A six-digit WhatsApp verification code lands on your phone, but you did not ask for one. A minute later, a “friend” messages you: “Sorry, I sent my code to your number by mistake. Can you forward it to me?” It feels harmless. It is not. That code is the key to your WhatsApp account, and handing it over lets a scammer lock you out, impersonate you, and target everyone in your contacts.
This scam is surging again in November 2026. Security researchers have flagged fresh waves of verification-code theft across the US, UK and Canada, and the trick keeps working because it arrives from an account you already trust — usually a friend whose account was stolen the same way. The fix takes less than five minutes.
What Is the WhatsApp Verification Code Scam?
WhatsApp ties your account to your phone number. When someone registers your number in WhatsApp on a new phone, WhatsApp sends a six-digit verification code by SMS. Whoever enters the code completes the registration — and the previous phone is logged out.
Scammers exploit this simple system. They type your phone number into WhatsApp on their own device, which triggers a real code to your phone. Then they contact you — often from a hijacked friend’s account — with a believable excuse and ask you to send them the code. The moment you share it, they finish registering your number on their phone. Your WhatsApp logs out, and they now control your account.
How the WhatsApp Verification Code Scam Works
Understanding the sequence makes it easy to spot. The scam almost always follows the same four steps.
Step 1: The scammer enters your number
The scammer opens WhatsApp on their phone and starts registration using your phone number, found on social media, in a leaked database, in a group chat, or from a previous victim’s contact list. WhatsApp immediately sends a six-digit code to your phone by SMS.
Step 2: The code arrives on your phone
You receive a text from WhatsApp with a six-digit code. The message itself warns you not to share the code — but most people skim past that warning. If you did not request a code, it means someone typed your number into WhatsApp. On its own, it does not mean your account is taken. The danger starts with what happens next.
Step 3: The “friend” asks for the code
Moments later, you get a WhatsApp message, often from a contact you know, saying something like: “Hi, I accidentally sent my WhatsApp code to your number. Can you forward it to me?” It feels urgent and slightly embarrassing — which is exactly the point. Urgency stops you from thinking.
Step 4: You share the code — and the scammer takes over
If you forward the code, the scammer enters it on their phone and completes registration. WhatsApp logs you out instantly, and you lose access to your chats, groups, and profile. Now in control of your account, the scammer messages your contacts as you — repeating the same trick to steal more accounts, asking for money with urgent excuses, or sending links to fake giveaways and phishing pages. In some 2026 cases reported in Europe, victims lost several hundred euros each to money requests sent from hijacked accounts. The cycle continues until someone reports the account and it is shut down.
What to Do Right Now If You Got a Code You Didn’t Request
If a WhatsApp code arrived and you did not ask for it, do these things in order.
1. Do nothing with the code
Do not enter the code anywhere, and never share it with anyone who asks — not a friend, not a family member, and never anyone claiming to be WhatsApp support. WhatsApp will never ask you to send your registration code or your two-step verification PIN to anyone. Anyone who asks is running the scam.
2. Check your WhatsApp
If WhatsApp is still working normally on your phone, you are fine. An unexpected code by itself does not prove your account was taken — it can also result from a mistyped number. Open WhatsApp, confirm you are still logged in, and move on to step 3. Do not call back unknown numbers attached to the message, and do not click any link in it.
3. Turn on two-step verification
This is the single most important protection, and it takes under a minute. Two-step verification adds a six-digit PIN that WhatsApp asks for whenever your number is registered on a new phone. Even if someone gets your SMS code, they cannot finish registration without the PIN.
On iPhone, go to Settings, then Account, then Two-step verification, then Turn On. On Android, tap the three-dot menu, then Settings, then Account, then Two-step verification, then Turn On. Choose a six-digit PIN you will remember and add an email address so you can reset the PIN if you forget it.
4. Warn the contact who messaged you
If the request came from a friend’s account, reach that friend another way — a phone call on the number saved in your phone, or a different app. Their account may be hijacked. Do not reply inside the suspicious chat, and do not use a phone number given in the message itself.
5. Block and report the sender
Inside WhatsApp, open the suspicious chat, tap the contact or group name, and use Block and Report. This flags the account to WhatsApp and stops further messages. If the message came as a voice note — a newer variation sometimes uses a cloned voice — the same rule applies: never send a code, money, or a screenshot, and verify the person with a live call on the number already saved in your phone.
What to Do If You Already Shared the Code
If you forwarded the code and lost access, act immediately. The scammer will start messaging your contacts within minutes.
1. Re-register your number
Open WhatsApp on your phone with your SIM card inside, tap to log back in, enter your phone number, and type the new six-digit code that arrives by SMS. Re-registering logs the attacker out of every device automatically.
2. Deal with the two-step PIN problem
If the scammer enabled two-step verification before you got back in, WhatsApp may make you wait up to seven days before you can continue without the PIN. Contact WhatsApp support at support@whatsapp.com with your phone number in full international format while you wait.
3. Check your linked devices and warn your contacts
Once you are back in, go to Settings, then Linked Devices, and log out of any session you do not recognise. Then turn on two-step verification immediately and add a recovery email. Tell your friends and family that your account was hijacked and that any money requests or strange links sent from your number were not from you. A quick group message or status update can stop the chain.
4. Report any money lost and keep evidence
If you or anyone you know lost money, report it to your local police or cybercrime authority. In the United States, report to the FBI’s Internet Crime Complaint Center at ic3.gov and to the Federal Trade Commission at ReportFraud.ftc.gov. Keep screenshots of the messages and the code request for your report. Never pay an “account recovery service” that demands money, personal information, or verification codes — regulators warn these are scams layered on top of the original one.
You can also learn to recognise the same tricks in email with our guide on how to spot a phishing email in 2026, since scammers reuse the same urgency tactics across every channel. And if your phone itself has been feeling slow, our 12 proven fixes to speed up your laptop in 2026 cover the same habit of keeping your devices clean and up to date.
Red Flags That Expose the WhatsApp Verification Code Scam
Keep this checklist in mind. Any one of these signs should make you stop and verify before you act.
- A verification code arrives that you did not request, followed by anyone asking you to share it.
- A message from a friend asks for a code, a PIN, or a one-time password. Real friends do not need your WhatsApp code.
- The request feels urgent — “quick, I need it now.” Urgency is the scammer’s favourite tool.
- The message claims to be from WhatsApp support or a delivery company and asks you to forward a code or click a link.
- A voice note asks for a six-digit code, even if the voice sounds exactly like someone you know. AI voice cloning makes this trick cheaper every year.
- A QR code or poll link arrives in the same conversation. German police documented a 2026 wave using fake poll links and QR codes alongside code theft.
A WhatsApp code is meant for you alone. If someone asks you to send it, forward it, or read it out, that request is the scam — no matter who it seems to come from.
The Bottom Line
The WhatsApp verification code scam works because it looks like a favour for a friend. In reality, the six-digit code is the only thing standing between a scammer and your entire WhatsApp account — your chats, your groups, and your contacts’ trust. Never share it with anyone, turn on two-step verification today, and check your linked devices once a month. If a code you did not request ever arrives, do nothing with it, warn the contact through another channel, and report the sender.