Someone has taken over my WhatsApp — how do I get it back?

The takeover is almost always the same: someone messages you, often from the account of a friend they have already taken, saying they sent you a code by mistake and asking you to forward it. That six-digit code is the registration code for your own account. Once they have it, they register your number on their device and yours is signed out.

Safety

Step by step

1. Warn your contacts first, on something else.Text, ring, or post elsewhere: my WhatsApp has been taken over, ignore any message from me asking for money. This is more urgent than the recovery, because the money requests start within minutes.
2. Re-register with your own number.Open WhatsApp — reinstall it if you were signed out — enter your phone number, and enter the six-digit code that arrives by SMS. Registering the number on your device signs it out everywhere else, because a number can only be active on one account at a time.
3. Deal with a two-step PIN they may have set.If the attacker enabled two-step verification, you may be asked for a PIN you never set. There is a waiting period after which you can register without it — usually several days — and it will be shown on screen. Wait it out; there is no faster route.
4. Turn on two-step verification yourself.In Settings, then Account, then Two-step verification. Set a PIN you will remember and add an email address for recovery. This is what prevents the same attack working a second time.
5. Check linked devices.In Settings, then Linked devices, log out anything you do not recognise. WhatsApp Web sessions survive independently and are a common way access is retained.
6. Check the groups you administer.Attackers use hijacked accounts to take over groups and then to defraud everyone in them. Remove anyone added while the account was not yours.
7. Tell WhatsApp.There is a support address for lost or stolen accounts and an in-app report route. Include your number in full international format.
8. Report it.Action Fraud, or Police Scotland on 101 in Scotland, particularly if any of your contacts sent money. Forward the original scam message to 7726 if it came by SMS.
9. Check what else uses that number.If your number is a recovery method for email or banking, check those accounts for unexpected reset attempts while the number was under someone else's control.

Tips

• Nobody ever needs a code that was sent to your phone. That single rule prevents this attack entirely, and it is worth telling everyone in the family.
• The request usually comes from a friend's account, because that account was taken the same way an hour earlier. Being asked by someone you trust is the design, not a coincidence.
• Your message history is on your device and is usually restored from your own backup. The attacker sees new messages, not your archive, unless they had access to the backup account.

Common mistakes

• Forwarding a code because a friend asked — That friend's account is already stolen. The code is yours and it is the only thing standing between them and your account.
• Waiting to warn contacts until the account is recovered — The money requests go out immediately. Recovery can take days if a PIN was set; the warning takes two minutes.
• Not setting the two-step PIN afterwards — Without it, the same attack works again the moment someone gets another code out of you.

Questions people ask