My WhatsApp was hacked: what to do now and how to get it back

How attackers get into WhatsApp

National CERTs and police describe two routes. Both start with the attacker getting a code that belongs only to you.

1. They link their own device to your account. A message arrives from someone you know: "Can you vote for me in this contest?" The link opens a fake page that asks for your phone number and then a code, or tells you to scan a QR code in WhatsApp. What you're actually doing is linking your account to the attacker's computer – the same way you'd set up WhatsApp on a laptop. Slovakia's SK-CERT warned on 6 October 2026 that this campaign is spreading again. Hong Kong's HKCERT describes the same trick dressed up as a "locked account" and a fake "WhatsApp Security Centre".
2. They take over the account completely. The attacker gets you to send them the registration code from a text message – often claiming they sent it to you "by mistake". They register WhatsApp with your number on their phone and you get logged out. Czech police warn the attacker can then change the access details and lock you out.

With the first route, WhatsApp carries on working as normal, so you may not notice anything. Meanwhile the attacker reads your conversations, can download your chat history and messages your contacts.

Czech police say attackers first read through old chats so they sound convincing, then message contacts in bulk asking for a quick loan – a car repair, an overdue bill, a card lost abroad – sometimes with a QR code to pay. They push for speed and ask people not to call. In one Czech region, police recorded more than ten cases with total losses over 400,000 Czech crowns within a few days in February 2026.

What to do right now (in this order)

If you also typed a password for another service into the fake page, follow I entered my details on a phishing site. For other hacked accounts (email, Facebook, Instagram), see My account was hacked.

A friend asked you for money on WhatsApp?

It may be coming from a hijacked account.

• Check another way, ideally by calling the number you already know – not by replying in the same chat.
• Never send money based only on a message in an app.
• Don't open voting, poll or contest links, even from friends. If you're unsure, check the link without opening it in our link checker. Our guide How to spot a fake link shows what to look for in the address. "You've won" messages from friends are after the same code – see Fake prize giveaway scam.
• Tell the account owner their account has been taken over – they probably don't know.

A similar scam arrives from an unknown number: the "Hi Mum, new number" scam. The difference is that here the message comes from the real account of someone you know, which is what makes it so convincing.

Where to report it

• You lost money: call your bank first to try to stop the payment, then the police. In the US, also report it at ReportFraud.ftc.gov.
• A scam link or text: in the UK, the NCSC explains how to report scam texts (forward them to 7726); the same number works in the US. Our link checker prepares a short report you can copy for a suspicious address.
• In the app: report and block the scam account or message.

How to protect yourself

• Turn on two-step verification with a password you don't use anywhere else. Since August 2026, WhatsApp also supports passkeys – signing in with your fingerprint, face or screen lock (Settings → Account → Passkeys).
• Check Linked devices now and then, as HKCERT and Czech police recommend. Log out anything you don't recognise.
• Only scan a QR code or type a "link with phone number" code when you're linking your own computer. Never because a website or message told you to. More in QR code scams.
• Tell your family. Fake vote links spread precisely because they come from people you know.