A WhatsApp takeover in Singapore almost always follows the same script: someone gets hold of the six-digit code that registers your number on a new device, and suddenly your account is theirs. They then message your friends and family pretending to be you, often asking for money or more codes. It sounds dramatic, but the fix is straightforward, and it starts with one rule that stops nearly every attack: never share your verification code with anyone.
This guide explains how the takeover works in plain terms, the settings that make your account much harder to steal, and what to do quickly if your account has already been compromised. None of it is technical, and all of it takes just a few minutes to set up.
How a Takeover Actually Happens
WhatsApp verifies that a phone number belongs to you by sending a six-digit code to that number when the account is set up on a device. Whoever enters that code controls the account. Scammers cannot easily intercept your code, so instead they trick you into handing it over.
The common approach looks like this. A message arrives, sometimes from an account that appears to be a friend whose own account was already taken over. It says something believable: they sent a code to your number by mistake, or you need to confirm a code to receive something. Moments later, a genuine WhatsApp verification code lands on your phone. If you read it out or forward it, the attacker uses it to register your number on their device, and you are locked out.
Because the follow-up messages come from what looks like a real contact, the request feels normal. That social angle is the whole trick. There is no clever hacking involved, just a moment of trust exploited under a little time pressure.
A few signs that you are being set up for a takeover:
- A contact, or a stranger, asks you to send them a code you just received.
- You get a WhatsApp code you did not request, followed by a message urging you to share it.
- A “friend” messages with an unusual request and a sense of urgency.
- Anyone frames sharing the code as helping them or fixing a mistake.
The rule is simple and absolute: a WhatsApp verification code is only ever for you. No friend, no company, and no support agent has a legitimate reason to ask for it.
Turn On Two-Step Verification
The most important protection is WhatsApp’s own two-step verification. When it is on, registering your number on a new device requires a PIN that only you know, on top of the six-digit code. Even if someone tricks you into sharing the code, they still cannot take over without the PIN.
To set it up, open WhatsApp settings, go to Account, and choose Two-step verification, then follow the prompts to create a PIN. Add an email address when asked, so you have a way to reset the PIN if you forget it. Keep the PIN private and choose something you will remember but others cannot guess.
Here are the core settings worth checking, and why each one helps.
| Setting | Where to find it | Why it matters |
|---|---|---|
| Two-step verification | Settings, Account | Adds a private PIN so a stolen code alone is not enough |
| Linked devices | Settings, Linked devices | Lets you see and remove any device using your account |
| Security notifications | Settings, Account, Security | Alerts you when a contact’s security code changes |
| Recovery email | Set during two-step setup | Lets you reset your PIN if you forget it |
| Passcode or lock on the app | Settings, Privacy, App lock | Stops someone with your unlocked phone opening WhatsApp |
Once two-step verification is on, the single most common takeover method stops working, because the code is no longer the only key.
Everyday Habits That Keep You Safe
Beyond the settings, a few habits make you a much harder target.
- Never share the six-digit code. This is the one rule that matters most. Treat any request for it, from anyone, as a scam.
- Verify unusual requests another way. If a contact asks for money or a code, call them or message on another channel to confirm it is really them.
- Check your linked devices now and then. Open Settings and Linked devices, and remove anything you do not recognise.
- Lock your phone and your apps. A phone passcode and WhatsApp’s app lock keep your chats safe if your device is lost or borrowed.
- Be wary of urgency. Scammers push you to act fast so you do not stop and think. Slowing down is a defence in itself.
- Keep the app updated. Updates include security fixes that close known weaknesses.
It is also worth having a quiet word with family, especially anyone less confident with technology. A shared understanding that “we never send each other codes, and we always call to confirm money requests” protects your whole circle, because a takeover of one account is often used to target the others.
If Your Account Is Taken Over
If you are suddenly logged out, or friends tell you that “you” are sending odd messages, act quickly and calmly.
- Re-register your number. Open WhatsApp and sign in with your phone number. You will receive a fresh six-digit code by SMS. Entering it on your phone signs you back in and signs the attacker out.
- Enter your two-step PIN if prompted. If you had two-step verification on, you may need your PIN. This is exactly the barrier that helps you recover.
- Remove unknown linked devices. Once back in, check Linked devices and remove anything unfamiliar.
- Warn your contacts. Let friends and family know your account was compromised and to ignore any recent money or code requests.
- Report it. Report the scam to the Police and use Singapore’s anti-scam tools such as ScamShield, looking up the official contacts through their own websites rather than any number sent to you.
Because control returns to whoever holds the number and can complete verification, re-registering usually restores access. If you had two-step verification on and did not share your PIN, recovery is faster and the attacker’s window is short.
The Habit That Matters Most
WhatsApp takeover attempts will keep circulating, because they are cheap and rely on ordinary trust. Two things defeat them almost every time: turning on two-step verification, and refusing to share your six-digit code with anyone under any circumstances. Set the PIN today, tell your family the two rules, and a scam that catches so many people simply stops at your door.
Explore more
Two-Factor Authentication Guide
Recovering a Hacked Account
How to Recognise Phishing Emails and SMS
Using ScamShield and Singapore’s Anti-Scam Tools