Lakewood Shomrim and other organizations are alerting WhatsApp users to a rise in attempts by fraudsters to steal accounts, with scammers tricking users into sharing SMS verification codes, allowing them to hijack accounts.
The scam involves fraudsters contacting users, often posing as WhatsApp customer support, and asking them to forward a six-digit verification code sent via SMS. This code is actually a registration code requested by the scammer, attempting to take over the user’s account. In some cases, scammers who already took over a user’s WhatsApp account then contact those person’s contacts, asking for their verification code, creating a snowball effect of stolen accounts.
WhatsApp emphasizes the importance of keeping verification codes secret, stating that sharing them can lead to account takeover. If a scammer gains control, they can access future messages and impersonate the user.
To secure your account, WhatsApp advises:
- Never share your verification code with anyone, including friends and family
- Enable two-step verification
- Restrict who can view your profile photo
If your WhatsApp account was stolen, sign into WhatsApp with your phone number and re-register by entering the 6-digit code you receive via SMS or phone call.
Once you’ve re-registered your WhatsApp account using the 6-digit code, the individual using your account is automatically logged out of your account. WhatsApp can only be registered with one phone number at a time. You might also be asked to enter a two-step verification PIN. If you don’t know it, the individual using your account might have enabled two-step verification. You must wait 7 days before you can sign in without the two-step verification PIN.
Once you’ve recovered your account, we recommend increasing security on your device, by configuring two-step verification, a passcode, fingerprint access, or another security option available for your device.