By The KTech team · Published 29 October 2026
WhatsApp is how many of us keep in touch with family, the village hall committee, the football club, the school parents and half the neighbourhood. That is exactly why criminals want to take over accounts. A hijacked account lets them message everyone you know, in your name.
One of the most common ways it happens is by tricking you into sharing a six-digit code. Here is how the trick works, how to protect yourself, and what to do if it happens to you.
How the scam works
When you set up WhatsApp on a new phone, or log in again, WhatsApp sends a six-digit code by text message. Entering that code proves the number is yours. Anyone who has your code, and your phone number, can set up your account on their own device.
The scam goes like this. A message arrives from someone you know, perhaps a member of a community or neighbourhood group, saying something like 'I sent you a code by mistake, can you send it back?' Around the same moment, a real code from WhatsApp lands on your phone. The two seem to fit together, so it feels natural to pass it on.
In fact the message came from a criminal who has taken over your friend's account, and the code is your own, triggered when they tried to register your number. Once you share it, they are in, and you are logged out. They then use your account to contact your friends and groups, repeating the trick or asking for money.
Variations include a request to 'vote' for someone, a message pretending to be from support, or an urgent plea from a relative. The pattern is always the same: a trusted name, a plausible reason, and a code.
The golden rule
Never share a WhatsApp verification code with anyone, for any reason, however friendly or urgent the request. Neither friends, nor family, nor WhatsApp itself will ever need you to pass it on. It is for you to enter on your own phone, and nobody else.
If you get a code you did not ask for, ignore it. It may mean someone is trying to get into your account, and it is worth turning on extra protection straight away.
Turn on two-step verification
WhatsApp offers an extra layer called two-step verification. Once it is on, anyone registering your number must also enter a PIN that you choose. Even if you were tricked into sharing a code, the criminal would still be stopped at the PIN.
You can switch it on in WhatsApp under Settings, then Account, then Two-step verification. Pick a PIN you will remember but that is not obvious, such as a birth year, and add an email address so you can reset it. WhatsApp explains the steps in its help centre, on the page About two-step verification.
While you are there, check Linked Devices to make sure only your own devices are listed, and keep the app updated.
How to spot a hijacked friend
- An unexpected message asking for a code, a favour or money, especially one that feels urgent.
- Odd phrasing, or a message that does not sound like the person.
- A request that you keep the conversation private.
- Links to voting pages, competitions or 'verify your account' sites.
- A friend whose number suddenly changes or who tells you their account has been taken over.
If it happens to you
Do not panic, and do not be embarrassed. These scams are designed to work on sensible people. You may be able to get back in by registering your number again on your own phone, which sends a new code to you.
Warn your contacts by another route, such as a phone call, text or email, so they know not to respond to anything from your account. Tell group administrators too. If money has been requested or lost, contact your bank at once and report it to Report Fraud.
If you are stuck, locked out or worried that your phone has been affected, we can help. Our hacked help page explains how we approach this, and what we may need from you. For wider background, see cyber threats in the South Hams.
Close to home
Scams like this travel through groups, and the South Hams has plenty of busy ones: village noticeboards, harbour and sailing groups, parent circles and sports clubs. A warning in the group chat does no harm. If you would like to talk it through with someone local, our team looks after IT help in Kingsbridge and the surrounding villages.
Protecting the groups you run
If you look after a WhatsApp group, you have a particular role. Remind members now and then that nobody will ever ask for a code, and pin a short message to that effect. If a member's account is taken over, remove the account from the group quickly, and let the others know.
Think, too, about who has admin rights. Fewer admins means fewer accounts that, if hijacked, can do real damage. Where a group is used for a business, such as a team or a customer list, make sure the people who hold those admin rights use two-step verification as a matter of course.
A quick, friendly note is usually enough. Scams like this rely on people being too polite to question a message from someone they know, so make it normal to say, 'That does not sound like you. Can I ring you?'