WhatsApp Account Theft Through the Verification Code

How it starts

It starts with a WhatsApp message from a number you recognize, usually a friend or a family member. In reality their account was already stolen, and the person on the other side is the attacker. The message sounds completely innocent: Hi, I sent you a code by mistake, can you send it back to me?

How it works

The attacker is trying to install your WhatsApp on a different device. To approve that, WhatsApp sends a six digit code by SMS to your phone. The attacker cannot see that code, so they need you to hand it over. That is why they pretend to be someone you trust and invent a story about a code sent by mistake. If you forward the code, the setup finishes on their device, and your account is logged out of your own phone in that instant.

What the scammer wants

The first prize is the account itself. Once it is theirs, the attackers message everyone in your contact list while pretending to be you. They ask your contacts for money, ask them for codes, or push the same trick further. For the attacker, one stolen account is a door into dozens of other people who trust you.

Common phrases

• I sent you a code by mistake, send it back
• I am locked out of WhatsApp
• Forward me the code you just received
• It is urgent, I need it fast

Red flags

• You received a WhatsApp verification code you did not ask for
• Someone asks you to forward a code that arrived on your number
• An urgent, pressured request, even from a number you know
• The message asks for a code, a password, or personal details

What to do now

• Never forward a verification code to anyone, not even a friend
• If a friend asks for a code or money, call them with a normal phone call to confirm
• If your account is already stolen, reinstall WhatsApp with your number and enter the code you receive
• Tell your contacts the account was hijacked so they do not answer requests sent in your name

Example scenario

Dana gets a message from an old friend: Sorry, I sent you a code by mistake, can you forward it to me? I am locked out. A few seconds later an SMS from WhatsApp arrives with a six digit code. Dana wants to help, so she forwards the code. Within a moment she is logged out of her own account. Her real friend never sent that message. Now the exact same request is going out to everyone Dana knows.

Prevention tips

• Turn on two-step verification in WhatsApp: Settings, Account, Two-step verification. It adds a personal PIN that only you know
• Treat a six digit code as completely private, exactly like a password
• Be suspicious of any urgent request for money or codes, even from someone you know
• Do not click links that promise to restore a WhatsApp account

Full description

WhatsApp account theft is one of the most common phone scams in Israel. It does not take any advanced technical skill from the attacker. All they need is for you to willingly hand over a six digit code. The scam is dangerous because it comes from the number of a person you know and trust, so it is easy to fall for. The best defense is to understand in advance how this code works.