Hacked WhatsApp: how to get your account back, step by step

If someone has taken over your WhatsApp, open WhatsApp on your phone, enter your phone number and type the six-digit code you receive by SMS or phone call. When you re-register this way, every device logged into your account is logged out automatically, as WhatsApp’s recovery page explains. Then turn on two-step verification, so that a code alone is never enough again.

WhatsApp says that someone who re-registers your account on a new device “can’t read your past conversations”, because messages are stored on your device. And anyone can be fooled: the request for the code usually comes from a friend whose account was taken first.

Do this now

Get back in with your number. In WhatsApp, tap Log back in > Continue, enter your full international phone number if asked, then the six-digit code, following WhatsApp’s steps. Changing your password will not remove the other person: re-registering with the code is “the only way”.
Give the code to nobody. WhatsApp says you should never share it, “not even friends or family”.
Warn your family and friends through another channel: a phone call, an SMS, an email. WhatsApp advises it because the other person could impersonate you in chats and groups, and the Polizia Postale warns that stolen accounts are used to ask family and friends for money.
If anyone already paid, they should call their bank now, on the number on their card or in the bank’s official app. The first steps are in I’ve been scammed: what to do in the first 30 minutes.
Keep the evidence. Ask anyone who received messages in your name to take screenshots, with the date and the number, and keep the message that asked you for the code. The FBI’s IC3 asks victims to keep evidence such as chat transcripts in a safe place in case investigators ask for it.
If WhatsApp asks for a two-step verification PIN you never set, keep calm. What to do is below.
Once you are back in, lock the account, with the steps below.
Do not report your own account to WhatsApp before you get it back. WhatsApp says that if you report the compromised account you are trying to recover, it might ban it, and you could lose access to your account. Reporting the crime to the police is a separate step (below).
Ignore anyone who offers to recover the account for a fee. More on this below.

How do people lose their WhatsApp account?

Usually through the six-digit code. WhatsApp sends it when a number is set up on a phone, the step you go through when you change phone, as the Polizia di Stato explains. If a stranger starts that procedure with your number, the code still arrives on your phone, so they need you to hand it over. The usual tricks:

A message from a friend. “Hi, I sent you a code by mistake, can you send it back?” It comes from someone in your contacts, so it looks genuine. The friend is usually another victim, the Polizia di Stato notes.
A link to vote in a contest. On 10 October 2026 the Polizia Postale warned about a new wave of messages, apparently from known contacts, asking you to vote for a little girl in a dance contest or another online competition. The link leads to a site that asks for your phone number and then for the code you receive, which lets the criminals register your WhatsApp on their own device.
Your voicemail. Switzerland’s National Cyber Security Centre (now the Federal Office for Cyber Security) reported in August 2023 that attackers ask for the code by phone call at night, so it ends up in voicemail, and listen to it using the voicemail’s original password. WhatsApp’s security tips say to set a voicemail password that is difficult to guess.
A SIM swap. A scammer may tell your mobile carrier that your phone was lost and get your number moved to a new SIM card that they control, the US Federal Trade Commission (FTC) explains. A phone that suddenly has no calls, texts or data is the warning sign.
Your Meta Account. If WhatsApp is added to your Meta Account and someone got into one of its profiles, WhatsApp’s tips say to contact the support team of the affected profile, for example Facebook or Instagram, to help recover WhatsApp. You can also move WhatsApp out of your Meta Account for a while, until all your profiles are secure.

The signs: WhatsApp notifies you when someone tries to register an account with your phone number. If you open the app and see “Your phone number was registered with WhatsApp on a new device”, follow the steps on screen to recover it, as the tips page says. Friends may also mention messages you never sent.

I got a WhatsApp code I didn’t ask for: what should I do?

Do not share it, and do not reply to whoever asks for it. A code you did not request means that someone has started registering your number on another phone, and they cannot finish without it, as the Polizia di Stato explains. As long as the code stays with you, so does your account.

The same goes for email. If you receive emails with a registration code you did not ask for, WhatsApp’s tips say not to click any link or share the code: someone could be trying to access your phone number on WhatsApp. Then turn on two-step verification. If the request came from a friend, call that friend: their account has probably been taken.

It asks for a two-step verification PIN I never set: what now?

In rare cases, WhatsApp says, someone using your account may have turned on two-step verification. You still have the upper hand: “whether you know the PIN or not”, anyone using your account is logged out once you enter the six-digit code. WhatsApp’s recovery page then says: “If you don’t have the PIN, wait 7 days and try again.”

WhatsApp is upgrading the six-digit PIN to a password, so the screen may ask for a password instead. Its page for when you can’t remember the password gives two more options:

Verify another way. Tap Verify another way, choose email, SMS or voice call, and enter the code you receive.
Reset the account. If you cannot complete two-step verification, the option to reset unlocks “after a few days” and cannot be undone. If you last logged in less than 30 days earlier, a reset deletes the messages received since then, and your profile stays. After more than 30 days, it deletes your messages and your profile.

I can’t receive the code: what can I do?

Ask for a call. WhatsApp’s recovery page says the code can come by SMS or phone call.
If your phone was lost or stolen, WhatsApp’s steps are: call your mobile provider as soon as possible and ask them to block your SIM card; ask for a new SIM card with the same number; activate it and put it in a phone; open WhatsApp and re-register. The lost phone is then logged out. WhatsApp cannot deactivate the account for you, and you cannot log out of your account from WhatsApp Web or desktop. Without a SIM with your number, the account cannot be recovered.
If your phone suddenly has no service at all, someone may have moved your number to their SIM. The FTC says to contact your mobile carrier immediately “to take back control of your phone number”, then change your passwords and check your bank and card accounts.

How do I check WhatsApp Web and other linked devices?

Other devices, such as a computer running WhatsApp Web or WhatsApp Desktop, can be linked to your WhatsApp. On your phone, WhatsApp’s help gives the path for Android: menu > Linked Devices. Tap a device you do not recognize, then Log Out, and repeat for each one. WhatsApp recommends checking this list regularly.

WhatsApp cannot tell you who accessed your account, or when and from where, its help notes.

Can I call WhatsApp, or pay someone to recover it?

WhatsApp’s help gives no phone number. Its contact page offers a contact form for support questions. Do not trust a “WhatsApp support” number found in search results or on forums.

Anyone who calls or messages offering to recover your account, or money, for a fee is a scammer. The FTC warns that “government agencies and legitimate organizations will never ask for money to help you get a refund”, and that anyone asking for “upfront fees is a scammer”. The FBI’s Internet Crime Complaint Center (IC3) says it “will never directly contact you for information or money”.

I got it back: how do I keep it safe?

WhatsApp recommends turning on its security features and reviewing linked devices once you have re-registered. The paths are the ones its help gives for Android.

Turn on two-step verification. menu > Settings > Account > Two-step verification, then turn it on, create a strong password and add an email address you can access (you can skip it), as WhatsApp’s settings page describes.
Add an email address to your account. menu > Settings > Account > Email address > Add email, then enter the six-digit code sent to that address, as the same settings page describes. WhatsApp’s tips say an email lets you recover your account without needing SMS or a phone call.
Add a passkey. It links your account to your phone’s fingerprint, face or screen lock, as WhatsApp’s help explains. Its blog gives the path: Settings > Account > Passkeys.
Check Linked Devices and log out of anything you do not recognize, as above.
Set a voicemail password that is difficult to guess, and never share your registration code or password, as the tips say.

Someone asked my contacts for money in my name: what now?

The Polizia Postale describes the pattern: messages from a stolen account ask, with urgency, for a bank transfer, a phone top-up or another payment, citing an emergency. Tell your contacts “to ignore pleas for help or money” sent from your account, as the FTC advises after a hack.

Anyone who paid should call their bank first and follow the first 30 minutes after a scam.

Where do I report it?

If you are in Italy

The Polizia Postale e per la Sicurezza Cibernetica, Italy’s police for online crime, asks victims to report through its official channels. Its Segnala online form is for reports, not formal complaints. A formal complaint (denuncia or querela) is made at a police office, and you have the right to a receipt, as the Polizia Postale explains. If money was paid, the person who paid should file one too. In an emergency, call 112 or 113.

If you are in the UK

If money was lost, the National Cyber Security Centre (NCSC) says to tell the bank and report it to Report Fraud (formerly Action Fraud), which replaced Action Fraud on 4 December 2025: reportfraud.police.uk or 0300 123 2040. In Scotland, call the police on 101.

If you are in the US

Report it to the FTC at ReportFraud.ftc.gov, as the FTC advises for scams, and, for crimes that happened online, to the IC3 at ic3.gov.

Elsewhere

Call the police of your country, and see where to report a scam for the official channels in 36 countries.

What if I can’t get it back?

Some accounts cannot be recovered, for example without a SIM card with the same number, as WhatsApp notes. In that case, the NCSC advises creating a new account, giving your contacts the new details and telling them you have abandoned the old one. Keep warning family and friends that messages from the old account are not from you.

Where to go next

Hacked account: the official recovery links, for your email and your other accounts.
I’ve been scammed: what to do in the first 30 minutes, if money was paid in your name.
Where to report a scam, the official channels in 36 countries.
Is this text a scam?, for fake bank, parcel and fine messages that ask for codes.

Common questions

My WhatsApp was hacked, what do I do?

Open WhatsApp on your phone, enter your phone number and type the six-digit code you receive by SMS or phone call: WhatsApp says every device logged into your account is then logged out. Warn your family and friends by phone or SMS that messages from your number may be fake. If someone asked your contacts for money, anyone who paid should call their bank at once.

How do I recover my hacked WhatsApp account?

Re-register your phone number in the WhatsApp app with the six-digit code. Changing your password does not remove the other person: WhatsApp says re-registering with the code is the only way. Try to recover the account before reporting it to WhatsApp, because WhatsApp may ban a reported account and you could lose access to it.

I got a WhatsApp code I didn't request, what should I do?

Do not share it with anyone, not even a friend who says they sent it by mistake. WhatsApp says you should never share your registration code, not even with friends or family; a code you did not ask for means someone may be trying to register your number. If it arrives by email, do not click any link in it either.

WhatsApp asks for a two-step verification PIN I never set, what now?

Someone using your account may have turned it on. Entering your six-digit code still logs them out, whether or not you know the PIN. WhatsApp's recovery page says to wait 7 days and try again; its page on forgotten passwords offers Verify another way, and a reset option that unlocks after a few days and can delete messages or your profile.

Can I report a hacked WhatsApp to the police?

Yes. In Italy the Polizia Postale asks victims to report it; a formal complaint (denuncia or querela) is made at a police office, while the Segnala online form on commissariatodips.it is only a report. In England, Wales and Northern Ireland report to Report Fraud (formerly Action Fraud) if money was lost; in Scotland call 101. In the US, report to the FTC at ReportFraud.ftc.gov and, for crimes online, to the FBI's IC3.

How do I protect WhatsApp from hackers?

Never share your registration code or password, turn on two-step verification and add an email address to your account. Add a passkey, so you can log in with your fingerprint, face or screen lock. Check your linked devices regularly and set a voicemail password that is hard to guess.

Topics: account recovery, WhatsApp