"I sent you a code by mistake": how your WhatsApp gets stolen

"I sent you a code by mistake": how your WhatsApp gets stolen

You get a text with a six-digit WhatsApp code you didn't ask for. A minute later, a message arrives from a friend, a cousin or someone in your sports club group: "Sorry, I sent you a code by mistake, can you send it back to me?" It looks harmless. It isn't. That code is the key to your WhatsApp account, and whoever has it can take it over in seconds. This is one of the most common account takeover scams, and it spreads from one phone to the next precisely because the request comes from someone you trust.

How does the account takeover work?

1. The criminal enters your number on their own phone and starts setting up WhatsApp. You receive the official text with the code.
2. They message you to ask for it. Often from a real contact's account that has already been stolen, which is why it comes from someone you know. Other times they pose as WhatsApp support, as the organiser of a competition or a vote, or as someone who "typed the wrong number".
3. They pile on the pressure. "It's urgent", "my account's about to be locked", "it'll only take a second".
4. If you send the code, your account moves to their phone. WhatsApp logs you out, and they often switch on their own two-step verification so you can't easily get it back.
5. They use your identity. They message your contacts and groups asking for urgent money, a bank transfer or, once again, "the code I sent you by mistake". That keeps the chain going.

What are the warning signs?

• You get a code you didn't ask for. This is the clearest sign: someone is trying to get into your account.
• The text tells you not to share it. Official messages from WhatsApp, Telegram, your bank and almost every service say exactly that.
• You're asked for it in a chat, even by a friend. Nobody can "send you their code by mistake": codes always go to the number being registered.
• "Support" messages you. WhatsApp and Telegram won't ask you for a code by chat, text or phone call.
• There's a rush or an odd excuse: a competition, a vote, an account that's "about to be blocked".

What do I do right now if someone's asking for it?

1. Don't send the code or read it out over the phone. Not even part of it.
2. Check through another channel. If the message comes from a contact, call them on their usual number or ask them in person. Their account has very likely already been stolen; let them know.
3. Turn on two-step verification now (see below). With it, even if someone gets hold of a code, they'll also need a PIN only you know.
4. Block and report the chat inside the app. If the message came from an unknown number, you can also report it in the spam numbers directory.
5. Warn others: if a friend's account is being impersonated, tell your shared group so nobody else falls for it.

How do I turn on two-step verification?

• WhatsApp: Settings Account Two-step verification Turn on. Choose a six-digit PIN you don't use anywhere else and add an email address so you can reset it if you forget it.
• Telegram: Settings Privacy and Security Two-Step Verification. Create a password and add a recovery email.

Do the same for your other important accounts (email, social media, banking). Own Your Online, the government's cyber security advice site, has easy guides for turning on two-step verification.

What if I've already sent the code?

1. Register your number again on your own phone. Open WhatsApp, enter your number and verify it with the new code you'll get by text. That logs the criminal out.
2. If it asks for a PIN you don't know, the criminal has turned on their own two-step verification. They can't keep you out forever: after a waiting period of several days, WhatsApp lets you register again without that PIN. Meanwhile, contact support from inside the app (Settings Help) and explain that your account has been stolen.
3. On Telegram, log in with your number, go to Settings Devices and tap "Terminate all other sessions". Then set your two-step verification password.
4. Warn your contacts another way (a text, a call, social media or through family): "My WhatsApp has been hacked, ignore any message from me asking for money or codes".
5. If the code was from your bank or a payment app, call your bank immediately on its official number (on the back of your card or on its website) to block transactions.
6. Keep evidence: screenshots of the messages, the number that contacted you and the time.

Where do I report it and who can help?

• The National Cyber Security Centre (NCSC): report the account takeover to the NCSC. It can guide you on recovering the account and securing your devices.
• NZ Police: if your identity was used to ask people for money, or someone lost money, report it on 105 or through the 105 online service on the NZ Police website, with your screenshots. Having sent the code doesn't make you responsible: you were tricked.
• Consumer Protection: its Scamwatch pages explain how to spot and report scams.
• 111: only if there's an emergency or an immediate threat.

Frequently asked questions

Can they read my old chats if they take my account? Usually not: your chat history stays on your phone and in your own backup. But they can see new messages, message your contacts and join conversations in groups as you.

My friend asked me for the code. Was it really them? Almost certainly not. Your friend's account was probably stolen first. Call them on their number and tell them.

I didn't ask for a code but got one. Is my account in danger? Someone tried to register your number. As long as you don't share the code, they can't get in. Turn on two-step verification to be extra safe.

Do I need to change my phone number? No. Recovering the account and turning on two-step verification is enough.

In short

A WhatsApp code you didn't ask for is a sign someone is trying to get into your account, and whoever asks you for it, even a friend, is trying to steal it. Don't share it, check by phone, turn on two-step verification and warn your contacts. If you already sent it, register your number again straight away and report it to the NCSC. And report the number in the NoCall spam numbers directory.