Account takeover

WhatsApp account hacked: what to do in the first hour

An urgent request for money from someone you know no longer has to be faked: it can come straight out of that account. Whoever takes over your account does not need to clone a voice or steal a profile photo — they send messages to your contacts in your name. The Dutch Fraud Helpdesk describes exactly this takeover: the criminal obtains the verification code through a chat conversation, a text message or even your voicemail, takes over the account and then asks your contacts for money (Fraudehelpdesk, WhatsApp account hacked).

That makes this harder to spot than a cloned voice: the number, the profile photo and the chat history all match. The check that always used to work — call or message the number the request came from — puts you in touch with the intruder instead.

Direct answer: five steps when your account has been taken over

1. Log back in with the 6-digit SMS code. Request the code in WhatsApp and enter it. The Fraud Helpdesk describes that the person using your account is automatically logged out at that moment (Fraudehelpdesk); WhatsApp says the same: when you re-register, all devices logged into your account are automatically logged out (WhatsApp Help Center, how to recover a compromised account). Never share that code with anyone, not even friends or family: WhatsApp states you should never share your registration code, and WhatsApp itself never asks for it (WhatsApp Help Center).
2. Asked for a two-step verification code you never set up? Wait 7 days. That usually means the intruder enabled two-step verification. Whatsapp and the Fraud Helpdesk both advise waiting seven days and trying again (Fraudehelpdesk; WhatsApp Help Center). The intruder has already been logged out at that point, even if you cannot get back in yet.
3. Warn your contacts immediately, in one concrete message. WhatsApp explicitly advises this, because the intruder can impersonate you in chats and groups (WhatsApp Help Center). One message in the same channels where the requests arrive is the fastest way to stop someone from paying. Say that money requests in your name are not from you, and that nobody should pass on a code.
4. Log out of all linked devices, then turn on two-step verification. The Fraud Helpdesk advises: Settings → Linked devices → Log out of all devices, because criminals can keep reading through a linked device. Then enable two-step verification (Settings → Account → Two-step verification) (Fraudehelpdesk).
5. Has money already been sent? Call your bank the same day. Speed determines whether a transfer can still be blocked or recalled. Report it to the national fraud desk, file a police report if there is loss, and keep everything: the number, the chat, the account number and the payment proof (Fraudehelpdesk, reporting fraud).

Received such a request? Five checks

1. Verify through a channel you already had, not through the number in the chat. Call or message the person on the number in your own contacts, or check through someone else. With a hijacked account, the number from the conversation reaches the intruder.
2. Read the payment route. An account number that does not match the person, a payment link, a gift card, mobile credit or crypto: that remains the classic stop sign, even when the account is genuine (FTC, family emergency scams).
3. Treat urgency and secrecy as the mechanism. Why could it not wait until you have spoken to the person? That pressure exists to stop you verifying.
4. Warn the person behind the account. Often they do not yet know their account was taken over. One call through another channel stops a whole wave of money requests — and it is exactly what WhatsApp advises the account owner to do (WhatsApp Help Center).
5. Use a detector for the attachments, never as proof of the sender. A message from a genuine account cannot be "AI-generated": no model was involved, only a stolen code. A score on the text or on a screenshot therefore says nothing about who is behind it. To assess a forwarded payment proof or document, use the text detector, the image detector or the document detector as triage: the signal tells you which file to check first, not whether the payment is real.

Why this exists next to a cloned voice

With voice cloning the sender is fake and the number is new; with account takeover the sender is real and the number is correct. In both cases the same check disappears: the channel the request arrives on no longer proves anything. What keeps working in both is making contact through a route you already had — a saved number, a second app, a family member — and treating a payment request as something you only act on after that check.

What a message cannot tell you

• whether the sender is the person whose account it is — the account is taken over, and a prepaid number or a new account looks the same;
• whether the story is true: only the person themselves, or someone who can reach them, can confirm that;
• whether an account number belongs to that person;
• whether fraud is involved — only a bank or an investigating authority can establish that.

If you have already paid

• Contact your bank the same day and ask about a block or recall while that is still possible.
• Keep the chat, the phone number, the account number, the payment proof and the timestamp.
• Report it to the national fraud desk and file a police report where there is loss.
• Tell the people around you: the same number or account is often reused, and speaking up removes the shame that keeps cases unreported.

More checks are in how to spot an AI voice clone scam, how to spot a fake payment proof and how to spot deepfake ads with a celebrity. If the takeover is followed by a threat to share intimate images — real or generated — follow the five steps for intimate-image blackmail. If the problem is your phone number itself rather than your WhatsApp (no signal, a text about your SIM), follow the steps for a taken-over SIM (SIM swap). To check a file on its own, use the free checker.

Frequently asked questions

Can I recover my account without the SMS code?

No. WhatsApp cannot recover an account without a SIM card with the same phone number, and the registration code arrives by SMS or phone call (WhatsApp Help Center). Contact your carrier if you have no signal or no SIM, and warn your contacts in the meantime.

My contacts receive messages, but I can still log in. Is something wrong?

Yes. Anyone who still has access can still push the intruder out with the SMS code, after which all other devices are logged out (WhatsApp Help Center). Then log out of all linked devices and enable two-step verification, because someone can keep reading through a linked device (Fraudehelpdesk).

Does a detector score prove the money request is fake?

No. With a hijacked account there is no generated text or image involved, so a score says nothing about the sender. It only describes patterns in the file you upload. A low score does not prove the request is genuine either.