The most useful WhatsApp security steps are straightforward: protect your phone number and device, enable two-step verification, review linked devices, and never share a verification code with someone who contacts you unexpectedly. These steps cannot prevent every scam, but they make it harder for another person to take over your account or misuse it.
WhatsApp changes menus over time, and Android and iPhone screens can differ. Treat the paths below as guidance and confirm the current instructions in the WhatsApp Help Center. This guide focuses on ordinary account safety, not on investigating or retaliating against anyone.
Start with the account takeover basics
WhatsApp registration is tied to your phone number. A common social-engineering attempt is to persuade you to reveal a code sent during account registration, or to approve something you did not initiate. The person may pretend to be a friend, support agent, employer, or delivery service.
Keep this simple rule: a code that arrives on your phone is for you to enter into the official app when you initiated the action. Do not read it to a caller, send it in a chat, or type it into a link someone sent. A convincing explanation does not make a request safe.
If a friend messages from a familiar account asking for money or a code, verify the request in a different way. Call the person using a number you already know. A compromised account can send messages that look like they came from its owner.
1. Turn on two-step verification
Two-step verification adds a PIN that WhatsApp asks for at intervals and during certain account changes. It is different from the one-time registration code delivered by SMS. Use a PIN you do not use for your bank card, phone lock, or another account.
In WhatsApp, open Settings (on some devices, first tap the three-dot menu), then look for Account → Two-step verification. Follow the current in-app prompts to enable it and add an email address if WhatsApp offers that recovery option. Menu names can shift, so check the app's own help instructions if your screen differs.
Use an email account you can still access and secure that inbox with its own strong password and multi-factor authentication. If someone controls your email, a recovery channel can become another route into accounts.
Avoid: writing your PIN in a chat with yourself, using an obvious sequence, or giving it to someone who claims they need it to “verify” you.
2. Review linked devices
Linked devices are useful when you intentionally use WhatsApp Web or another supported device. They also give you a place to check for sessions you do not recognize.
Open WhatsApp settings and select Linked devices. Review the list. If you see a device or browser session you do not recognize, log it out from the app. If you recently used a shared computer, sign out there and review the list again.
Do not scan a QR code just because a stranger, a supposed recruiter, or a support caller instructs you to. Before scanning, understand which device you are linking and why. A QR code is an action, not a harmless picture.
3. Tighten privacy settings thoughtfully
Open Settings → Privacy and decide who can see information such as your last seen, online status, profile photo, About text, status updates, and group invitations. Pick settings that suit your life; there is no single correct choice for everyone.
For example, if you use WhatsApp for work with people you do not know personally, you may want to limit profile details and control who can add you to groups. If a privacy option is unclear, read its in-app explanation before changing it.
Privacy settings reduce what other people can see inside the service. They do not make messages immune to screenshots, forwarding, compromised devices, or a recipient sharing what you sent. Avoid sending passwords, identity documents, or other sensitive information in a chat unless you have considered the risks and have a genuine need.
4. Protect the phone and the SIM
Use a screen lock that is difficult for another person to guess. Keep the operating system and WhatsApp updated through the official app store and device settings. Do not install a configuration profile, “security tool,” or remote-access application at the request of an unexpected caller.
Protect your primary email and your mobile carrier account too. If you lose service unexpectedly, contact your carrier through its official support route and ask whether your number or SIM has been changed. Do not rely on a number provided by a suspicious message.
Turn on device-level security features that fit your needs, such as a strong passcode and screen lock timeout. If you use WhatsApp's app lock or biometric lock, remember it protects access to the app on that device; it does not replace the account PIN or a secure phone.
5. Think through backups
Chat backups can help restore conversations after changing phones, but they may contain private material. Review WhatsApp's current backup settings and understand where a backup is stored, which account controls it, and what protection options are available for your device and region.
Secure the associated Google or Apple account with a unique password and multi-factor authentication. Do not assume a backup is protected simply because the phone app is locked. For current options and limitations, use WhatsApp's own documentation and your cloud provider's help pages.
If you think someone accessed your account
Act from the official WhatsApp app and help center:
- Try to register your number again in the official app and follow the verification prompts. Do not share any code with another person.
- Check Linked devices and log out sessions you do not recognize.
- Tell close contacts through another channel that they should verify unusual requests supposedly sent by you.
- Secure the email account and device connected to your WhatsApp use.
- Follow the current account-recovery process in the WhatsApp Help Center.
If the incident involves financial loss or threats, preserve messages and transaction references and contact the relevant bank or official reporting service through independently verified details. Check the current Indian reporting process before adding a phone number or promising a particular recovery outcome.
Key Takeaways
- Never share a WhatsApp registration code, PIN, or recovery detail with an unexpected caller or chat.
- Enable two-step verification and secure the email account used for recovery.
- Review linked devices and sign out sessions you do not recognize.
- Set profile and group privacy according to your comfort.
- Use the official app and help center for recovery; ignore links and phone numbers supplied by suspicious contacts.
Frequently asked questions
Can someone take over my WhatsApp using only my phone number?
A phone number alone should not be treated as proof of access, but it may be used to target you with verification-code or SIM-related scams. Protect codes and PINs, secure the phone and carrier account, and follow the official recovery steps if you see an account change you did not initiate.
Should I share an OTP with WhatsApp support?
Do not disclose an unexpected one-time code to a caller, chat contact, or person claiming to be support. Enter a code only in the official app during a process you started yourself. When in doubt, close the conversation and use the Help Center opened independently.
What should I do if a friend's account asks me for money?
Pause and contact your friend on another channel using details you already have. Do not send money or verification codes based only on the WhatsApp message, even if it refers to a personal detail.
Does hiding my profile photo stop scams?
No. Limiting profile information can reduce exposure, but it cannot establish who is messaging you or prevent all impersonation. Verify unusual requests independently.
Your next step
Open Linked devices now and remove any session you cannot identify. Then enable two-step verification if it is not already on.
Sources and further reading
- WhatsApp Help Center — Use current instructions for registration, two-step verification, privacy settings, and account recovery.
- Google Account Security Checkup — review devices and account security if Google backs up your chats.
- Apple Account security — review account security if iCloud is used.