Losing access may be just the beginning of the problem. If a cybercriminal takes over an account, they can impersonate the victim and write to family members, friends or colleagues to ask for money, request security codes or send fraudulent links. That is why quickly identifying what has happened and acting within the first few minutes can be crucial to limiting the consequences.
Although people commonly say that their "WhatsApp has been hacked," there is not always a sophisticated cyberattack behind it. One technique used by criminals involves tricking the victim into revealing the six-digit code WhatsApp sends to register a phone number. It may also happen that someone has linked a device to the account without permission, that there is some type of malware on the phone or that SIM swapping has taken place, a form of fraud involving the acquisition of a duplicate SIM card.
Several signs can raise the alarm: WhatsApp unexpectedly logging us out, receiving a registration code we did not request, discovering linked devices we do not recognize or having our contacts alert us to strange messages sent from our number. We may also see a notice saying that the number has been registered on another phone.
WHAT TO DO IF YOUR WHATSAPP HAS BEEN HACKED
The first step is to try to regain control of the account as soon as possible. To do this, open WhatsApp on the phone, enter the number and request a new six-digit registration code, which will normally arrive by text message or phone call. Once this code is entered correctly, the account is registered on our phone again and the session of anyone using our number on another phone is closed.
There is one fundamental rule throughout this process: never share that six-digit code with anyone. Not even if the person contacting us claims to be a friend, a company or WhatsApp technical support. Obtaining this code through deception is precisely one of the ways cybercriminals take over accounts.
Another situation may arise. When opening WhatsApp, users may see a message saying that "This account cannot use WhatsApp" because some activity may have violated the terms of service. In these cases, the app itself allows users to request a review in an attempt to regain access and states that most reviews are completed within the following 24 hours.
After recovering the account, it is advisable to go to Settings > Linked devices and check each listed device. If we find a computer, phone or device we do not recognize, we should immediately log out of that session.
WHAT HAPPENS IF WHATSAPP ASKS FOR A PIN YOU DO NOT KNOW
The process can become more complicated if, after entering the code received by text message, WhatsApp asks for a two-step verification PIN that we never set up. This can happen if the person who took over the account activated this security measure.
If an email address is associated with the account, it may be possible to reset the PIN using that method. Otherwise, it may be necessary to wait seven days to access the account again without knowing the PIN. For this reason, it is not advisable to try to guess it or turn to third parties who promise to restore access.
Once the account has been recovered, it is recommended that we activate our own two-step verification. This feature adds an extra security PIN and makes it more difficult for someone to take over the account again, even if they obtain the registration code.
ALERT YOUR CONTACTS AS SOON AS POSSIBLE
Recovering WhatsApp is a priority, but there is another step that should be taken almost at the same time: alerting our contacts. If someone has gained access to the account, they could use those first few minutes to write to family and friends while pretending to be us.
The deception can take different forms: from claiming that we have changed our number to urgently asking for money, requesting a bank transfer or sending a link for the next victim to click. Until we regain access, we can issue a warning by phone call, text message, email or another social network and ask our contacts to ignore any suspicious request coming from our WhatsApp.
Once back in the account, it is also advisable to review the latest messages sent, statuses, profile photo and name, as well as any other changes we do not recognize. This may help determine what the attacker did while they had access to the account and whom we need to warn.
WHAT TO DO IF THE SIM CARD IS NOT WORKING EITHER
If, in addition to losing WhatsApp access, we discover that our phone has suddenly lost service, the situation requires special attention. This may indicate SIM swapping, a technique in which criminals arrange for a duplicate of the victim's SIM card to be issued.
In this case, we must immediately contact the phone operator to find out what happened, block any fraudulent duplicate and regain control of the number. Until we have access to the line again, we will also normally be unable to receive the text message needed to register WhatsApp.
The situation is different if we have lost the phone or it has been stolen. In addition to alerting our contacts, it is advisable to block the SIM, request a replacement, remotely lock or erase the device and change the passwords for the most important accounts that were open on the phone.
HOW TO PREVENT YOUR WHATSAPP FROM BEING HACKED AGAIN
Once the problem has been resolved, it is advisable to strengthen security. The first step is to activate WhatsApp's two-step verification and always keep both that PIN and any registration codes received by text message secret.
It is also recommended to check linked devices regularly, keep WhatsApp and the phone's operating system up to date and be wary of unexpected messages that try to create a sense of urgency. Claims about a problem with a package, bank alerts, prizes, job offers or messages from an acquaintance asking for a code may conceal fraud attempts.
And there is one simple rule that can prevent many problems: if you receive a WhatsApp code that you did not request, do not give it to anyone. Receiving the message does not necessarily mean that someone has gained access to your account, but it may indicate that someone is trying to register your number.
