How to turn on WhatsApp two-step verification and stop account takeovers
It takes a minute and blocks scammers from hijacking your account even if they trick you into sharing the SMS code. Here is how to set it up.
One of the most common WhatsApp scams goes like this: someone pretends to be a store, a marketplace buyer or a survey and asks for “the code you just received by text”. That code is exactly what moves your account to a new phone. Share it, and you hand over your WhatsApp.
Two-step verification adds a second lock. Even if a scammer gets the SMS code, they hit a six-digit PIN that only you know.
How to turn it on
The steps are the same on Android and iPhone:
- Open WhatsApp and go to Settings.
- Tap Account > Two-step verification.
- Tap Turn on.
- Create a six-digit PIN. Avoid birthdays and sequences like 123456.
- Add a recovery email so you can reset the PIN if you forget it.
- Confirm the email through the link WhatsApp sends you.
That’s it. Every now and then the app will ask for your PIN so you don’t forget it. That is expected.
How to spot the scam
Be suspicious whenever someone:
- Asks for a code you received by text, even if they say it is “to confirm your registration” or “to release a prize”;
- Messages you from a new number claiming to be a relative who “got a new phone” and then asks for money;
- Creates urgency, with tight deadlines or threats to cancel something.
When in doubt, call the person on their old number or contact the company through its official channels.
Extra protections worth turning on
Two-step verification is the main lock, but you can go further. Under Settings > Account > Passkeys, you can create a passkey: instead of typing a code, WhatsApp confirms it is you with your fingerprint, face or screen lock.
It is also worth going to Settings > Privacy > Groups and choosing who can add you to groups. Many scams start with a fake “investment” or “job offer” group.
What if your account was already taken?
Reinstall WhatsApp on your phone and sign in with your number. You will get a fresh SMS code, and once you are back in, the scammer is logged out. If they turned on two-step verification before you did, you may need to wait a few days to regain access.
In the meantime, warn your contacts through other channels so nobody sends money to requests made in your name, and report the incident to the police.
