Yes, WhatsApp accounts get hacked every day, but almost never by someone breaking the encryption. They get hacked because a person was talked into reading out a six-digit code, approving a pairing request or scanning a QR code. The attacker doesn't defeat WhatsApp. They borrow your permission.
That changes what protects you. This guide explains the four ways accounts really get taken over, how to tell if yours has been, what to do in the first hour, and the settings that make a takeover very hard.
TL;DR
- WhatsApp's end-to-end encryption hasn't been broken. Account takeovers happen through verification codes, linked devices, access to your phone or number, and, rarely, spyware.
- Never share the six-digit code WhatsApp sends you, even with a friend. Singapore police say this is how scammers log into accounts.
- Open Settings > Linked Devices and remove anything you don't recognise. A hijacked account can look normal on your phone.
- To recover, log back in by re-registering your number, then remove linked devices, turn on two-step verification and warn your contacts.
- A VPN does not prevent any of these attacks.
How WhatsApp accounts really get hacked
1. The verification code trick
This is the most common route. The attacker enters your phone number into WhatsApp on their device, which triggers an SMS or WhatsApp message with a six-digit code sent to you. Then they contact you, often pretending to be a friend whose account they already control, and say the code was sent to you by mistake.
Singapore police described exactly this in a May 2026 advisory: since April 1, 2026 there had been at least 52 reported cases with losses of at least S$46,000. Scammers log in with the code you hand over, take over your account and message your contacts asking for emergency loans. Police told people never to give a WhatsApp OTP to anyone, because doing so loses access to the account. Read the full police advisory.
2. Linked-device hijacking, including GhostPairing
WhatsApp lets you link extra devices, such as WhatsApp Web or the desktop app. The attacker's goal is to get their browser added as one of yours.
In December 2025, security firm Gen Digital described a campaign it named GhostPairing. Victims got a message from a hacked contact saying something like "I just found your photo!", with a link to a fake Facebook-style viewer. The page asked them to "verify" by scanning a QR code or entering a numeric code. That code was WhatsApp's own pairing code, and entering it linked the attacker's browser to the account. Gen's analysis notes there was no password theft and no SIM swap, and the phone kept working normally, so many victims didn't know a second device had been added. BleepingComputer's report adds that the attacker gets access to synced conversation history and media.
Fake "WhatsApp Web" sites work the same way. Singapore police have warned about phishing pages that show a real QR code, copied from the official site.
3. Access to your phone or your number
Someone who has your unlocked phone can open WhatsApp, or link a device in seconds. Someone who controls your phone number, through a SIM swap or by getting at your voicemail, can request a login code. Singapore police advise setting a device code and being aware of who has physical access to your phone. Two-step verification adds a PIN that this kind of attacker doesn't have.
4. Spyware, which is rare and targeted
In January 2025, WhatsApp notified about 90 Android users in more than two dozen countries that they had been targeted with Paragon's Graphite spyware, through a zero-click flaw: attackers added them to a group and sent a PDF that the app processed on its own. WhatsApp fixed it without needing a client update, BleepingComputer reported. In June 2026 WhatsApp said it had disrupted new phishing linked to spyware maker NSO.
These attacks are aimed at journalists, activists and officials. If that's you, WhatsApp's Strict Account Settings, introduced in January 2026, lock the account down further. For almost everyone else, the first three routes are the ones to worry about.
Signs your WhatsApp has been hacked
Look for any of these:
- You're suddenly logged out and asked to verify your number.
- You get a verification code by SMS or message that you didn't request.
- Contacts say they received strange messages or money requests from you.
- You see sent messages you didn't write.
- Settings > Linked Devices shows a device you don't recognise.
- Your profile photo, name or status changed without you doing it.
Treat the absence of signs with care. With linked-device attacks, the phone works normally. The only reliable check is the Linked Devices list.
What to do if your WhatsApp is hacked
Do these in order. Speed matters because the attacker uses your account to reach your contacts.
- Log back in. Open WhatsApp, tap Log back in and continue, enter your full phone number and the six-digit code you receive by SMS or call. WhatsApp says re-registering your number is how you recover, and that past conversations stay on your phone and can't be read by someone trying to access your account. If the attacker set their own two-step PIN, follow WhatsApp's recovery guide.
- Remove linked devices. Settings > Linked Devices, then log out every device you don't recognise. Gen Digital noted that re-registering doesn't always clear a linked session, so check this even after you've regained access.
- Turn on two-step verification. Settings > Account > Two-step verification > Enable. Choose a PIN you will not share.
- Warn your contacts. Post in your main groups or message your family, so nobody sends money to "you". Tell them to confirm any money request by calling you.
- Contact your bank if you shared card details or anyone transferred money. Report the scam to your local police or fraud agency.
- Report the attacker's messages in WhatsApp with Block and Report.
- Change passwords on anything linked to the same phone number or email, and review your cloud backup account.
How to make a takeover very hard
| Setting | Where | What it stops |
|---|---|---|
| Two-step verification | Settings > Account > Two-step verification | Takeover with a stolen SMS code |
| Check linked devices | Settings > Linked Devices | Ghost devices and fake WhatsApp Web |
| Silence unknown callers | Settings > Privacy > Calls | Spam calls and some call-based attacks |
| Groups: My contacts | Settings > Privacy > Groups | Strangers adding you to scam groups |
| Phone lock and app lock | Phone settings and WhatsApp privacy | Someone borrowing your phone |
| Strict Account Settings | Settings > Privacy > Advanced | Media from unknown senders, for high-risk users |
Three habits beat any setting:
- Never share a six-digit code, a pairing code or a QR code, whoever asks. WhatsApp's security page says to set a secret PIN and never share it with anyone.
- Use only the official app, from your app store. WhatsApp warns that fake versions put your data at risk.
- Check unusual requests another way. If a friend asks for a code or money, call them.
Myths about hacking WhatsApp
"Anyone can hack my WhatsApp with just my number." A number lets an attacker start a login, but they need the code sent to you. Don't share it and turn on two-step verification, and the number alone isn't enough.
"Hackers read my chats through the network." Messages are end-to-end encrypted. Someone on your Wi-Fi can't read them. We explain why in is WhatsApp encrypted.
"Tools can hack any WhatsApp account." Services that promise to hack an account from a number are generally scams aimed at the person paying. Real takeovers rely on tricking the account owner.
Where a VPN fits
A VPN doesn't stop any of the four attacks above. None of them depends on your network connection. They depend on a code, a pairing request, a phone or a flaw in the app.
What a VPN does help with is the connection around WhatsApp: hiding your traffic details from a shared Wi-Fi network and hiding your IP address. If you travel and work from cafés, Atomic VPN is a reasonable layer next to the settings above, and our guide on how to tell if your phone is hacked goes through device-level checks. For the account itself, two-step verification and a clean linked-devices list matter far more.
What to do today
Open WhatsApp, check Linked Devices, enable two-step verification and agree with your family that nobody ever shares a code, even with each other. It takes five minutes and closes the doors that attackers actually use.
Two-step verification protects the account. A VPN covers the network side on hotel, airport and café Wi-Fi.
