"Your WhatsApp will expire today unless you update." "We found a problem with your account, tap here to keep receiving messages." Or just a friend sending you a link to vote for their niece. The fake WhatsApp update is one of the most common WhatsApp scams, and it comes in many versions. The goal is almost always the same: get you to tap, share a code or install something. With that, the scammer takes over your account, quietly uses it in the background or gets into your phone. And that's usually where the real target comes in: asking your friends and family for money.
This guide shows you how to recognize the message, what to do if you already clicked, and how to stop the damage before someone pays.
Quick answer
WhatsApp updates through Google Play or the App Store, never through a link sent by chat or text. If you clicked or shared a code: go to WhatsApp → Linked devices and log out anything you don't recognize, turn on two-step verification, and warn your contacts through another channel (a call or a text) not to send money. If someone already paid, they need to call their bank right now.
In this article
- What the fake message looks like
- What they're after: your account, your data or your money
- If you already clicked the link or shared the code
- If someone asked your contacts for money
- How to turn on two-step verification
- Other WhatsApp scams to know about
- Watch out for anyone promising to fix it all
- When to get help
What the fake message looks like
There's no single script, but the pattern is easy to spot once you know it:
- The "mandatory update" warning. It arrives on WhatsApp from a number you don't have saved, sometimes with the WhatsApp logo as the profile picture, or by text message. It says your version is out of date, you'll lose your chats or your account will be blocked, and it includes a link.
- Fake "support" asking for your code. Someone poses as the WhatsApp team: "to finish the update, send us the 6-digit code we just sent you." You got that text because they're trying to register your number on their phone.
- A download for a "new version." WhatsApp Gold, WhatsApp Plus, a version "with new features"... The link installs an app that isn't the official one. WhatsApp warns that fake versions carry serious privacy and security risks.
- A link from someone you know. A friend asks you to vote in a contest, check a photo you're "tagged" in or confirm something. Their account has already been compromised and the scammer is the one writing.
The common thread: urgency, a threat of losing your account, a link, and a request for something you should never hand over. WhatsApp's Help Center lists exactly these red flags: being asked to tap a link, turn on new features through a link or download an app.
What they're after: your account, your data or your money
Taking over your account with the registration code
The 6-digit code you get by text or call is what registers your WhatsApp number on a phone. Share it, and the scammer moves your account to their device and locks you out. WhatsApp is blunt about this: never share your registration code with anyone, not even friends or family. It's also one of the key tips in WhatsApp's scam awareness campaign with National Trading Standards in the UK.
Using your account in secret (a linked device)
This is the quiet version. The fake page asks for your phone number and shows you a code to enter in WhatsApp under "link a device." That code doesn't confirm any update or vote. It lets the scammer's device use your account, just like WhatsApp Web. You keep using WhatsApp normally and notice nothing, while messages go out to your contacts from the other session.
Getting into your phone with a fake app
If the link made you download and install an app, the risk goes beyond WhatsApp. A malicious app may try to read your texts, notifications or what you type, and use that to get into your email or bank.
And in the end, your money or your friends' money
With your account, the scammer messages your family and friends using your name and photo: an emergency, a bill you "can't pay because your bank blocked you," a quick transfer you'll pay back tomorrow. By the time anyone realizes it wasn't you, the money may already be gone.
If you already clicked the link or shared the code
Take a breath. What you need to do depends on how far it went:
- You only opened the link. Close the page and don't follow any instructions. Opening it alone doesn't link your account, but check your linked devices anyway.
- You linked a device or entered a code in WhatsApp. Go to WhatsApp → Settings (or the three-dot menu on Android) → Linked devices, tap anything you don't recognize and choose "Log out." Take a screenshot first if you can.
- You shared the 6-digit code and lost your account. Open WhatsApp on your phone, with your SIM card, and re-register your number with a new code. WhatsApp says this automatically logs out every other device. If it asks for a two-step verification PIN you never set, the scammer turned it on: WhatsApp says you'll need to wait 7 days to try again without it. Changing passwords won't kick anyone out; re-registering with the code will.
- You installed an app or downloaded a file. Uninstall it, scan your phone with a reputable security tool and, from another device, change your email and online banking passwords. Call your bank if you shared login details or see anything odd.
Once you're back in control, turn on two-step verification (steps below) and check your linked devices again the next day.
Before you delete anything
Screenshot the fake messages, the number that contacted you, the web address and any unknown linked devices. Ask your contacts to keep what they received too. If you need to file a report or dispute a payment later, that evidence is what helps most.
If someone asked your contacts for money
The clock is against you here, so order matters:
- Warn people through another channel, now. Call or text your closest family and friends, and post a heads-up elsewhere if needed. Don't use WhatsApp to warn people if you haven't regained control yet, and don't forward the scam link, not even as a warning.
- If someone paid, they should call their bank or payment app immediately using the official number, say it's fraud and ask to stop or reverse the payment. Nothing is guaranteed, but speed is what makes the biggest difference. If it went through Zelle, Cash App or Venmo, see what to do after a payment app scam.
- Report it. In the US, file at ReportFraud.ftc.gov and, for online losses, with the FBI's IC3. In the UK, report to Report Fraud and forward scam texts to 7726. Your friend should include the payment receipt, the account or number they paid and screenshots. Here's more on how to report a scam.
- Getting money back depends a lot on how it was paid. We go through the options in can you get money back after a scam?.
A typical case: a dad gets a WhatsApp from his daughter's account asking for $950 to cover an urgent bill "because her bank froze her card." He sends it to an account he doesn't recognize. An hour later, she calls him knowing nothing about it. If he calls the bank at that moment, there's a chance. If he waits until Monday, the money has usually moved on.
How to turn on two-step verification
It's the simplest protection against account theft via the text code, because it adds a PIN only you know:
- Open WhatsApp and go to Settings → Account → Two-step verification.
- Tap Turn on and pick a 6-digit PIN you don't use anywhere else.
- Add a recovery email that only you can access.
WhatsApp may ask for this PIN now and then; it's not the same as the code you get by text when registering. Never share it, even if someone says it's "to verify an update." One caveat: two-step verification doesn't replace checking linked devices. Against linked-device hijacks, what works is never entering codes a website gives you and logging out sessions you don't recognize.
Other things that help:
- Turn on automatic updates for WhatsApp and your phone's system.
- Check "Linked devices" every so often.
- Limit who can see your profile photo and info, so you're harder to impersonate.
- Before paying anyone who asks on WhatsApp, even someone you trust, call them on the number you've always used.
Other WhatsApp scams to know about
The fake update is only one way in. Other common ones:
- "Hi Mom, this is my new number." A stranger poses as your son or daughter from a different number and ends up asking for an urgent payment.
- Fake contests, giveaways and votes that end with a request for your number and a code.
- Job and investment offers with easy money, which WhatsApp itself lists among typical scams. If you were added to an investment group, read can stolen crypto be recovered?.
- Messages from your "bank," a delivery company or a tax agency with a link to "verify" details or pay a fee.
Watch out for anyone promising to fix it all
After an account takeover, profiles often pop up offering to "recover your WhatsApp" or "get your money back" for an upfront fee. WhatsApp reminds users that the app is free and that anyone offering to unlock your account for money is probably after your data. And no one can guarantee your money comes back. Before paying anyone, read how to spot crypto recovery scams.
When to get help
If you only clicked the link and nothing else happened, checking linked devices, turning on two-step verification and staying alert is usually enough.
It's worth a professional review when money is involved: contacts who paid thinking it was you, charges on your account after installing an app, or several payments. At Kironic, we deal with scams and account takeovers every day. Send us the screenshots, receipts and whatever you know about the payments. We'll review it for free, tell you what to do first with the bank and the police report, and whether it makes sense to go further. If the honest answer is that the odds are low, we'll tell you that too.
