Updated 10 October 2026. WhatsApp security options can change by app version.
Your WhatsApp account suddenly starts requesting money from friends, or the app says your number was registered elsewhere. The right response is to secure the messaging account, warn contacts and check any separate financial exposure. This guide explains what a registration code means, what linked devices can access and how to recover through the platform’s official instructions.
What an account-takeover alert really means
You receive a WhatsApp message saying your phone number was registered on another device, or a friend reports that your account asked for money. A sudden alert should be taken seriously, but an unsolicited registration code is not, by itself, proof that somebody has gained access. WhatsApp notes that another user might have typed your number by mistake or an attacker may be attempting a takeover. Check whether you can still access your account, whether messages were sent without your knowledge and whether an unfamiliar computer appears under Linked Devices.
Registration codes are private
When a number is registered, WhatsApp may send a verification code through an authorised channel. Criminals sometimes claim they accidentally sent a code to your number and ask you to forward it, or impersonate a support worker asking for verification. That code is not a social favour. Never share it with anybody who contacts you. A familiar-looking chat account can itself be compromised. You should only enter the code during an authentic registration process that you personally initiated inside the official app.
How to recover when someone registered your number
If the platform confirms that the number was registered elsewhere, begin recovery in the official WhatsApp app. WhatsApp’s Help Center describes re-registering your number as a way to log out another registered device and regain control. Follow the current verification prompts and any additional protection that applies to your account. Some scenarios involve delays or other verification requirements. Avoid third-party recovery websites, unofficial patched applications and anyone who promises guaranteed account restoration in exchange for an advance fee. Those approaches can create new security risks.
Linked Devices are a separate risk
WhatsApp Web and companion sessions let people use chats on a computer or other device. This convenience also means an office laptop or borrowed machine may remain connected longer than intended. Open WhatsApp’s Linked Devices section and inspect the list. Log out of unfamiliar or unnecessary sessions. A linked session is different from re-registering a phone number on a new primary device, so the response should match the actual problem. If a shared computer was involved, change its access arrangements and review other sensitive accounts used there.
Two-step verification and newer account security settings
The current WhatsApp Help Center explains that some two-step verification settings are evolving from six-digit PIN protection toward password-based or other supported verification methods. Menus vary by app version and account. Use your own application’s Settings and Account areas to inspect what is available, then enable appropriate extra protection. Choose a strong secret that is not reused for banking or email, and secure the recovery address. Passkeys and trusted-device options may be available on supported setups, but no security setting makes it safe to reveal a registration code in chat.
Warn contacts through an independent route
An attacker who controls a messaging identity may ask friends for an emergency loan, shopping payment or OTP. Call important contacts through another verified number or application and warn them that recent messages might be impersonation. Keep the warning direct: do not transfer money or disclose codes without independently checking. Avoid forwarding the suspicious payment link in your warning. If somebody already paid, encourage them to contact their bank quickly and preserve the transaction reference. A family verification phrase or callback routine can reduce the chance that a hijacked account causes further loss.
Check whether banking access was separately exposed
Messaging compromise does not automatically give an attacker your bank password or UPI PIN. However, chats may contain old statements, document photographs, contact details or account references. If you shared banking credentials or lost control of the physical phone or SIM, take additional steps with the affected institution. Review recent transaction alerts and the security of the email account used for recovery. Our lost phone and UPI safety guide covers the different situation in which the handset itself has been lost or stolen.
What about end-to-end encryption and backups?
End-to-end encryption protects communication in transit, but it cannot make an already accessible device or unlocked account harmless. A person who can view an active linked session may gain access to messages available through that session. Cloud backups, shared media and screenshots can also contain personal details that should be protected separately. Review what data may actually have been exposed instead of assuming that all conversations were read. WhatsApp says it cannot always identify exactly who accessed an account or the time and place of that access.
Save evidence before deleting anything
If someone used your identity to request money, preserve relevant chats, incoming alerts, linked-device information and messages from affected contacts. Keep a timeline of events and the steps taken to restore security. Use WhatsApp’s official reporting controls where appropriate. If financial cybercrime occurred in India, report through the National Cyber Crime Reporting Portal or helpline 1930 and notify affected banks. Make the report factual; avoid speculating about an attacker without evidence. Reporting is important even though it cannot guarantee recovery of funds.
A practical recovery and prevention checklist
Use the official app to recover number access, review Linked Devices, enable current supported account security, secure your SIM and email, update your phone and warn contacts if impersonation occurred. Do not install modified WhatsApp versions from strangers. Record any bank transfer references involved and keep screenshots redacted when sharing with authorities. If the compromise came through a message asking for money, our urgent money-request and impersonation guide can help explain the tactics. Regularly checking active sessions is a small habit that reduces future risk.
An example involving a colleague
A colleague receives an unusual message from your WhatsApp number saying you are in a meeting and urgently need ₹12,000 sent to an unfamiliar account. They are about to pay because the profile photo and writing style look familiar. A short independent phone call would reveal that you sent no such request. If you discover this impersonation, recover access first and warn other colleagues promptly. Treat any completed transfer as a separate financial incident requiring accurate bank and cybercrime reporting rather than assuming a message deletion will reverse the payment.
Frequently asked questions
Does an unexpected code prove my WhatsApp account was hacked?
No. It can indicate a mistaken or unauthorised registration attempt. Never share the code.
Can I log out of unfamiliar WhatsApp Web sessions?
Yes. Check Linked Devices in the official app and remove sessions you do not recognise.
Can re-registering recover an account?
WhatsApp describes re-registration as a recovery route, subject to current security checks and possible delays.
Should I pay a third party to unlock it?
No. Use the official recovery tools and do not share passwords or registration codes.
Sources and further reading
WhatsApp account recovery; WhatsApp linked devices guidance; WhatsApp registration and two-step verification. For editorial corrections contact NJPEJOB without sharing private account information.
