How to Recover a Hacked WhatsApp Account

By

Last updated: October 13, 2026

Four steps to recover a hacked WhatsApp account using your phone number, a code and a two-step PIN

WhatsApp is tied to your phone number, so account takeovers work differently from a typical email or social media hack. There is no ordinary password to guess. Instead, attackers trick you into handing over the six-digit registration code WhatsApp sends to your phone, or they take control of your number itself. Once they register your number on their device, they can message your contacts and groups as you.

The good news is that WhatsApp recovery is usually quick if you still have your SIM. This guide follows WhatsApp's official recovery instructions step by step, explains exactly what happens if a two-step verification PIN blocks you (including the email reset many guides leave out), and shows how to lock the account down afterward.

How WhatsApp Accounts Get Taken Over

  • Registration code scams. Someone messages you, often from a friend's hijacked account, saying they sent you a code "by mistake" and asking you to forward it. Others pretend to be WhatsApp support, a delivery company or a prize draw. That code lets them register your number on their phone.
  • Voicemail code theft. If you do not answer, WhatsApp can deliver the code by voice call. Attackers have exploited voicemail boxes that still use a default or easy PIN to listen to the code.
  • Number takeover. A criminal moves your number to a SIM they control. See our guide to SIM swap attacks.
  • Linked devices. Someone with brief access to your unlocked phone links WhatsApp Web or another device to your account and reads your messages without logging you out.

WhatsApp's rule is simple: never share your registration code with anyone, not even friends or family.

Signs Your Account May Be Compromised

  • WhatsApp logs you out and asks you to verify your phone number again.
  • You receive a six-digit code you did not request, or a notification that your number was registered on a new device.
  • Contacts say you sent strange links or requests for money.
  • Messages appear as sent or read that you did not send or read.
  • An unfamiliar computer or phone appears under Linked devices.

Which Situation Are You In?

Your situationWhat to doHow long it takes
Logged out, you still have your SIM and no PIN is requestedRe-register with the six-digit code (Step 1)Minutes
A PIN is requested and you added a recovery emailTap Forgot PIN? and reset by email (Step 2)Minutes
A PIN is requested and you have no email accessWait 7 days, then Forgot PIN? > Reset Account7 days from the account's last successful connection
Your phone has no signal at allContact your carrier first; your number may have been movedDepends on carrier
You are still logged in, but see an unknown linked deviceLog out that device (Step 4)Seconds
Phone lost or stolenAsk your carrier to lock the SIM, then register WhatsApp on a new phone with a replacement SIMHours to a day

Step 1: Register Your Number Again on Your Own Phone

According to WhatsApp, this is the only way to remove someone else from your account. Changing a password or turning on features from another device does not do it.

  1. Open WhatsApp on your phone (reinstall it from the official app store if needed) and tap Log back in or Continue.
  2. Enter your full phone number in international format. US numbers start with +1.
  3. Enter the six-digit code that arrives by SMS or phone call.

WhatsApp says that when you re-register with the code, all devices logged in to your account are automatically logged out, and that this happens whether or not you know a two-step verification PIN. You must be able to receive texts or calls on your number, and WhatsApp states that it is not possible to recover an account without a SIM card with the same number. If your phone has lost service entirely, call your carrier right away.

Step 2: If You Are Asked for a Two-Step Verification PIN

You may be asked for a PIN you never created. WhatsApp says that in rare cases someone using your account may have turned on two-step verification to lock you out. You have two routes, according to WhatsApp's page on resetting a two-step verification PIN:

  • Reset by email. If you added an email address to two-step verification or to your WhatsApp settings, tap Forgot PIN? > Send Email, open the link in the email, tap Confirm, then return to WhatsApp and tap Forgot PIN? > Reset. This can work immediately.
  • Wait seven days. If you cannot use the email or an SMS one-time password, you must wait seven days. WhatsApp says the wait starts from the last time your account successfully connected to WhatsApp, and that no one can access the account during that time. Afterward, tap Forgot PIN? > Reset Account.

WhatsApp also says it cannot speed up the seven-day period. Anyone who offers to "bypass the PIN" for a fee is a scammer.

Step 3: Do Not Report the Account Before You Recover It

This is a gap in most guides. WhatsApp warns that if you report the compromised account you are trying to recover, it may be banned for violating the Terms of Service, and you could lose access to the account or its data. WhatsApp recommends trying to recover first and reporting afterward. If you still need help, use the official route inside the app (Settings > Help > Contact us) or the WhatsApp Help Center, never a "recovery service" advertised on social media.

WhatsApp also notes some limits: it cannot tell you who accessed your account or when and where, and it cannot deactivate accounts on someone else's behalf.

Step 4: Check Linked Devices

Once you are back in, go to Settings (or the menu on Android) > Linked devices. Review every computer, browser or tablet listed. Tap any you do not recognize and choose Log out. If you are unsure, log out of all of them and link your own devices again. This matters because a linked device can read your messages without logging you out of your phone.

Step 5: Turn On Two-Step Verification and Add an Email

  1. Go to Settings > Account > Two-step verification > Turn on.
  2. Create a six-digit PIN that is not your birthday, phone number or a simple pattern.
  3. Add an email address you control and verify it. This is what lets you reset the PIN quickly later.

WhatsApp notes that after you re-register an account, there may be a delay before you can turn on two-step verification, for security reasons. If the option is unavailable, try again later. The PIN is different from the six-digit SMS code; never share either.

Other security settings worth turning on

  • Passkey: WhatsApp supports passkeys on many phones, letting you verify with your face, fingerprint or screen lock. Look under Settings > Account > Passkeys. Our guide to passkeys explains why they resist phishing.
  • Security notifications: show alerts when a contact's security code changes.
  • Privacy checkup: limit who can see your profile photo, last seen and who can add you to groups.
  • Chat lock and app lock: add your fingerprint or face to sensitive chats or the whole app.

Menu names change between versions, so if you cannot find an option, search WhatsApp's Help Center for the feature name.

Step 6: Warn Your Contacts

WhatsApp advises telling family and friends if your account was compromised, because the intruder may have impersonated you in chats and groups. Use another channel, such as a phone call, text or another app, and ask them to ignore any request for money or codes sent while you were locked out. If anyone sent money, they should contact their bank or payment app right away and report it at ReportFraud.ftc.gov.

Step 7: Secure Your Number and Other Accounts

  • Add a PIN to your mobile carrier account and turn on any SIM lock or port-out protection.
  • Change your voicemail PIN from any default, since codes can be delivered by voice call.
  • Change the password on your main email account and turn on two-factor authentication. An authenticator app is better than SMS; see how to set up Google Authenticator.
  • Secure the Google or iCloud account that holds your WhatsApp backup, because it contains your chat history.
  • Lock your phone with a strong passcode and keep WhatsApp and the operating system updated.

A VPN does not prevent these attacks. They work by tricking you or your carrier, not by intercepting your connection.

What Happens to Your Messages?

WhatsApp says messages are end-to-end encrypted and stored on your device, so someone who re-registers your account on a new device cannot read your past conversations. They can, however, send and receive new messages while they control the account, and they may see group messages sent during that time. If you need to restore chats after recovery, WhatsApp says a Google account or iCloud backup may let you do so.

Frequently Asked Questions

Can WhatsApp support restore my account for me?

Recovery depends on you verifying your number with the six-digit code. Support can answer questions, but it cannot bypass the code or the seven-day PIN wait.

Will the hacker see my old chats?

According to WhatsApp, no. Past messages stay on your device. The intruder can see new messages while they have control.

Why do I keep getting WhatsApp codes I did not request?

Someone is probably trying to register your number. Do not share the codes. Turn on two-step verification with an email so the attempt fails even if a code leaks.

Does changing my password remove the hacker?

No. WhatsApp says the only way to remove someone is to re-register with the code sent to your number.

Can I recover WhatsApp without my old SIM?

Not according to WhatsApp. Ask your carrier for a replacement SIM or eSIM with the same number first.

How do I recover other hacked accounts?

See our guides to recovering a hacked Instagram account and Facebook account.

Conclusion

Recovering WhatsApp usually comes down to one action: re-register your number on your own phone with the six-digit code, which logs the intruder out. If a PIN blocks you, reset it by email or wait the seven days, and do not report the account until you have it back. Then turn on two-step verification with an email, consider a passkey, check linked devices and warn your contacts. Above all, remember that no genuine friend or WhatsApp employee will ever ask you for your code.

By Safe Sign In Editorial Team

Comments

Post a Comment

Popular posts from this blog

How to Tell If Your Email Has Been Hacked and What to Do

By
Image
Last updated: October 8, 2026 Your email account is the master key to almost everything else you own online. Bank alerts, shopping receipts, social media logins and "forgot password" links all land in your inbox. If someone else gets into it, they can often reset the passwords of your other accounts too. That is why spotting a hacked email account quickly matters so much. This guide shows the common warning signs, how to check whether someone has really been in your account, and what to do, in order, if they have. It covers Gmail, Outlook, Yahoo and iCloud Mail, with links to each provider's official help page. Common Signs Your Email May Have Been Hacked No single sign proves a break-in, but several together are a strong hint. Watch for these: Friends say they received strange messages from you. Links, "urgent" requests for money or odd attachments sent to your contacts are a classic pattern. Sent folder items you did not write. Sometimes attackers d...
Read more

How to Create a Strong Password You Can Actually Remember

By
Image
Last updated: October 8, 2026 Most of us know we should use strong passwords, yet we still end up with "Summer2024!" or the same password on ten websites. The reason is simple: strong passwords seem impossible to remember. The good news is that a strong password does not need to look like random noise. Length matters more than complexity, and there are easy ways to make long passwords memorable. This guide explains what actually makes a password strong, what the current US government guidance says, how to build a password you can recall, how to check whether your existing passwords are weak or leaked, and when to hand the job over to a password manager. What Makes a Password Strong? Attackers rarely sit and guess by hand. They use software that tries huge numbers of guesses, starting with the most common passwords, known leaked passwords and predictable patterns. The Cybersecurity and Infrastructure Security Agency (CISA) sums up a strong password with three tips, and ...
Read more

How to Recover a Hacked Instagram Account

By
Image
Last updated: October 8, 2026 Finding that your Instagram password no longer works, that the email address on the account has changed, or that strange posts and messages are going out under your name is stressful. The important thing is to act in a sensible order, because the path you can use depends on whether you can still sign in. This guide walks through both situations: you can still get in, and you are locked out. It also covers how to secure the account afterward and how to avoid the "recovery services" that make things worse. Menu names in the Instagram app change from time to time, so where wording may differ, this guide describes the option generically and points you to Instagram's own Help Center . Instagram also has a dedicated page for hacked accounts at instagram.com/hacked , which you can open in a desktop or mobile browser. One more naming note: Instagram's Help Center says Meta is gradually moving people to Meta Accounts , so you may see either ...
Read more