"I sent you a code by mistake": how your WhatsApp gets hijacked

"I sent you a code by mistake": how your WhatsApp gets hijacked

You receive an SMS with a six-digit WhatsApp code you did not ask for. A minute later, a friend writes on WhatsApp: "Sorry, I sent my code to your number by mistake, can you forward it to me?" It looks harmless. It is not. That code is the key to your WhatsApp account, and whoever asks for it is trying to register your number on their phone. The rule is absolute: a verification code is never shared with anyone, not even with someone you know.

How does the account takeover work?

1. The scammer starts registering your number on WhatsApp (or Telegram) on their own phone. WhatsApp sends a code by SMS to you, the real owner.
2. They ask you for the code with an excuse. Often the message comes from a friend's account that has already been hijacked, which makes it very convincing. Other excuses: a "contest" or "voting for a friend's child", a "delivery confirmation", "verifying your account" on behalf of WhatsApp support.
3. You forward the code, and your account opens on their phone. You are logged out.
4. They use your account to message your contacts and groups asking for money ("can you PayNow me S$300, I'll pay you back tonight") or for their codes, so the chain continues.

Similar tricks target Telegram, Instagram and other apps that verify accounts by SMS. Sometimes the scammer calls you instead, pretending to be a courier, a telco or a bank, and asks you to "read out the code we just sent you".

What are the warning signs?

• You receive a code you did not request. Someone is trying to register your number.
• Anyone, including friends, asks for that code. A real friend has no use for a code sent to your phone.
• The message says it comes from WhatsApp support. WhatsApp does not ask for your code by chat or phone.
• Voting, contest or giveaway excuses that require "verification".
• Urgency: "quick, it expires in a minute".

What do I do right now if someone is asking for it?

1. Do not send the code. Do not reply with it, do not screenshot it, do not read it out.
2. Call your friend on their usual number to warn them their account may have been hijacked.
3. Turn on two-step verification in WhatsApp now (see below). With it, the code alone is not enough to take your account.
4. Report and block the requesting account in WhatsApp. If you are unsure, the ScamShield Helpline (1799) can help you check.

How do I turn on two-step verification?

In WhatsApp, go to Settings Account Two-step verification Turn on, create a six-digit PIN you will remember, and add an email address so you can reset it. Full instructions are on WhatsApp's help page. Also consider adding a passkey or email address to your account if the app offers it, and on Telegram, set a cloud password under Privacy and Security.

What if I already sent the code?

Act quickly:

1. Open WhatsApp and register your number again. You will receive a new code by SMS. Entering it logs the scammer out of your account.
2. If they have already set up two-step verification, you may have to wait before you can get back in. Keep trying, and contact WhatsApp support from the app.
3. Warn your contacts by SMS, call or social media: "My WhatsApp was hijacked, ignore any request for money or codes."
4. Turn on two-step verification once you are back in, and check Settings Linked devices to remove anything you do not recognise.
5. If anyone paid because of messages sent from your account, they should call their bank immediately and make a police report.

Where do I report it and who can help?

• Report the scam through ScamShield.
• If money was lost, make a police report through SPF e-services or at a Neighbourhood Police Centre, and follow ScamShield's I've been scammed checklist.
• Report the number in the spam numbers directory.

Frequently asked questions

Can they read my old chats? Normally, past chats stay on your phone and are not transferred to the new device unless a backup is restored with your credentials. But they will see new messages and group activity while they control the account.

My friend asked for the code. Can it really be a scam? Yes. In most cases your friend's account has already been taken over. Call them to check.

Is it safe to share the code with WhatsApp support? No. WhatsApp support never asks for it.

I received a code but no one asked me for it. What now? Ignore it, do not share it, and turn on two-step verification. Someone may have tried to register your number.

In short

A six-digit code is the key to your account: never share it, whoever asks. Turn on two-step verification today, and if you already sent the code, re-register your number, warn your contacts and secure the account. And if you got a request like this, report it in the NoCall spam numbers directory.