LIVE: New phishing campaigns targeting mobile users —View latest threats →

Back to Threats
High🎭 Social Engineering

WhatsApp Account Hijack via OTP Theft

Attackers trick WhatsApp users into sharing their 6-digit OTP registration code, instantly hijacking the account to scam the victim's contacts for money.

Published: 8 May 2026Last updated: 1 April 2026

What Is This Threat?

WhatsApp account hijacking is one of the fastest-growing social engineering attacks. The attacker needs just one thing from you: the 6-digit SMS code WhatsApp sends when registering a new device. Once they have it, your account is gone in seconds.

How It Works

  • You receive a WhatsApp message from a contact (whose account was already hijacked): "Hi, sorry — I accidentally sent a code to your number instead of mine. Can you forward it to me?"
  • Shortly after, you receive a real SMS from WhatsApp with a 6-digit code.
  • You forward the code to the "friend." That code is actually YOUR registration code.
  • The attacker enters your phone number on a new device and uses your forwarded code to register — you are immediately logged out.
  • They now control your account, access all your chats, and send the same scam to everyone in your contact list. They may also request money from your contacts claiming an emergency.

    • Why It Works

  • The message comes from someone you trust (a real contact's hijacked account).
  • The request sounds harmless and plausible — a simple "mistake."
  • WhatsApp doesn't warn you that the code you're forwarding is for your own account.

    • Red Flags

  • Any message asking you to forward an SMS code, no matter who it comes from.
  • A contact asking for money or a code "urgently" — they may be hijacked.
  • You suddenly get a WhatsApp registration SMS you didn't request.

    • How to Protect Yourself

    • Enable WhatsApp two-step verification (Settings → Account → Two-step verification) — a PIN is required even with the code
    • Never share or forward any SMS code with anyone, no matter who asks
    • If a contact asks for a code or money urgently, call them on a regular phone call to verify
    • Treat any unsolicited WhatsApp registration SMS as a sign someone is trying to steal your account
    • Tell your contacts immediately if your account is hijacked so they ignore messages from it

    What to Do If Affected

    1. 1.If you forwarded the code, immediately re-register WhatsApp on your own phone with your number — this logs out the attacker
    2. 2.Enable two-step verification as soon as you regain access
    3. 3.Warn all your contacts that your account was compromised and to ignore recent messages
    4. 4.Check if the attacker sent any money requests to your contacts on your behalf
    5. 5.Report the hijacked account to WhatsApp via the in-app Help menu
    #WhatsApp#OTP#account hijack#social engineering#SMS