Deepak Gupta

A friend asked for your WhatsApp code: the code scam

WhatsApp's "Received verification code without requesting it" page is clear: never share your verification code. A friend asking for a code "sent by mistake" is almost always a hijacked account. If you already sent it, re-register your number now with a fresh 6-digit code to log them out.

Do these 3 things now

1Do not send the code. Read WhatsApp's code warning if you are unsure.Read to them:“Do not send the code. Read WhatsApp's code warning if you are unsure.”
2Do not reply to anyone offering to help, and call your friend on a different app or by phone to check.Read to them:“Do not reply to anyone offering to help, and call your friend on a different app or by phone to check.”
3If you already sent the code, open WhatsApp and re-register your number with a new code right away.Read to them:“If you already sent the code, open WhatsApp and re-register your number with a new code right away.”

Read WhatsApp's code warning

Official link: faq.whatsapp.com

I am helping someone else

Helper mode: each step is written for you to read aloud. Let them tap and type on their own device; never ask them to send you a code. Send them this first.

01Is this you?

A contact says they sent you a 6-digit code by mistake and asks you to forward it.
You got an SMS or notification with a WhatsApp code you did not ask for.
The message feels rushed or the friend will not take a call.

Not quite? You already lost access to your WhatsApp · Friends are getting odd messages from you · Other recovery scams

02Official recovery path

Do not share the code. WhatsApp says anyone trying to take your account needs the SMS code sent to your number. Without it, they cannot use your number on WhatsApp.Read to them:“Do not share the code. WhatsApp says anyone trying to take your account needs the SMS code sent to your number. Without it, they cannot use your number on WhatsApp.”source
If you already shared it, open WhatsApp on your phone and re-register: tap Log back in > Continue if prompted.Read to them:“If you already shared it, open WhatsApp on your phone and re-register: tap Log back in > Continue if prompted.”source
Enter your full international phone number, tap Next > Ok, then enter the new 6-digit code. That logs out every other device.Read to them:“Enter your full international phone number, tap Next > Ok, then enter the new 6-digit code. That logs out every other device.”source
Report and block the account that asked. Reporting sends WhatsApp up to five of its last messages to you.Read to them:“Report and block the account that asked. Reporting sends WhatsApp up to five of its last messages to you.”source
Turn on two-step verification: tap You > Account > Two-step verification, then toggle on Turn on two-step verification. Create a password and add an email you can access.Read to them:“Turn on two-step verification: tap You > Account > Two-step verification, then toggle on Turn on two-step verification. Create a password and add an email you can access.”iPhonesource
Turn on two-step verification: open Settings > Account > Two-step verification, then toggle on Turn on two-step verification. Create a password and add an email you can access.Read to them:“Turn on two-step verification: open Settings > Account > Two-step verification, then toggle on Turn on two-step verification. Create a password and add an email you can access.”Androidsource
Check Linked Devices. Tap any device you do not recognize, then tap Log Out.Read to them:“Check Linked Devices. Tap any device you do not recognize, then tap Log Out.”source

Did that get you back in?

Yes

Lock it down now. Change the password, turn on two-step, sign out other devices. It takes about 15 minutes.

No

A.If you shared the code and are now asked for a PIN you never set, the attacker set it. Follow the PIN page.Read to them:“If you shared the code and are now asked for a PIN you never set, the attacker set it. Follow the PIN page.”source
B.Tell your friend by another channel. Their account is likely hijacked, and they need the someone-else-logged-in steps.Read to them:“Tell your friend by another channel. Their account is likely hijacked, and they need the someone-else-logged-in steps.”

Then: how long it takes

03How long it takes

No published timeline

WhatsApp does not publish a timeline for this. If you did not share the code, your account is safe. If you did, re-registering logs them out as soon as you enter a new code.

04Warn your contacts

Send this from another account or by text, so nobody falls for messages sent in your name.

Heads up: someone using a friend's WhatsApp asked me for a code. If anyone, even me, asks you for a WhatsApp code, do not send it. It is how accounts get stolen.

More templates: email, followers, customers

05Watch out for recovery scams

People who just lost an account are the main target of fake helpers. Only WhatsApp's own app or website can restore your account.

A friend's account asking for a code "sent to you by mistake". That code is your WhatsApp registration code. How it works
Calls or texts that say they are from WhatsApp, your bank, or a delivery firm and ask you to read out a code. How it works
Vote, prize, or job messages that ask you to "confirm" with a code. How it works

All recovery scams and how to spot them

06Once you're back in: lock it down

0 of 9 doneAbout 19 minutes total

Turn on two-step verification with a password and email3 minOn Android, open Settings > Account > Two-step verification. On iPhone, tap You > Account > Two-step verification. Toggle on Turn on two-step verification, create a strong password, then add an email address you can access and tap Next. WhatsApp is replacing the old 6-digit PIN with a password, so set a password if you still have a PIN.source
Add and verify a recovery email2 minOpen Settings > Account > Email address > Add email (on iPhone, start from You). Enter the code WhatsApp sends to your inbox and tap Verify. A verified email lets you get a registration code without SMS. Use an email account that has its own strong protection.source
Create a passkey2 minOpen Settings > Account > Passkeys, then follow the prompts (on Android, tap Create passkey > Continue). A passkey uses your phone's fingerprint, face, or screen lock, so you can verify yourself without an SMS code. You need Android 9 or later with a password manager, or an iPhone 8 or later on iOS 16 or later.source
Log out devices you do not recognize2 minOpen Linked Devices (on iPhone, from Settings or your profile picture; on Android, from the menu). Tap any device you do not recognize, then tap Log Out. Repeat for each one. WhatsApp Web sessions show up here.source
Limit who can add you to groups1 minOpen Settings > Privacy > Groups and choose My contacts or My contacts except.... By default anyone with your number can add you to a group, which is how many scam groups reach people.source
Hide your profile from strangers2 minOpen Settings > Privacy and set Last seen, Profile photo, About, and Status to My contacts or Nobody. Scammers use your photo and name to pose as you. You can also turn on Silence unknown callers under Privacy > Calls.source
Turn on security notifications1 minOpen Settings > Account > Security notifications and turn on the setting to show them on this device. You will see a notice when a contact's security code changes, which happens when they move to a new phone. If that contact then asks you for money or a code, check with them another way first.source
Protect your SIM with your carrier5 minYour WhatsApp account follows your phone number. Ask your carrier for a SIM PIN or a port-out or number-lock protection so no one can move your number to their SIM. See the SIM-swap guide for what to ask for.Unconfirmed, test pending
Never share your WhatsApp code1 minNever share your 6-digit registration code or your password with anyone, not even friends or family. Anyone who asks for it, for any reason, is trying to take your account.source

Then do the 24-hour cleanup.

Free toolExposure CheckSee what of yours is already public.Free toolPassword Breach CheckCheck if a password shows up in known leaks.ReadMinimizing credential theft with MFA

07How it probably happened

Most likely
Your friend's account was hijacked and is being used to ask everyone for codes
How this scam works
Also common
Someone typed your number into WhatsApp to request a code they want you to forward
How this scam works
Less common
A wrong number typed by mistake, which WhatsApp says also happens

Account taken, recovery details swapped

08Report it

About reporting and blocking on WhatsApp

Lost money, being blackmailed, or someone is using your account to scam others? Report it to your country's cybercrime service too. If you are in danger, call your local emergency number.

United States

FBI Internet Crime Complaint Center (IC3)Report online crime, including account takeovers that led to money loss or extortion. The IC3 never contacts you first and never asks for money.
FTC ReportFraudReport the scam to the Federal Trade Commission.
IdentityTheft.govUse it if someone used your Social Security number or opened accounts in your name. You get a recovery plan.

United Kingdom

Report Fraud (England, Wales and Northern Ireland)Run by the City of London Police. It replaced Action Fraud on 4 December 2025. In Scotland, call Police Scotland on 101 instead.
Forward scam texts to 7726Free on most UK networks. Your provider can look into the sender and block it.
Report a scam email to the NCSCForward the email to report@phishing.gov.uk before you delete it.
Report Fraud: 0300 123 2040England, Wales and Northern Ireland. In Scotland, call Police Scotland on 101.

India

National Cyber Crime Reporting PortalRun by the Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs. Reports go to state and UT police.
Chakshu on Sanchar SaathiReport suspected fraud calls, SMS or WhatsApp messages to the Department of Telecommunications. It is not for money already lost: call 1930 for that.
National Cyber Crime Helpline: 1930Toll free, 24 hours. Call fast if money left your account: it can help freeze the transfer.

Canada

Canadian Anti-Fraud Centre: report onlineVictims and witnesses can report fraud or cybercrime online. Also contact your local police as soon as you can.
Canadian Anti-Fraud Centre: 1-888-495-8501Toll free. The CAFC does not contact people to ask for money.

Australia

ReportCyberReport cybercrime to police. Your report may go to your state or territory police or the AFP.
ScamwatchReport a scam, even if you lost no money. The AFP also points people worried about identity theft to IDCARE, a free support service.
ReportCyber phone line: 1300 292 371Report concerns about cybercrime or cyber security incidents. If life is at risk, call 000.

09Questions people ask

Why did I get a WhatsApp code I did not ask for?

WhatsApp says someone entered your number to register. Often it is a typo, but it can also be someone trying to take your account.

Is my account safe if I did not share the code?

Yes. WhatsApp says without the code, no one can finish verifying your number, so you stay in control.

I already sent it. What now?

Re-register your number right away. Entering a new 6-digit code logs out everyone else. Then turn on two-step verification.

Can WhatsApp tell me who requested the code?

No. WhatsApp says it does not have enough information to identify who tried to verify your account.

Sources and last check

Last verified: October 16, 2026. Steps checked against the platform's own help pages listed below. Device testing is ongoing; steps marked unconfirmed are still waiting for it.

Received verification code without requesting it (read 2026-10-16)
How to recover a compromised account (read 2026-10-16)
Seeing "Your phone number was registered with WhatsApp on a new device" (read 2026-10-16)
About registration and two-step verification (read 2026-10-16)
About reporting and blocking on WhatsApp (read 2026-10-16)
How to manage two-step verification settings (read 2026-10-16)
How to check devices linked to your account and unlink a device you don't recognize (read 2026-10-16)

Wrong step or changed screen? Report it. Never include passwords or codes.