If your WhatsApp account has been hacked, the first step depends on whether you can still access it. If you’ve been logged out, try signing back in with your phone number and the six-digit code sent by SMS or phone call. This signs out anyone else using your account, although an unknown two-step verification PIN may delay full access.
If WhatsApp still works on your phone, check Linked devices and log out of any session you don’t recognize. If you’ve lost control of your SIM, contact your mobile carrier to recover your number.
Regaining access doesn’t necessarily restore missing chats or tell you what someone may have seen. This guide explains how to recover a hacked WhatsApp account, protect your conversations, and secure it against another takeover.
WhatsApp Hacked? Here's What to Do Immediately
Before changing your settings or reinstalling WhatsApp, find out what kind of security problem you're dealing with.
Someone taking over your WhatsApp account is different from someone secretly linking another device to it. Both are serious, but the steps to regain control aren't the same.
Identify Your Situation and Take the Right Action
Your situation | What to do first |
|---|---|
WhatsApp unexpectedly logged you out | Sign back in using your phone number and verification code. |
WhatsApp still works, but you suspect someone else is using it | Check Linked devices and disconnect unfamiliar sessions. |
Your SIM was lost, stolen, or stopped working | Contact your mobile carrier to recover your number. |
You're not receiving verification codes | Check your number and follow WhatsApp's verification troubleshooting steps. |
WhatsApp asks for a two-step verification PIN you don't recognize | Verify your phone number and follow the recovery instructions. |
Someone is sending suspicious messages from your account | Warn your contacts through another trusted communication method. |
Never share your WhatsApp verification code, two-step verification PIN or password, or backup recovery key. Anyone claiming to be WhatsApp support who asks for these credentials should be treated with suspicion.
According to WhatsApp's official account recovery guidance, entering the six-digit registration code automatically logs out other devices using your account.
There's also no need to uninstall WhatsApp as your first step. If your conversations are still accessible, reinstalling the app unnecessarily could put messages without a usable backup at risk.
How to Know If Your WhatsApp Account Has Been Hacked
A strange notification doesn't always mean your account has been compromised. Still, certain changes are worth investigating straight away.
Warning Signs of Unauthorized Access
Pay attention to the following:
Unexpected logout: WhatsApp asks you to register your phone number again, even though you never signed out.
Unknown linked devices: You notice a computer, browser, tablet, or phone you don't recognize in your Linked devices list.
Messages you didn't send: Friends or family receive unusual links, requests for money, or messages that appear to come from you.
Unexplained account changes: Your profile information or security settings have changed without your knowledge.
Unusual chat activity: Messages appear read, or conversations have changed when you haven't been using WhatsApp.
Any of these could indicate unauthorized access. However, they don't necessarily tell you how it happened or who was responsible.
Suppose a friend calls to ask why you've requested money through WhatsApp. You haven't sent any such message. That's a reason to investigate immediately, even if the app seems to be working normally on your phone.
Does an Unexpected WhatsApp Verification Code Mean You've Been Hacked?
Not necessarily.
If you receive a WhatsApp verification code you didn't request, someone may be trying to register your number on another device. It could be an honest mistake or an attempted account takeover.
The important distinction is that receiving an unexpected code doesn't prove someone successfully accessed your account.
Don't share the code, enter it on an unfamiliar website, or approve a device-linking request you didn't initiate.
If you can still use WhatsApp, check your linked devices and account settings. If you've been logged out unexpectedly, move straight to the recovery instructions below.
How to Recover a Hacked WhatsApp Account When You're Logged Out
If someone has registered your WhatsApp account on another phone, you'll need to verify your registered phone number to regain control.
The process is usually straightforward when you still have access to that number.
Step-by-Step Recovery Using Your Phone Number
Follow these steps based on WhatsApp's official compromised-account recovery instructions:
Open WhatsApp on your phone. Tap Log back in and Continue if those options appear.
Enter your registered phone number. Make sure you include the correct international country code.
Request a verification code. WhatsApp can send a six-digit registration code by SMS or phone call.
Enter the code you receive. Use the latest valid code sent to your number.
Complete any additional security checks. Depending on your account settings, WhatsApp may ask for a two-step verification PIN or another authentication method.
Review your account once you're back in. Check your linked devices, security settings, and recent conversations.
The screens may look slightly different depending on your phone, WhatsApp version, and enabled security features.
What Happens After You Verify Your Number?
Once you successfully re-register your number using the six-digit code, WhatsApp automatically logs out other devices using that account.
That matters if someone has taken over your WhatsApp registration. Entering the code removes their account sessions, even when they've set up two-step verification without your permission.
However, you may still be unable to use the account immediately if WhatsApp asks for a PIN you don't know.
There's another distinction worth understanding: changing a password alone doesn't remove someone who has already taken over your WhatsApp account. WhatsApp's recovery guidance specifically directs affected users to verify their number again.
What to Check After Regaining Access
Once you're back in, spend a few minutes checking whether anything has changed.
Review your profile information and security settings. Look through recent conversations for messages you didn't send, and check Linked devices for unfamiliar connections.
If someone used your account to contact friends, family, or customers, let them know those messages may have been fraudulent.
Also check whether your chats and media are still available. If everything is intact, there's no reason to rush into restoring a backup.
WhatsApp Hacked but Still Logged In? Check Linked Devices
It's possible for someone to access WhatsApp conversations without logging you out of your phone.
WhatsApp supports companion devices, including computers, browsers, tablets, and other supported phones. If someone tricks you into linking their device, they may be able to read messages synchronized to that session.
This is why checking linked devices matters, even when your main WhatsApp account seems normal.
How to Find and Remove Unknown WhatsApp Linked Devices
On Android:
Open WhatsApp.
Tap the three-dot menu.
Select Linked devices.
Review the connected devices.
Tap an unfamiliar device and choose Log out.
On iPhone:
Open WhatsApp.
Go to Settings.
Tap Linked Devices.
Review the active sessions.
Select a device you don't recognize and tap Log Out.
These steps follow WhatsApp's linked-device management guidance. The exact menu layout may vary between app versions.
Before disconnecting something, consider whether it could be a computer or browser you've used in the past. If you can't identify the device or never authorized it, log it out.
What Happens After You Disconnect a Suspicious Device?
Logging out disconnects that device from your WhatsApp account.
What it doesn't do is erase information someone may already have seen, copied, photographed, or saved.
If you think an unauthorized device had access to sensitive conversations, check what those chats contained. For example, messages involving financial information, private documents, or account credentials may require further action.
You can't undo every possible exposure, but you can stop the suspicious session and address any information that may have been compromised.
How Attackers Trick People Into Linking Devices
Some WhatsApp scams don't try to steal your phone number. Instead, they try to convince you to connect an attacker's device.
Imagine receiving a message asking you to vote for a friend in an online competition.
You open the website, enter your phone number, and see a request for a WhatsApp linking code. It looks like a normal verification step, but entering that code could authorize someone else's device.
Meta described this type of scam when it announced new warnings for suspicious WhatsApp device-linking requests in March 2026.
The protections include warnings for potentially fraudulent requests involving QR codes and device-linking codes.
These alerts are helpful, but they won't necessarily catch every scam.
Only approve a device-linking request when you're deliberately connecting a device you own or trust.
Can't Recover Your WhatsApp Account? Fix Common Recovery Problems
Sometimes the normal recovery process doesn't work immediately.
You may not receive the verification code, your SIM may no longer be active, or WhatsApp may ask for security credentials you don't recognize.
Here's what to do in each situation.
WhatsApp Verification Code Not Received
If you're not receiving a WhatsApp verification code, start with the basics:
Check that you've entered the correct phone number and international country code.
Make sure your SIM can receive text messages and phone calls.
Check your mobile signal.
Wait for WhatsApp's verification timer to finish.
Try Call Me if WhatsApp offers that option.
Enter the latest valid code instead of repeatedly guessing.
WhatsApp warns that incorrect registration attempts can result in a temporary waiting period.
Its registration troubleshooting guide also recommends checking your app version, restarting your phone, and confirming that your number can receive SMS messages.
If you've previously added and verified an email address, WhatsApp may offer email verification for an existing account. That option has additional requirements, though, and won't solve every phone-number problem.
How to Recover Hacked WhatsApp Without Your Original SIM
If your SIM has been lost, stolen, deactivated, or transferred to someone else, recovering your phone number should come first.
WhatsApp's email verification documentation states that email login for an existing account requires a previously verified email address and an active SIM associated with the WhatsApp number.
In other words, email alone isn't a guaranteed way to recover WhatsApp when you've lost access to your phone number.
Contact your mobile carrier and ask how to restore service to the same number. Depending on the situation, this may involve obtaining a replacement SIM.
If you suspect someone transferred your number to another SIM without permission, report the issue to your carrier immediately.
This is known as a SIM-swap attack. The US Federal Trade Commission recommends contacting the carrier and checking sensitive accounts for unauthorized activity.
Once your number is back under your control, return to WhatsApp's official registration process.
Be especially cautious of services that promise to recover your WhatsApp account without verification in exchange for money.
What If the Hacker Enabled Two-Step Verification?
WhatsApp may ask for a two-step verification PIN you never created.
According to its official compromised-account guidance, users who cannot provide the required PIN may have to wait seven days before regaining full access.
Entering the six-digit phone-number registration code still logs out unauthorized account sessions, even if the unknown PIN delays your access.
There's an important update for 2026.
In August, Meta announced stronger two-step verification using longer passwords instead of the traditional six-digit PIN. Since authentication features are changing, you should follow the recovery prompts shown in your WhatsApp app rather than assuming every account has the same recovery process.
An unfamiliar PIN also isn't always evidence of hacking. If you've recently received a recycled phone number, its previous owner may have configured two-step verification.
WhatsApp explains these circumstances in its two-step verification and email recovery documentation.
What If WhatsApp Has Banned Your Number?
If someone used your account for spam or scams, WhatsApp may restrict or ban it.
When you see a ban notification, check whether the app offers an appeal:
Open WhatsApp.
Tap Request review, if available.
Follow the instructions to submit your request.
Check the app for the review decision.
WhatsApp's account-ban documentation explains that if the review option isn't available, the ban may not be eligible for an appeal through that process.
Don't pay third-party services claiming they can remove WhatsApp bans. They cannot legitimately override WhatsApp's account restrictions.
Can Hackers Read Your Old WhatsApp Messages?
This is often the first question people ask after recovering their accounts.
The answer isn't simply yes or no. What an attacker can read depends on how they gained access.
WhatsApp uses end-to-end encryption for personal messages. However, encryption doesn't stop someone from reading conversations on a device or account session they've gained access to.
What an Attacker Can Access Depends on How They Got In
Type of compromise | What an attacker may access |
|---|---|
Account registered on another phone | Re-registration alone doesn't expose old conversations stored on the original phone. |
Unauthorized linked device | Recent synchronized chats and messages available through that device. |
Physical access to an unlocked phone | Existing conversations, media, and information accessible on the phone. |
Compromised cloud backup account | Potential access to backup data, depending on the backup's encryption and available credentials. |
Previously connected unauthorized device | Messages or information already copied or saved may remain exposed after disconnection. |
WhatsApp confirms that registering your phone number on a new device doesn't automatically provide access to conversations stored on your original phone.
However, WhatsApp's linked-device documentation explains that companion devices receive an end-to-end encrypted copy of recent message history.
WhatsApp Desktop may also synchronize more historical messages than WhatsApp Web.
That's an important difference. Someone who takes over your account registration doesn't automatically receive every old conversation, but someone who successfully links another device may see messages available through that session.
What Happens to Your Chats After You Regain Control?
Getting your account back stops unauthorized access through sessions removed by re-registration. It doesn't undo everything that happened beforehand.
If an attacker copied a message while using an unauthorized linked device, disconnecting that device won't erase the copy.
Similarly, recovering your WhatsApp account doesn't automatically restore deleted chats or missing photos and videos.
Think about whether any exposed conversations contained passwords, personal documents, financial information, or other sensitive details. If they did, take steps to secure the affected information and accounts.
How to Recover WhatsApp Chats After Your Account Was Hacked
Recovering your WhatsApp account and restoring your chat history are two different things.
You might regain access to your number but discover that some conversations are missing. Whether you can restore them depends on what remains on your original device and whether you have a usable backup.
Restore WhatsApp Chats on Android Using Google Account Backup
On Android, WhatsApp supports chat backups linked to a Google Account.
To restore an existing backup, you'll generally need:
The WhatsApp phone number associated with the backup.
The Google Account used to create it.
Any required encrypted-backup credentials.
Enough storage space and a working internet connection.
WhatsApp normally offers a backup restoration option during supported account setup.
Before uninstalling or reinstalling the app, check whether your current conversations are still available and whether a usable backup exists.
There's another detail worth checking: WhatsApp's Google Account backup guidance explains that a new backup replaces the previous one.
If the backup you wanted has already been overwritten, you generally can't restore that older version through WhatsApp's standard Google Account backup process.
That's particularly relevant when chats have gone missing. Creating another backup without checking what it contains could replace an earlier copy that still held the messages you needed.
Restore WhatsApp Chats on iPhone Using iCloud
On iPhone, WhatsApp can restore conversations from an existing iCloud backup.
If you can still open WhatsApp, go to Settings → Chats → Chat Backup to review the available backup information.
If a usable backup exists and restoration is necessary, follow these steps:
Confirm that the appropriate iCloud backup is available.
Make sure you can access the Apple Account associated with it.
Reinstall WhatsApp when restoration is required.
Verify the phone number connected to the backup.
Select Restore Chat History when prompted.
Complete any additional backup-security checks.
WhatsApp explains these requirements in its chat restoration guidance.
Keep in mind that a backup only contains the information saved when it was created. Messages sent or received afterward generally can't be restored from that backup.
If your original phone is still accessible, WhatsApp may also offer a supported device-to-device chat transfer, depending on your devices and circumstances.
Don't uninstall WhatsApp just because you suspect a hack. First check whether your chats are still intact and whether a reliable backup is available.
What If Your WhatsApp Backup Is End-to-End Encrypted?
WhatsApp supports end-to-end encrypted cloud backups protected by one of the available authentication methods:
A password you created.
A 64-digit encryption key.
A supported passkey.
These backup credentials are separate from your WhatsApp registration code and two-step verification PIN or password.
According to WhatsApp's encrypted-backup documentation, restoring a protected backup requires the appropriate authentication method.
If you've lost account access and no longer have the password or encryption key needed for your encrypted backup, WhatsApp cannot reset those credentials or restore the backup for you.
There is an important exception: if you can still access your WhatsApp chats, you may be able to change a forgotten encrypted-backup password.
To review your available options, open Settings → Chats → Chat Backup → End-to-end encrypted backup.
WhatsApp also provides instructions for changing a forgotten encrypted-backup password.
The key point is that recovering your account, restoring conversations, and unlocking an encrypted backup are separate processes. Succeeding with one doesn't guarantee the others will work.
What to Do If a Hacker Contacted Your Friends or Asked for Money
If someone impersonated you on WhatsApp, the consequences may continue even after you've recovered the account.
Friends, relatives, coworkers, or customers could already have received suspicious links, payment requests, or messages asking for verification codes.
Warn Your Contacts About Suspicious Messages
Reach out to anyone who may have received fraudulent messages, preferably through another communication method you trust.
Explain that someone may have accessed your WhatsApp account and that unusual messages sent from your number shouldn't be trusted.
Ask contacts not to open suspicious links, transfer money, or share verification codes.
If you use WhatsApp Business, pay particular attention to customers who may have received unexpected payment instructions or requests for confidential details.
A short warning can prevent further problems, especially when the fraudulent messages look like they came from someone the recipient knows.
Check for Financial Fraud or Impersonation
If money or sensitive information may be involved, take action beyond WhatsApp itself.
Contact any affected bank, payment provider, or mobile carrier.
Review financial accounts for transactions you don't recognize.
Secure other accounts if passwords or recovery information may have been exposed.
Save relevant screenshots, suspicious messages, and transaction details.
Report suspected fraud through the appropriate official channels.
For example, if someone impersonating your business gave customers a different bank account for payment, contact those customers directly and verify any outstanding transactions.
The appropriate reporting process and chances of recovering stolen money depend on your country, bank, and payment provider.
How to Secure Your WhatsApp Account After Recovery
Once you're back in control, it's worth reviewing more than just your WhatsApp settings.
Your registered phone number, email account, physical device, and connected sessions all play a role in keeping the account secure.
Enable or Update Two-Step Verification
Two-step verification adds protection beyond the initial phone-number registration code.
For years, WhatsApp primarily used a six-digit PIN for this feature.
On August 25, 2026, Meta announced stronger two-step verification with longer passwords that can contain letters, numbers, and special characters.
If your account offers password-based verification, choose a strong password that you don't use elsewhere. Make sure your associated recovery email is secure, too.
If your account still uses a PIN, check the available security settings and upgrade when the option appears.
Two-step verification helps protect against future unauthorized registration. It doesn't replace the recovery process if someone has already taken over your account.
Review Passkeys and Security Credentials
WhatsApp also supports passkeys for account authentication.
Depending on the device, a passkey lets you verify your identity using a fingerprint, facial recognition, or your device's screen lock.
Meta's August 2026 announcement confirmed support for adding multiple account passkeys.
To see whether the feature is available to you, open Settings → Account → Passkeys.
One distinction is easy to miss: a passkey for signing into WhatsApp isn't the same as a passkey used to unlock an encrypted chat backup. They protect different things.
Protect Your SIM, Email, Phone, and Linked Devices
A few habits can reduce the risk of another compromise:
Secure your phone number. Ask your carrier whether it offers SIM-swap protection or additional account verification.
Protect your email. Use a unique password and enable multi-factor authentication where available.
Lock your phone. Set a secure screen lock and keep your operating system updated.
Check linked devices. Disconnect computers, browsers, or other sessions you no longer use.
Stick to official WhatsApp apps. Avoid modified versions from untrusted sources.
Keep recoverable backups. Review your backup settings and store necessary recovery credentials securely.
No single setting can prevent every kind of account compromise. These precautions work together to address different risks.
Use Additional WhatsApp Privacy Protections
WhatsApp introduced several security improvements in 2026.
In March, Meta announced warnings for suspicious device-linking attempts, including scams involving misleading QR codes and linking codes.
Earlier, in January 2026, Meta introduced Strict Account Settings.
This optional feature is intended for people who may face sophisticated cyberattacks, including journalists and public figures.
It provides stricter protections, such as blocking attachments and media from unknown senders and silencing calls from unfamiliar numbers.
Where available, you'll find it under Settings → Privacy → Advanced.
These features may not appear in exactly the same way on every device or app version. Check the security options available on your own account and choose the protections that fit your needs.
Frequently Asked Questions
Can WhatsApp Tell Me Who Hacked My Account?
No. WhatsApp states that it cannot identify who accessed your account or provide the time and location of that access.
If you suspect criminal activity, preserve any useful evidence and contact the appropriate authorities.
You can read more in WhatsApp's official compromised-account guidance.
Can WhatsApp Support Deactivate My Account for Me?
WhatsApp's current recovery guidance says it cannot deactivate accounts on someone else's behalf because of verification restrictions.
It also recommends attempting account recovery before reporting the compromised account itself, since reporting may result in restrictions or loss of access.
Follow WhatsApp's official recovery instructions rather than relying on third-party recovery services or outdated advice about requesting deactivation by email.
Final WhatsApp Recovery Checklist
If your WhatsApp account has been hacked, start by identifying what kind of access the attacker may have gained.
If you've been logged out, re-register your phone number. If you're still logged in, check for unfamiliar linked devices. And if you've lost control of your SIM, contact your mobile carrier.
After recovering the account, review your messages and backups, warn anyone who may have received suspicious messages, and strengthen your security settings.
Above all, keep your verification credentials private and avoid services promising guaranteed recovery. When recovery instructions or security options change, the official WhatsApp Help Center is the best place to check the latest guidance.