Deepak Gupta

Friends are getting WhatsApp messages you did not send

Follow WhatsApp's "How to recover a compromised account" steps: re-register your number with the 6-digit code to log out anyone using it, then check Linked Devices. Warn your friends by another channel first, because WhatsApp says the person could impersonate you in chats and groups.

Do these 3 things now

1Warn your contacts by SMS, a call, or another app that messages from your number are not from you.Read to them:“Warn your contacts by SMS, a call, or another app that messages from your number are not from you.”
2Open WhatsApp's recovery steps, re-register, and check Linked Devices.Read to them:“Open WhatsApp's recovery steps, re-register, and check Linked Devices.”
3Do not reply to anyone offering to recover your account, and never share a code.Read to them:“Do not reply to anyone offering to recover your account, and never share a code.”

Open WhatsApp's recovery steps

Official link: faq.whatsapp.com

I am helping someone else

Helper mode: each step is written for you to read aloud. Let them tap and type on their own device; never ask them to send you a code. Send them this first.

01Is this you?

Friends say you asked for money, a code, or sent a strange link.
You can still use WhatsApp, but sent messages appear that you did not write.
A WhatsApp Web or desktop session you do not recognize is listed.

Not quite? You were logged out of WhatsApp · Someone asked you for a code · Copy-paste warning messages

02Official recovery path

Check Linked Devices first. On iPhone, tap Settings or your profile picture, then Linked Devices. On Android, open it from the menu.Read to them:“Check Linked Devices first. On iPhone, tap Settings or your profile picture, then Linked Devices. On Android, open it from the menu.”source
Tap each device you do not recognize, then tap Log Out. Repeat for all of them.Read to them:“Tap each device you do not recognize, then tap Log Out. Repeat for all of them.”source
If you were logged out, or messages keep coming, re-register: open WhatsApp, enter your number, and enter the 6-digit code. That logs out every other device.Read to them:“If you were logged out, or messages keep coming, re-register: open WhatsApp, enter your number, and enter the 6-digit code. That logs out every other device.”source
Turn on two-step verification with a password and email, so a stolen code alone cannot take your account again.Read to them:“Turn on two-step verification with a password and email, so a stolen code alone cannot take your account again.”source
Turn on security notifications: open Settings > Account > Security notifications, then turn on Show security notifications on this device.Read to them:“Turn on security notifications: open Settings > Account > Security notifications, then turn on Show security notifications on this device.”Androidsource
Turn on security notifications: tap Settings or your profile picture, then Account > Security Notifications, and turn on Show Security Notifications on This Phone.Read to them:“Turn on security notifications: tap Settings or your profile picture, then Account > Security Notifications, and turn on Show Security Notifications on This Phone.”iPhonesource

Did that get you back in?

Yes

Lock it down now. Change the password, turn on two-step, sign out other devices. It takes about 15 minutes.

No

A.If you are asked for a PIN you never set, follow the PIN page. The other person is already logged out.Read to them:“If you are asked for a PIN you never set, follow the PIN page. The other person is already logged out.”source
B.If your phone has no service, your number may have been moved. Call your carrier.Read to them:“If your phone has no service, your number may have been moved. Call your carrier.”source
C.Ask friends who got scam messages to report them in the chat. WhatsApp says reporting is only done in the app.Read to them:“Ask friends who got scam messages to report them in the chat. WhatsApp says reporting is only done in the app.”source

Then: how long it takes

03How long it takes

Published by the platform

Logging out a linked device or re-registering takes effect right away. If you are asked for a PIN you do not know, WhatsApp says to wait 7 days and try again.

While you wait

Post a short warning on your status or other social accounts.
Ask anyone who sent money to contact their bank today.

04Warn your contacts

Send this from another account or by text, so nobody falls for messages sent in your name.

My WhatsApp was taken over. If my number messages you asking for money, a code, or a link, it is not me. Please do not send anything or share any code. I will tell you when I have my account back.

More templates: email, followers, customers

05Watch out for recovery scams

People who just lost an account are the main target of fake helpers. Only WhatsApp's own app or website can restore your account.

The "friend in trouble" money request sent to your contacts from your account. How it works
Fake "WhatsApp Support" accounts or callers who offer to restore your account. Only use help pages on whatsapp.com. How it works
Paid "account recovery" services and hackers-for-hire in comments and DMs. They cannot do anything you cannot do yourself, and many take money and vanish. How it works

All recovery scams and how to spot them

06Once you're back in: lock it down

0 of 9 doneAbout 19 minutes total

Turn on two-step verification with a password and email3 minOn Android, open Settings > Account > Two-step verification. On iPhone, tap You > Account > Two-step verification. Toggle on Turn on two-step verification, create a strong password, then add an email address you can access and tap Next. WhatsApp is replacing the old 6-digit PIN with a password, so set a password if you still have a PIN.source
Add and verify a recovery email2 minOpen Settings > Account > Email address > Add email (on iPhone, start from You). Enter the code WhatsApp sends to your inbox and tap Verify. A verified email lets you get a registration code without SMS. Use an email account that has its own strong protection.source
Create a passkey2 minOpen Settings > Account > Passkeys, then follow the prompts (on Android, tap Create passkey > Continue). A passkey uses your phone's fingerprint, face, or screen lock, so you can verify yourself without an SMS code. You need Android 9 or later with a password manager, or an iPhone 8 or later on iOS 16 or later.source
Log out devices you do not recognize2 minOpen Linked Devices (on iPhone, from Settings or your profile picture; on Android, from the menu). Tap any device you do not recognize, then tap Log Out. Repeat for each one. WhatsApp Web sessions show up here.source
Limit who can add you to groups1 minOpen Settings > Privacy > Groups and choose My contacts or My contacts except.... By default anyone with your number can add you to a group, which is how many scam groups reach people.source
Hide your profile from strangers2 minOpen Settings > Privacy and set Last seen, Profile photo, About, and Status to My contacts or Nobody. Scammers use your photo and name to pose as you. You can also turn on Silence unknown callers under Privacy > Calls.source
Turn on security notifications1 minOpen Settings > Account > Security notifications and turn on the setting to show them on this device. You will see a notice when a contact's security code changes, which happens when they move to a new phone. If that contact then asks you for money or a code, check with them another way first.source
Protect your SIM with your carrier5 minYour WhatsApp account follows your phone number. Ask your carrier for a SIM PIN or a port-out or number-lock protection so no one can move your number to their SIM. See the SIM-swap guide for what to ask for.Unconfirmed, test pending
Never share your WhatsApp code1 minNever share your 6-digit registration code or your password with anyone, not even friends or family. Anyone who asks for it, for any reason, is trying to take your account.source

Then do the 24-hour cleanup.

Free toolExposure CheckSee what of yours is already public.Free toolPassword Breach CheckCheck if a password shows up in known leaks.ReadLogin security: 7 best practices

07How it probably happened

Most likely
Someone got your 6-digit code and registered your number on their phone
How this scam works
Also common
Someone linked WhatsApp Web to your account, for example by scanning a QR code on your unlocked phone
How this scam works
Less common
Your number was moved to another SIM
How this scam works

Account taken, recovery details swapped

08Report it

About reporting and blocking on WhatsApp

Lost money, being blackmailed, or someone is using your account to scam others? Report it to your country's cybercrime service too. If you are in danger, call your local emergency number.

United States

FBI Internet Crime Complaint Center (IC3)Report online crime, including account takeovers that led to money loss or extortion. The IC3 never contacts you first and never asks for money.
FTC ReportFraudReport the scam to the Federal Trade Commission.
IdentityTheft.govUse it if someone used your Social Security number or opened accounts in your name. You get a recovery plan.

United Kingdom

Report Fraud (England, Wales and Northern Ireland)Run by the City of London Police. It replaced Action Fraud on 4 December 2025. In Scotland, call Police Scotland on 101 instead.
Forward scam texts to 7726Free on most UK networks. Your provider can look into the sender and block it.
Report a scam email to the NCSCForward the email to report@phishing.gov.uk before you delete it.
Report Fraud: 0300 123 2040England, Wales and Northern Ireland. In Scotland, call Police Scotland on 101.

India

National Cyber Crime Reporting PortalRun by the Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs. Reports go to state and UT police.
Chakshu on Sanchar SaathiReport suspected fraud calls, SMS or WhatsApp messages to the Department of Telecommunications. It is not for money already lost: call 1930 for that.
National Cyber Crime Helpline: 1930Toll free, 24 hours. Call fast if money left your account: it can help freeze the transfer.

Canada

Canadian Anti-Fraud Centre: report onlineVictims and witnesses can report fraud or cybercrime online. Also contact your local police as soon as you can.
Canadian Anti-Fraud Centre: 1-888-495-8501Toll free. The CAFC does not contact people to ask for money.

Australia

ReportCyberReport cybercrime to police. Your report may go to your state or territory police or the AFP.
ScamwatchReport a scam, even if you lost no money. The AFP also points people worried about identity theft to IDCARE, a free support service.
ReportCyber phone line: 1300 292 371Report concerns about cybercrime or cyber security incidents. If life is at risk, call 000.

09Questions people ask

Can WhatsApp block the people messaging my friends?

No. WhatsApp says it cannot block or unblock contacts for you. You and your friends can block and report in the app.

Will a new password stop them?

No. WhatsApp says setting a password will not remove someone who has already taken over your account. Re-register with the 6-digit code.

What is the difference between linked devices and trusted devices?

Linked devices, like WhatsApp Web or desktop, can read and send your messages. Trusted devices are phones you mark to log in faster with two-step verification.

Can WhatsApp show me who was in my account?

No. WhatsApp says it cannot share who accessed your account, or when or where.

Sources and last check

Last verified: October 16, 2026. Steps checked against the platform's own help pages listed below. Device testing is ongoing; steps marked unconfirmed are still waiting for it.

How to recover a compromised account (read 2026-10-16)
How to check devices linked to your account and unlink a device you don't recognize (read 2026-10-16)
How to manage two-step verification settings (read 2026-10-16)
About security code change notifications (read 2026-10-16)
About reporting and blocking on WhatsApp (read 2026-10-16)
Account security tips (read 2026-10-16)
How to recover a WhatsApp account from a lost or stolen device (read 2026-10-16)

Wrong step or changed screen? Report it. Never include passwords or codes.