"I sent you a code by mistake": how your WhatsApp or Google Voice gets hijacked

"I sent you a code by mistake": how your WhatsApp or Google Voice gets hijacked

A text arrives with a six-digit code you didn't request. A minute later, a message from a contact (or a stranger): "Sorry, I sent you a code by mistake, can you forward it to me?" Or a "buyer" on Facebook Marketplace says they need to "verify you're real" with a code. That code is the key to one of your accounts: if you share it, someone else can register your WhatsApp, set up a Google Voice number tied to your phone, or get into another account. Here's how to stop it.

How does the account takeover work?

Many apps verify your identity by sending a code to your phone number. Scammers exploit that:

1. They start registering your account (WhatsApp, Telegram, Google Voice, or even a bank or email app) on their own device using your phone number.
2. The service sends a code to you, because it's your number.
3. They ask you for it with a convincing story: "I sent it to you by mistake," "it's to confirm you're not a bot," "it's for a prize or a raffle," "it's the code to verify your delivery."
4. If you share it, they take control. On WhatsApp they read your new messages and write to your contacts asking for money or more codes. With Google Voice, they create a phone number linked to yours that they use to commit other scams in your name.

The worst part: the request often comes from a friend's account that has already been hijacked, so it seems trustworthy.

What are the warning signs?

• A code arrives that you didn't request.
• Someone asks you to read or forward it, for any reason.
• The message says "do not share this code" and someone is asking you to share it anyway.
• A contact asks for something unusual by text and doesn't want to talk on the phone.
• A buyer or seller on a marketplace wants to "verify" you with a code.

What do I do right now if someone is asking for it?

1. Don't share the code with anyone, not even a friend or relative. No legitimate service asks for it.
2. If it's from a contact, call them on their usual number: their account has probably been hijacked.
3. Ignore and delete the text with the code. As long as you don't share it, your account is still yours.
4. Turn on two-step verification right away (see below).

How do I turn on two-step verification?

Two-step verification adds a PIN or second factor that the attacker doesn't have, even if they get a text code. CISA's guide to turning on multifactor authentication explains why it matters.

• WhatsApp: Settings Account Two-step verification Turn on. Choose a six-digit PIN you'll remember and add a recovery email.
• Telegram: Settings Privacy and Security Two-Step Verification, and set a password.
• Google, email, and banks: use an authenticator app or a passkey instead of codes by text whenever the service allows it.
• Your mobile carrier: ask for a PIN or passcode on your account to make port-outs and SIM changes harder.

What if I already sent the code?

If it was WhatsApp:

1. Open WhatsApp on your phone and re-register your number. You'll receive a new code by text; entering it logs the attacker out.
2. If they had already turned on two-step verification, you may have to wait before you can re-register. Keep trying, and meanwhile warn your contacts.
3. Tell your contacts through another channel (a call, social media, or a group of family members) that your account was hijacked and that they shouldn't send money or codes.
4. Once you're back in, turn on two-step verification.

If it was Google Voice:

1. Sign in to your Google account and check whether a Google Voice number was created with your phone. Reclaim your number in the Google Voice settings if possible.
2. Change your Google password and turn on two-step verification.

For any other account (email, bank, social media):

1. Change the password and log out of other devices.
2. If it's a bank, call it immediately using the number on your card.
3. If they may have used your identity, follow the plan at IdentityTheft.gov.

Where do I report it and who can help?

• Inside the app: report the account that asked you for the code.
• To the FTC: at ReportFraud.ftc.gov.
• If money was involved, to the FBI's IC3 and your local police.
• In NoCall: report the number in the spam numbers directory so others are warned.

Frequently asked questions

Can they hijack my WhatsApp without the code? In the common version of this scam, no: they need the text code. That's why sharing it is the critical mistake, and two-step verification is the safety net.

My friend asked me for the code. Is it really them? Probably not. Their account is likely already hijacked. Call them to confirm.

Why would anyone want my Google Voice number? Because it lets them make calls and send texts from a US number linked to a real person, which makes their other scams harder to trace.

Do I need to change my phone number? Usually not. Recover your account, turn on two-step verification, and keep sharing nothing.

In short

A text code is a key, not a formality. Never share it with anyone, for any reason, and turn on two-step verification in WhatsApp and your other apps today. If you already sent it, re-register your account, warn your contacts, and report it. And report the number that asked you for it in the NoCall spam numbers directory.