WhatsApp Hacked? Verification Code Scams Explained

Two WhatsApp scams catch out thousands of people across the UK. The first is a message from an unknown number saying "Hi Mum, this is my new number, I dropped my phone" (or Dad, Gran or a friend), which soon turns into an urgent request for money. The second starts with a text containing a WhatsApp verification code you didn't ask for, followed by a message from a friend saying "Sorry, I sent you my code by mistake, can you send it back?"

If you've received either, here's what's going on, what to do, and how to get your account back if it's been taken over.

How the Scams Work

The "Hi Mum" Scam

A scammer messages from an unknown number pretending to be a family member who has lost or broken their phone. They chat for a while, then ask for help paying an urgent bill, often saying their banking app isn't working on the new phone. The payment goes to the scammer's account.

The Verification Code Scam

WhatsApp sends a six-digit code by text whenever someone sets up an account on a new phone. Scammers start setting up your number on their phone, which sends the code to you. Then they message you, often from a friend's account they've already taken over, asking you to forward the code. If you do, they take over your account, lock you out, and use it to scam your contacts, and the cycle continues.

If You Get a "Hi Mum" Message

1. Don't reply with money or personal details.
2. Call the person on their old number, or ask someone else in the family to contact them. If it really is them with a new phone, nothing is lost by checking.
3. If you can't reach them, ask a question only they would know the answer to. Scammers avoid voice and video calls, which is a red flag in itself.
4. Block and report the number in WhatsApp: open the chat, tap the contact's name or number at the top, then choose Block and Report.

If Someone Asks for Your Code

1. Don't send it. Delete the text.
2. Contact the friend who asked by phone call, not WhatsApp. Their account has probably been taken over, and they need to know.
3. Turn on two-step verification (see below) so this can't happen to you.

If Your WhatsApp Has Been Hacked

Signs include being logged out with a message such as "Your phone number is no longer registered with WhatsApp on this phone", or friends telling you they've had strange messages from you.

1. Reinstall or open WhatsApp on your phone and sign in with your phone number.
2. Enter the six-digit code WhatsApp texts you. Verifying your number logs the scammer out, because WhatsApp can only be active on one phone number's primary device at a time.
3. If you're asked for a two-step verification PIN you didn't set, the scammer has set one to keep you out. You won't be able to get in straight away. WhatsApp's help pages explain the options, which include resetting the PIN by email if one was registered, or waiting a set period before you can log in without it. The scammer is still logged out once you've verified your number by text.
4. Warn your contacts by text, phone or social media that your account was taken over and not to send money or codes.
5. Contact WhatsApp support through the in-app help or the contact form on WhatsApp's website if you can't regain access.
6. Check linked devices once you're back in: Settings > Linked Devices. Log out of any computer or browser you don't recognise.

Turn On Two-Step Verification

This is the single most important step to protect your WhatsApp. It adds a PIN that's needed whenever your number is registered on a new phone, so a stolen code alone isn't enough.

1. Open WhatsApp and go to Settings > Account > Two-step verification.
2. Tap Turn on (or Create PIN).
3. Choose a six-digit PIN you'll remember but others won't guess. Avoid birthdays.
4. Add an email address, so you can reset the PIN if you forget it.

If You've Already Sent Money

1. Call your bank immediately using the number on the back of your card, or call 159, which connects you securely to most major UK banks.
2. Report it to Report Fraud (formerly Action Fraud) online or on 0300 123 2040 (in Scotland, report to Police Scotland on 101).
3. Keep the messages as evidence. Take screenshots before blocking the scammer.

You can also forward scam text messages to 7726, a reporting service run by UK mobile networks.

When to Get Help

If a parent or grandparent has been targeted, or you'd like someone to check WhatsApp, email and banking security across the family's phones, our tech help for seniors is patient, practical and done at your pace. Our DBS-checked engineers can also help with phones, computers and accounts more generally. Much of this can be done through remote support, and Senri Home visits homes across West and South West London seven days a week, 8am to 9pm. Book a visit or call or WhatsApp 07826 399715.

Related Reading

• How to Spot Scam Calls, Texts and Emails
• Fake Virus Warning Pop-Up? Don't Call the Number
• How to Set Up an iPad for an Elderly Parent