"I sent you a code by mistake": how your WhatsApp gets stolen

"I sent you a code by mistake": how your WhatsApp gets stolen

An SMS arrives with a six-digit code you never asked for and, almost at the same moment, a message from a friend, someone in the school parents' group or a "WhatsApp technician": "Sorry, I sent you a code by mistake, can you forward it to me?". It looks like a harmless favour, but that code is the key to your account. If you send it, someone else will register your WhatsApp or Telegram number on their own phone, you will lose access, and the criminal will start messaging all your contacts pretending to be you. The rule is simple and has no exceptions: you never share a verification code or OTP, with anyone.

How does the account takeover work?

WhatsApp and Telegram identify your account by your phone number. When someone installs the app on a new phone and enters a number, the service sends a code by SMS (or by a call, or inside the app) to the owner's phone to confirm it belongs to them. The criminal needs exactly what just landed on your phone.

The script usually follows these steps:

1. The criminal enters your number on their phone and starts registering. You receive the official SMS with the code.
2. They message you to ask for it. Often from the account of a real contact that has already been stolen, which is why the message comes from someone you trust. Other times they pose as WhatsApp support, as the organiser of a competition or a vote, or as someone who "got the wrong number".
3. They pile on the pressure. "It's urgent", "my account is going to be blocked", "it will only take a second".
4. If you send the code, the account moves to their phone. Your WhatsApp is logged out, and they often switch on their own two-step verification so that you cannot easily get it back.
5. They use your identity. They message your contacts and groups asking for urgent money by EFT, e-wallet or cash-send, or, once again, for "the code I sent you by mistake". That keeps the chain going.

What are the warning signs?

• You get a code you did not request. This is the clearest sign: someone is trying to get into your account.
• The SMS itself tells you not to share it. Official messages from WhatsApp, Telegram, your bank and almost every service say so.
• You are asked for it over chat, even by a friend. Nobody can "send you by mistake" a code for their own account: codes always go to the number being registered.
• "Technical support" messages you. WhatsApp and Telegram will not ask you for a code by chat, SMS or phone call.
• There is a rush or an odd excuse: a competition, a vote, an account that is "about to be blocked".

What do I do right now if someone is asking for it?

1. Do not forward the code or read it out over the phone. Not even part of it.
2. Check through another channel. If the message comes from a contact, call them on their usual number or ask them in person. Their account has very likely been stolen already; let them know.
3. Switch on two-step verification now (we explain how below). With it, even if someone gets a code, they will also need a PIN that only you know.
4. Block and report the chat in the app. If the message came from an unknown number, you can also report it in the spam numbers directory.
5. Warn everyone else: if a friend's account is being used to impersonate them, tell your shared groups so nobody else falls for it.

How do I switch on two-step verification?

It is the single most effective protection against this fraud, and it takes a minute:

• WhatsApp: Settings Account Two-step verification Turn on. Choose a six-digit PIN you do not use anywhere else and add an email address so you can reset it if you forget it. WhatsApp explains the options on its two-step verification help page.
• Telegram: Settings Privacy and Security Two-Step Verification. Create a password and add a recovery email.

Do not share that PIN or password either. Menus may vary slightly between app versions, but the option always has that name. While you are there, check your linked devices (in WhatsApp: Settings Linked devices; in Telegram: Settings Devices) and end any session you do not recognise.

What if I already sent the code?

Act fast. The sooner you do, the easier it is to get it back:

1. Register your number again on your own phone. Open WhatsApp, enter your number and verify it with the new code you will receive by SMS. When you do, the criminal's session is closed.
2. If it asks for a PIN you do not know, the criminal has switched on their own two-step verification. They cannot keep you out forever: after a waiting period of several days, WhatsApp lets you register again without that PIN. Meanwhile, contact support from inside the app (Settings Help) and explain that your account was stolen.
3. On Telegram, log in with your number, go to Settings Devices and tap "Terminate all other sessions". Then set your two-step verification password.
4. Warn your contacts another way (SMS, a call, social media or through relatives): "My WhatsApp has been stolen, ignore any message from me asking for money or codes".
5. If the code was an OTP from your bank or a payment app, call your bank's fraud line immediately (the number on the back of your card or on its website) to block transactions.
6. Keep evidence: screenshots of the messages, the number that contacted you and the time.

Where do I report it and who can help?

• SAPS: open a case at your nearest police station with the screenshots, especially if someone used your identity or lost money, and ask for the case number. Having sent the code does not make you guilty: you are the victim of a deception.
• Your bank, on its official number, if any banking OTP was involved or money left your account.
• WhatsApp or Telegram support, from inside the app, to report the account takeover.
• 10111 (or 112 from a cellphone): only if there is an emergency or an immediate threat.

If any of your contacts were asked for money in your name, read how the fake "new number" WhatsApp scam works: it is the usual next step after this theft.

Frequently asked questions

I got a code I didn't ask for but I didn't give it to anyone. Am I in danger? No. Without the code they cannot get in. It means someone tried your number; ignore the SMS, do not reply to anyone asking for it, and switch on two-step verification.

A real friend asked me for it. How can it be a scam? Because the person writing is probably not your friend but whoever stole their account. Call them before you do anything.

Can they read my old conversations? In general, registering the account on a new phone does not download your old chats unless they have access to your backup. What they can do is write in your name and see new messages that arrive while they control the account.

Should I change my number? There is no need. Getting the account back and switching on two-step verification is enough.

In short

A code that arrives by SMS belongs to you and nobody else: not friends, not "technical support", not competitions. If someone asks for it, do not send it, check through another channel and switch on two-step verification. If you already sent it, register your number again, warn your contacts and open a case. And if the attempt came from an unknown number, report it in the NoCall spam numbers directory so that others recognise it in time.