Someone Hacked My WhatsApp – What to Do Next

Discovering that your WhatsApp account may have been compromised is unsettling, but understanding exactly what has happened is the first step toward fixing it. In most cases, what people describe as their WhatsApp being hacked actually falls into one of two distinct situations, and knowing which one applies to you determines what steps will actually help.

The first and more common situation is that someone has taken over your phone number’s WhatsApp registration, effectively locking you out of your own account and gaining the ability to send and receive messages as you. The second situation is that someone has gained access to view your existing conversations without necessarily locking you out, often through a linked device or a compromised backup, meaning your account still works normally for you but someone else may also be reading it. Recognizing which of these matches your situation shapes the correct response.

Common Signs Your Account Has Been Taken Over

A few clear signals usually indicate a full account takeover rather than something less serious. You may suddenly be logged out of WhatsApp entirely and unable to log back in, even though you are certain you entered the correct phone number. You might receive a verification code by text message that you did not request, followed shortly by being logged out unexpectedly. Contacts may tell you they have received strange messages from your account, often asking for money, containing suspicious links, or written in a tone that does not sound like you. You may also notice your profile photo, status, or display name has changed without your involvement.

Common Signs of Unauthorized Access Without a Full Takeover

A different, quieter set of signs can point toward someone viewing your messages without locking you out entirely. This can include seeing an unfamiliar device listed under your linked devices settings, noticing that messages appear to have been read or archived without your action, or generally sensing that someone else seems aware of conversations you have not shared with them. This scenario is often connected to WhatsApp Web or the linked devices feature being used on a device you do not recognize or no longer control.

Immediate Steps if You Have Been Locked Out

If you find yourself unable to access your own account, speed matters, since acting quickly limits how long someone else can use your identity to contact your friends, family, or business contacts.

Try Logging Back In First

Before assuming the worst, attempt to reinstall or reopen WhatsApp and log in using your normal phone number. If you receive a verification code by text message, enter it as you normally would. In many cases, this alone will restore your access, particularly if what happened was a single unauthorized login attempt rather than a deeper compromise.

Use WhatsApp’s Own Account Recovery Protection

WhatsApp includes a built in protection specifically designed for this situation. If someone else attempts to register your phone number on a new device, and you still have access to your original device, WhatsApp will typically prompt you with an option to reactivate your account and automatically log out the unauthorized device. Watching for this prompt and using it promptly is one of the most effective ways to reclaim a hijacked account.

Contact WhatsApp Support Directly

If you cannot log back in through the normal process, WhatsApp allows you to email their support team directly from within the app’s help section, or through their official support contact listed on their website, explaining that your account appears to have been compromised. Providing your phone number in international format and a clear description of what happened helps their team assist you more quickly. It is worth noting that WhatsApp support will never ask you to share a verification code with them, since this code exists specifically to prove account ownership to WhatsApp itself, not to a support representative.

Alert Your Contacts as Soon as Possible

While working to recover access, find another way to reach your close contacts, such as a phone call, a text message, or a different messaging platform, to warn them that your WhatsApp account has been compromised and that any messages sent from it, particularly requests for money or unusual links, should not be trusted until you confirm you have regained control.

Steps if You Still Have Access but Suspect Unauthorized Viewing

If your account still works normally for you but you suspect someone else has been viewing your conversations, the priority shifts toward removing their access rather than recovering your own.

Check and Remove Linked Devices

Within WhatsApp’s settings, there is a section listing every device currently linked to your account through WhatsApp Web or the desktop application. Reviewing this list carefully and logging out of any device you do not personally recognize or no longer use removes their ability to continue viewing your messages. If you are uncertain whether every listed device is legitimate, logging out of all linked devices at once and then re adding only the ones you actually use is the safer approach.

Change Your Two Step Verification PIN

WhatsApp offers an optional two step verification feature, which adds a personal PIN required in addition to a text message verification code whenever your number is registered on a new device. If this feature was not previously enabled, turning it on significantly strengthens your account against future takeover attempts. If it was already enabled, changing the PIN ensures that anyone who may have previously learned it can no longer use it.

Review Your Backup Settings

WhatsApp conversations are often backed up to cloud storage associated with your phone, such as a Google account on Android devices or an iCloud account on Apple devices. If someone has gained access to that associated cloud account, they may be able to access a backup of your conversations independently of your WhatsApp app itself. Reviewing the security of that underlying cloud account, including its password and any devices signed into it, is an important and sometimes overlooked part of fully securing your messages.

Strengthening Your Account Afterward

Once you have regained control or confirmed your account is secure, a few additional steps help ensure the same problem does not happen again.

Enable Two Step Verification if You Have Not Already

This feature remains one of the strongest defenses available, since it means that even if someone obtains a text message verification code, whether through a scam, a compromised phone number, or another method, they still cannot register your number on a new device without also knowing your separate PIN.

Be Cautious About Sharing Verification Codes

A very common way accounts are taken over in the first place involves a fraudster contacting a victim, often pretending to be a friend, a contest organizer, or even WhatsApp itself, and convincing them to share a verification code they just received by text message. This code should never be shared with anyone under any circumstances, since its entire purpose is to confirm that only you are authorizing your number to be registered on a device.

Secure the Phone Number and Accounts Connected to It

Since WhatsApp is tied directly to your phone number, ensuring that number itself is secure matters as well. This includes being cautious about SIM swap fraud, a technique where a fraudster convinces a mobile network provider to transfer your number onto a SIM card they control, and protecting the email address and cloud accounts linked to your phone, since these are often the starting point for a broader takeover attempt.

Keep the App Updated

Running the most current version of WhatsApp ensures you have the latest security improvements the company has released, since older versions of any app can sometimes carry vulnerabilities that have already been addressed in newer releases.

When to Involve Outside Help

If money was requested or sent to someone as a result of messages sent from your compromised account, or if you believe sensitive personal information was exposed, reporting the incident to your local police or relevant cybercrime authority is a reasonable next step, particularly if a financial loss occurred either to you or to someone who trusted a message believing it came from you. Keeping a record of what happened, including screenshots of suspicious messages or unfamiliar login notifications, can help support this kind of report if needed.

Bringing It All Together

Recovering a compromised WhatsApp account generally comes down to two connected goals, regaining or confirming your own access as quickly as possible, and cutting off whatever access an unauthorized person currently has, whether that means logging back in through WhatsApp’s own recovery process, removing an unfamiliar linked device, or securing the underlying phone number and cloud accounts tied to your messaging. Warning your contacts early prevents further harm while you work through these steps, and enabling two step verification afterward closes the door on many future attempts.

Most importantly, remembering that a verification code should never be shared with anyone, no matter how convincing the request sounds, remains the single most effective habit for preventing this situation from happening again in the first place.

More Information ℹ

• How to keep your personal WhatsApp account safe