WhatsApp Hacked? How to Check, Get Your Account Back and Report It
How to tell whether a WhatsApp account was taken over, the recovery steps WhatsApp gives, the settings it offers, and where to report it in India, Singapore and Malaysia.
For a WhatsApp message saying your number was registered on a new device, WhatsApp's recovery steps are to tap ‘Log back in’ and enter the six-digit code sent to your number, which it says logs out every other device using the account. If you're still logged in but something looks wrong, the place to look is Settings, then Linked devices.
How to tell what happened
You were logged out. Someone registered your number on their phone, which needs the six-digit code WhatsApp sends by SMS or call. Singapore Police described one way the code changes hands in a March 2026 advisory: a contact whose account is already hijacked says a code was ‘sent to you by mistake’ and asks for it.
You're still logged in, but Linked devices shows a browser or computer you didn't add. Someone has linked your account to WhatsApp Web or a desktop app. India's computer emergency response team, CERT-In, rated one such pairing-code method, known as GhostPairing, high severity in December 2025, PTI reported; the lure was a ‘check this photo’ message from a known contact. Tapping the device lets you log it out.
Your contacts get messages you didn't send, asking them for money or for a code. Singapore Police recorded at least 128 cases of this kind of impersonation and S$249,000 in losses from September to October 2026.
An older Indian variant goes through the phone line. A caller posing as telecom support asks you to dial a code starting with *401#, which the Department of Telecommunications warned in January 2024 activates unconditional call forwarding.
Getting the account back
- Put the SIM with your number in your phone. WhatsApp needs that number to send the code.
- Open WhatsApp, tap ‘Log back in’ (or reinstall it) and enter the code.
- If WhatsApp then asks for a two-step verification PIN or password you don't recognise, WhatsApp's help page says you wait seven days before you can register without it.
The same help page warns that reporting a compromised account can get it banned.
It also says WhatsApp can't tell you who accessed the account, when or from where, and that messages are stored on your device, so a phone that registers your number doesn't receive your old chats.
Settings WhatsApp offers
- Two-step verification (Settings, Account): a code of your own that WhatsApp asks for when the number is registered again. WhatsApp is moving it from a six-digit PIN to a password and lets you add an email address for resets.
- A passkey lets your fingerprint, face or screen lock replace the SMS code when you log in.
- Strict account settings switch on two-step verification, keep security notifications on and block large volumes of messages from unknown accounts. They can only be turned on from your main phone.
Where to report it
| Country | Official channel |
|---|---|
| India | The national helpline 1930 or cybercrime.gov.in, as the home ministry advises (our guide to the form) |
| Singapore | The government's ScamShield Helpline, 1799, listed in the police advisory |
| Malaysia | The National Scam Response Centre, 997, within 24 hours where money was lost, followed by the bank and a police report |
Malaysia's communications regulator, MCMC, has said an account takeover and a WhatsApp ban are two distinct matters and that complaints WhatsApp doesn't resolve can be taken to MCMC. Singapore's authorities have also warned about malware spreading through hijacked WhatsApp accounts.
This guide describes public rules and official procedures as the linked sources state them. It is general information, not legal or financial advice on your own case. Rules, deadlines and helpline details change, so check the linked official page before you act. See our terms of use.
More guides
DPDP Act 2023 and DPDP Rules 2025: Breach Duties for Security Teams, and When They Start
What India's DPDP Act and Rules ask after a personal data breach, which parts are in force, and how they sit next to CERT-In's six-hour reporting rule.
How to Check a Scammer's Phone Number or Bank Account in Malaysia
Check a phone number or bank account on the police Semak Mule portal, what ‘No Records Found’ does and doesn't mean, and the official steps if money has already gone.
Cyber Crime Complaint Online in India: The 1930 Helpline, cybercrime.gov.in and RBI Deadlines
How to report cyber fraud in India: what a 1930 call does, the National Cyber Crime Reporting Portal form, tracking a complaint, and the RBI reporting deadlines for bank customers.