scammer writing, not your friend. Call them on their usual number first.

Can they read my old messages? Generally, chat history stays on your phone; what they can see is new messages that arrive while they control the account, plus your groups and contacts. That is enough to cause damage.

I received a code but nobody asked me for it. Is that a problem? It means someone tried to register your number. Do not share it, ignore it and turn on two-step verification.

Does this also work for Telegram, Instagram or bank apps? Yes. Any SMS code is a key to something. The rule is the same for all: never share it.

In short

An SMS code someone asks you to forward is the key to your account. Never share it, call the person on their normal number, turn on two-step verification, and if you already sent it, register WhatsApp again and warn your contacts. And report the number in the NoCall spam numbers directory: your warning could save someone else's account.