Quick answer: Most WhatsApp accounts in India get taken over the same way: someone tricks you into sharing the 6-digit SMS code, or into entering a "pairing code" on a fake website. Turn on two-step verification (Settings → Account → Two-step verification), add a passkey, check Linked devices for anything you don't recognise, and switch on Silence unknown callers and Protect IP address in calls. Never share any WhatsApp code with anyone, even a friend who asks.
Your WhatsApp is probably the most valuable app on your phone. It has your family groups, your office chats, photos of your Aadhaar card, and the trust of every person in your contact list. That last part is exactly why scammers want it.
When someone takes over a WhatsApp account, they rarely care about reading old messages. They message your contacts as you: "I'm stuck, can you send ₹5,000 on UPI? Will return tonight." Your friends see your name and photo, and many of them pay.
The good news is that WhatsApp already has the settings to stop almost all of this. Most people just never turn them on. Here are the ten worth changing today, in order of importance. The whole list takes about ten minutes.
How WhatsApp accounts actually get hacked
Before the settings, it helps to know the two tricks behind most takeovers. Once you can spot them, you're already safer.
1. The "I sent you a code by mistake" trick. Someone tries to register your number on their phone. WhatsApp sends a 6-digit code to you by SMS. Then a message arrives, often from a friend's hacked account: "Sorry, I sent my code to your number by mistake, please forward it." The moment you share it, they log in as you.
2. The fake photo or voting link (GhostPairing). A message from a known contact says something like "Hey, I found your photo!" with a link. The page looks like a Facebook login and asks for your phone number, then shows a short code and tells you to enter it in WhatsApp to "verify". That code actually links the scammer's computer to your account as a linked device. Security researchers have called this attack GhostPairing. Your phone keeps working normally, so you may not notice anything for days.
The rule that beats both: a WhatsApp code is like your UPI PIN. Nobody else ever needs it.
The 10 WhatsApp settings to change today
The steps below are for both Android and iPhone. On Android, Settings is under the three dots (⋮) at the top right; on iPhone, it's the Settings tab at the bottom.
1. Turn on two-step verification
This is the single most important setting. Even if a scammer gets your SMS code, they can't log in without the PIN or password you set here.
Go to Settings → Account → Two-step verification → Turn on. Create your PIN, then add an email address so you can reset it if you forget.
WhatsApp has started replacing the old 6-digit PIN with a full password that can use letters, numbers and symbols. If your app offers the password option, use it. Whatever you choose, don't use 123456, your birthday or your car number. WhatsApp itself has specifically warned people still using 123456.
2. Add a passkey
A passkey lets you log in to WhatsApp with your fingerprint, face or screen lock instead of an SMS code. A scammer can trick you into sharing a code, but they can't trick you into sharing your fingerprint.
Go to Settings → Account → Passkeys and follow the steps. If you use WhatsApp on both an Android phone and an iPhone, you can now add a separate passkey for each.
3. Check your linked devices right now
This takes ten seconds and catches the GhostPairing trick.
Go to Settings → Linked devices. You'll see every computer and browser that can read your chats, with when each was last active. If you see anything you don't recognise, such as a "Chrome on Windows" when you only use your phone, tap it and choose Log out.
Make this a habit: check it once a month, and every time a friend tells you they got a strange message "from you".
4. Silence unknown callers
Scam calls on WhatsApp, including fake "police" and "digital arrest" video calls, almost always come from numbers you haven't saved.
Go to Settings → Privacy → Calls and turn on Silence unknown callers. Those calls won't ring your phone, but they still appear in your Calls tab, so you won't miss a genuine call from a delivery person or a new colleague. You can check and call back if it's someone you expected.
On Android, WhatsApp now also shows more details when a stranger calls, such as whether the number is from another country and whether you share any groups. A foreign number you've never spoken to, calling about an "urgent" problem, is a red flag.
5. Protect your IP address in calls
During a normal WhatsApp call, your phone can connect directly to the other person's phone, which can reveal your approximate location to a determined scammer.
Go to Settings → Privacy → Advanced and turn on Protect IP address in calls. Your calls are then relayed through WhatsApp's servers. They stay end-to-end encrypted. The only trade-off is that call quality may drop slightly, which most people never notice.
6. Stop strangers adding you to groups
Ever been added to a "stock tips" or "work from home, earn ₹5,000 a day" group you never joined? That's how many investment and task scams in India begin.
Go to Settings → Privacy → Groups and choose My contacts (or My contacts except…). Now only people you've saved can add you. Everyone else has to send you an invite, which you can ignore.
7. Hide your profile photo and "last seen" from strangers
Scammers use your profile photo to create a fake account in your name, and your "last seen" to work out when you're asleep or busy.
Go to Settings → Privacy and set Profile photo, Last seen and online and About to My contacts. While you're on that screen, you may see a Privacy checkup banner. Tap it: it walks you through the main privacy settings in one go.
8. Block messages from unknown accounts
If you get a lot of spam from numbers you don't know, go to Settings → Privacy → Advanced and turn on Block unknown account messages. When an unknown account sends you an unusually large number of messages, WhatsApp blocks them automatically.
9. Turn on security code notifications
Every chat has a security code that changes when the other person reinstalls WhatsApp or switches phones. A sudden change can mean their account was taken over.
Go to Settings → Account → Security notifications and turn it on. You'll see a small note in the chat when a contact's code changes. It's usually innocent (a new phone), but if that same contact then asks for money, call them on a normal phone call before you do anything.
10. Lock your most private chats
If someone else uses your phone, even for a minute, Chat lock keeps sensitive chats hidden behind your fingerprint or face.
Long-press a chat (Android) or swipe left on it (iPhone), tap Lock chat, and confirm. Locked chats move to a separate folder at the top of your chat list. For chats where you share documents like Aadhaar or bank details, consider turning on disappearing messages too, so they don't sit on the phone forever.
For journalists and public figures: Strict Account Settings
If you're at higher risk, for example a journalist, activist or someone in the public eye, WhatsApp has a lockdown-style mode called Strict Account Settings. It switches several settings to their most protective values in one tap and blocks attachments and media from people who aren't in your contacts.
Look for it under Settings → Privacy → Advanced. It's being rolled out gradually, so it may not appear on every phone yet. Most people don't need it; the ten settings above are enough.
What to do if your WhatsApp has already been hacked
Act fast. The first hour matters most.
- Reinstall and log in again with your number. Open WhatsApp, enter your phone number and verify with the SMS code. This logs the scammer out of the main account. If they had set up two-step verification, you may need to wait before you can get fully back in, but they also lose access.
- Log out of every linked device. Go to Settings → Linked devices and log out of everything you don't recognise.
- Warn your contacts immediately. Post a status and message your close family groups: "My WhatsApp was hacked. Don't send money to anyone asking from my number."
- Turn on two-step verification and a passkey as soon as you're back in.
- Email WhatsApp support (support@whatsapp.com) with "Lost/Stolen: Please deactivate my account" and your full number with country code (+91), if you can't get back in.
- If anyone lost money, call the national cyber fraud helpline 1930 straight away and file a complaint at cybercrime.gov.in. Speed improves the chance of freezing the money.
You can also report suspicious numbers that messaged you on Chakshu, on the government's Sanchar Saathi portal.
The settings checklist
- Two-step verification: on, with a strong PIN or password and a recovery email
- Passkey: added
- Linked devices: checked, unknown ones logged out
- Silence unknown callers: on
- Protect IP address in calls: on
- Groups: My contacts
- Profile photo, last seen, about: My contacts
- Block unknown account messages: on
- Security notifications: on
- Chat lock: on for your most private chats
AI is making these scams more convincing, from cloned voices to fake video calls. If you're curious how attackers are using AI tools, read what happened when three Indians used Claude to find security holes in OpenAI. And if you're starting to use AI assistants that can pay for things, keep our 9 safety rules before you let an AI agent spend your money handy.
Frequently asked questions
Can someone hack my WhatsApp with just my phone number?
Not on its own. They also need the 6-digit code WhatsApp sends to your phone, or a pairing code you enter yourself. That's why every takeover involves tricking you into sharing a code. With two-step verification on, even the code isn't enough.
Someone sent me a WhatsApp code by mistake. What should I do?
Nothing. Don't forward it to anyone, even if the request comes from a friend's number. The code is for your account, and sharing it lets the other person log in as you. Ignore the message and turn on two-step verification.
How do I know if someone else is using my WhatsApp?
Check Settings → Linked devices for computers or browsers you don't recognise. Other signs: messages marked as read that you didn't open, sent messages you didn't write, or friends asking about strange requests "from you".
Does two-step verification mean I'll need a PIN every time I open WhatsApp?
No. WhatsApp only asks for it when you register your number on a phone, plus an occasional reminder so you don't forget it. Day-to-day use doesn't change.
Is Protect IP address in calls worth turning on?
For most people, yes. It hides your approximate location from people you call, and calls stay end-to-end encrypted. The only downside is that call quality can be slightly lower.
Where do I report a WhatsApp scam in India?
If you lost money, call 1930 immediately and file a complaint at cybercrime.gov.in. If you didn't lose money, report the number on Chakshu (sancharsaathi.gov.in) and use Report inside WhatsApp to block the account.
Final word
WhatsApp scams don't work because people are careless. They work because the message comes from someone you trust, at a moment when you're busy. You can't control what lands in your inbox, but you can make sure a stolen code is useless and a strange device gets spotted early. Spend ten minutes on these settings today, then do the same for your parents' phone. That second part might be the most useful thing you do this week.
