Your sister calls to ask if you're OK, because you've just asked her for £800 on WhatsApp. Or you open the app and it tells you your number is now registered on another phone. Or everything looks normal, but your friends are getting messages from you that you never wrote. Finding out your WhatsApp has been hacked is a horrible feeling, but you can get the account back, and most of the time you can do it yourself in a few minutes.
Here's how to recover your WhatsApp using WhatsApp's own steps, how to kick out anyone using it in secret, how to warn your contacts so nobody pays, and what to do if someone has already sent money. And if it hasn't happened to you yet, the last part covers what really protects your account, which comes down to a couple of settings that take a minute.
Quick answer
Open WhatsApp on your phone, with your SIM in it, and register your number again with the 6-digit code: this logs the hacker out of every device. Check Linked devices and log out anything you don't recognise, turn on two-step verification and warn your contacts by phone call or text not to pay anything. If someone has already paid, they should call their bank right now.
In this article
- How to tell if your WhatsApp has been hacked
- How to recover a hacked WhatsApp account, step by step
- Can they read your messages?
- Warn your contacts before anyone pays
- If one of your contacts paid: how to claim it back
- Reporting a hacked WhatsApp
- Imagine this happens to you
- How to protect your WhatsApp so it doesn't happen again
- Beware of anyone offering to get your WhatsApp back
- If you or your contacts have lost money
How to tell if your WhatsApp has been hacked
There are two main ways to take over a WhatsApp account, and they show up differently.
The first is stealing the whole account. The scammer tries to register your number on their phone, you get a text with the 6-digit code, and they get you to hand it over: by pretending to be WhatsApp, by posing as a friend who "sent you their code by mistake", or with a call-forwarding trick so the call with the code goes to them. When that happens, WhatsApp logs you out and tells you your number has been registered on a new device. It's the most dramatic version, but also the easiest to spot.
The second is quieter: linking a device to your account, as if it were WhatsApp Web, using a code they get you to enter in the "link with phone number" option. You keep using WhatsApp as usual and notice nothing, while they message your contacts from the other session. That's why still having access to the app doesn't mean nobody else is using it.
These are the signs that should make you suspicious:
- Someone tells you that you asked them for money, a code or a vote in some contest, and it wasn't you.
- Under Settings → Linked devices (on Android, in the three-dot menu) there's a computer, browser or phone you don't recognise.
- WhatsApp logs you out or asks for a two-step verification PIN you never set.
- You get a WhatsApp code by text that you didn't ask for. That means someone is trying to register your number, so don't give it to anyone.
If you're also noticing odd things on the phone itself, like apps you didn't install, the problem may go beyond WhatsApp. We explain how to check in how to tell if your phone is hacked.
How to recover a hacked WhatsApp account, step by step
The good thing about WhatsApp is that the account is tied to your phone number, and whoever holds the SIM holds the key to get it back. What you need to do depends on what happened.
If you've been locked out
- Open WhatsApp on your phone, with your SIM in it, and follow the steps to log back in with your number.
- Enter the 6-digit code you receive by text or call. According to WhatsApp's help centre, when you re-register your account you're automatically logged out of every device that had it connected. The hacker is out.
- If it asks for a PIN you don't know, the scammer turned on two-step verification to keep you out. WhatsApp explains that without the PIN you'll have to wait 7 days to try again, but that entering the text code still logs out whoever was using your account. So even if you have to wait before you can chat again, you've already cut off their access.
Two things are worth knowing. First, changing passwords won't remove anyone from WhatsApp: the only thing that does is re-registering the account with the code. Second, don't report your own account inside the app before you recover it, because WhatsApp warns it could ban the account and you could lose access.
If the text with the code never arrives or the call never comes, check that your calls aren't being forwarded to another number. Scammers sometimes get people to dial a forwarding code so they can receive the verification call themselves. We explain how to check and cancel forwarding in how to tell if your phone is hacked.
And if your phone was stolen or you lost your SIM, call your carrier to block it and get a replacement SIM with the same number. With the new SIM in, register WhatsApp again and the stolen phone is logged out automatically, as WhatsApp explains on its page about lost or stolen devices.
If they're still using your account without locking you out
- Go to Linked devices, tap each device you don't recognise and tap Log out. If you can do it without losing time, take a screenshot of that screen first, because it's useful evidence.
- Warn your contacts through another channel (more on that below).
- Turn on two-step verification and check your linked devices again the next day to make sure nothing new has appeared.
If you have an older iPhone and your contacts keep getting messages you can't see, update iOS to the latest version your phone supports first, then back up WhatsApp, delete the app completely, reinstall it from the App Store and register your number again. Spain's national cybersecurity institute, INCIBE, reported in October 2026 that doing it in that order was what solved the cases it handled.
If something still feels off after all that, contact WhatsApp support from inside the app. The UK's National Cyber Security Centre also has a clear, free guide to recovering a hacked account.
Can they read your messages?
It's one of the first things people worry about, and the answer depends on how they got in. If they registered your number on another phone, WhatsApp says they can't read your previous chats, because messages are encrypted and stored on your phone. What they do get are the new messages that arrive while they have the account, and they can write in your chats and groups pretending to be you.
If they linked a device instead, it's a little different. According to WhatsApp, when a device is linked your main phone sends it a copy of your recent message history, so they may have seen recent chats. That's why logging that session out quickly matters so much, and as soon as you do, their access is gone.
Think about whether those chats had anything sensitive, like a photo of your passport or driving licence, passwords or bank details. If so, change those passwords from a device you trust and let your bank know someone may have seen that information. If you're worried they'll use your details to pose as you elsewhere, read identity theft: what to do.
Warn your contacts before anyone pays
This is what saves the most money, and it needs doing right away, even before you've got the account back. Call or text your family and closest friends, starting with older relatives, and post a warning on another social network if you like. Don't use WhatsApp to warn people while you're not in control, because the scammer can delete your messages or reply as you.
Something as simple as this works well:
"My WhatsApp has been hacked. If you get a message from me asking for money, a code or a vote, it isn't me. Don't pay anything, just call me."
Ask anyone who got strange messages not to delete them and to take screenshots showing the number and the time. If you later need to report it or claim the money back, that evidence is gold.
And if you feel guilty because they used your name, please don't. You're a victim too, and these tricks are designed to catch anyone.
If one of your contacts paid: how to claim it back
Time is what matters most here, so keep a cool head, but don't leave it until tomorrow. This is what the person who paid should do:
- Call their bank straight away on the number on its website or the back of their card, say it's a scam and ask them to stop or recall the payment. If the money is still in the receiving account, it can still be frozen.
- Keep the payment receipt and screenshots of the chat, including the phone number or account details the money went to.
- Report it as soon as possible, so the police have the details of the receiving account.
- Complain to the bank in writing, explaining how it all happened.
Where they live makes a real difference. In the UK, since 7 October 2024, most scam payments made by Faster Payments or CHAPS must be reimbursed by the bank up to £85,000, under the APP fraud reimbursement rules, and if the bank says no you can take it to the Financial Ombudsman Service. In the US the rules are less generous for payments you sent yourself, but calling the bank or payment app immediately often means the money can be held before it moves on, and a lawyer can follow it to the receiving account and pursue it. If the money went through a payment app like Zelle or Cash App, see Cash App and Zelle scams, and for the full picture, can you get money back after a scam?.
Reporting a hacked WhatsApp
Breaking into someone else's WhatsApp is a crime. In the UK, the Computer Misuse Act 1990 makes unauthorised access to a computer or account an offence, and in the US the Computer Fraud and Abuse Act does the same. Asking your contacts for money while pretending to be you is fraud on top of that.
In England, Wales and Northern Ireland you can report it to Report Fraud, the police's national fraud and cybercrime service, and in Scotland to Police Scotland on 101. In the US, report it at ReportFraud.ftc.gov and to the FBI's IC3. Include screenshots of the messages, the number they used, the dates, a screenshot of the linked devices if you have one and, if someone paid, the receipt with the receiving account or phone number. Ideally the person who paid reports it and you report the misuse of your account too, even if nobody lost money, because it protects you if they keep using your name. We walk through the process in how to report a scam.
Imagine this happens to you
Imagine that on a Friday afternoon you get a text with a WhatsApp code you didn't ask for and, right after, a message from a friend: they typed their number wrong and the code came to you, could you forward it? You send it without thinking. Ten minutes later WhatsApp logs you out, and that evening your aunt calls because you asked her for £500 for an emergency and she's already sent it.
In a situation like that, the most useful thing would be to register your number again with a new code, even if it asks for a PIN you don't know, because that already locks the scammer out. At the same time, you'd call the family so nobody else pays, and your aunt would call her bank that same evening to try to stop the transfer and report it with the receipt and the account that got the money. You'd report the account theft too. It's just an example, but it's how many of these cases start, and acting in the first few hours makes all the difference.
How to protect your WhatsApp so it doesn't happen again
If it hasn't happened to you yet, or you don't want it to happen again, these settings shut the door on almost every account takeover:
- Turn on two-step verification. Go to Settings → Account → Two-step verification, choose a 6-digit PIN you don't use anywhere else and add a recovery email only you can access. That way, even if someone gets the text code, they can't register your account without your PIN. WhatsApp explains how to manage it.
- Never share your 6-digit code or your PIN, not with someone claiming to be WhatsApp and not with a friend or relative. Nobody legitimate will ask for it.
- Never enter a code from a website into WhatsApp, whether it's for a vote, a giveaway or an "update". Only use the link-a-device option yourself, with your own computer in front of you. And if WhatsApp detects an unfamiliar device, it asks you to confirm before linking it: if in doubt, tap "Don't link".
- Check your linked devices every now and then and log out anything you don't use.
- Keep your phone and WhatsApp updated, especially on an iPhone running an old version of iOS.
- Whenever someone asks for money on WhatsApp, even someone you trust, call them on their usual number before paying.
If you want to know the messages these takeovers usually start with, we cover them in WhatsApp scams: the fake update trick.
Beware of anyone offering to get your WhatsApp back
As soon as someone posts online that their account was stolen, profiles of so-called hackers or experts appear, promising to recover it or get the money back 100%, always for a fee up front. Recovering your WhatsApp is free and you do it yourself with the code sent to your number, and anyone who guarantees results in exchange for paying first is usually running a second scam. Before you pay anyone, read how to spot recovery scams.
If you or your contacts have lost money
Having your WhatsApp stolen and your name used to ask your loved ones for money is infuriating, but it can be dealt with, and the sooner you act, the more options there are. If someone has paid, if there are charges on your bank account or if the hack went beyond WhatsApp, it's worth having a professional look at it.
We are lawyers and expert investigators specialising in online scams, cryptocurrency and cybercrime, and every case is handled by a lawyer or an expert investigator. We document how your account was used so it's on record, trace the money to the receiving account, prepare the claim to the bank and ask the authorities for whatever is needed to try to freeze the funds. In many cases the money is recovered, especially if you act fast. At Kironic we do everything we can to recover your money: send us your case and we'll look at it together.
