Do not share that WhatsApp code
“I sent you a code by mistake. Can you send it to me?”
The message comes from someone you know. It has their photo, their name and the familiarity of earlier conversations. It is easy to want to help without thinking too much about it.
That is where the problem starts: a message from that number does not prove the same person is still behind it. If someone has taken over their account, they may be using that familiarity to try to get into yours.
What phishing means
The word sounds more complicated than the situation. It is a trick in which someone pretends to be a person or organisation you trust to obtain information they should not have. It can arrive through a message, an email or a page that imitates a real one. NIST definition.
On WhatsApp, the request may be presented as a favour, a vote or a security warning. Before judging how well the message is written, look at what it asks you to do. A request for an access code, a password or permission to connect a device is a reason to pause the conversation.
The code you receive and the extra protection you choose
The registration code is used to register your number with WhatsApp. Sharing it may allow someone else to try to set up your account on their phone. Do not forward it to a friend or to someone claiming to work in support. Use it within the official process you started yourself.
Two-step verification adds another check. It is part of what we often call two-factor authentication, or 2FA: not relying on a single check to grant access. On WhatsApp, this protection may ask for a PIN or password you set up, in addition to registering the number. WhatsApp on registration and two-step verification.
There is a change to keep in mind: WhatsApp has announced that it is moving from a six-digit PIN to a password. If your account still shows a PIN, follow the official options in your version of the app to update it. The code you receive and the PIN or password you choose have different purposes. Neither should be shared. WhatsApp update.
A quick check inside the app
Open WhatsApp yourself and look for Settings → Account → Two-step verification. Check which protection you have enabled and follow the app's instructions. If it allows you to add a recovery email, use one you own and can access, and keep it protected.
Then look at Linked devices. If you see a device you do not recognise, log that device out. Linking a device grants another way into the account: do not scan a QR code or approve a link just because a chat asks you to. Meta has warned about scams that use this very step. WhatsApp device-linking warnings, how to unlink a device.
Enabling a security feature does not make every message genuine. If someone urgently asks for money, confirm the request through another contact method you already had before making a transfer.
If you have already shared something
If you still have access, review your linked devices and account security settings. If you have lost access, start recovery in the official app and follow WhatsApp's help. It may ask for your two-step verification PIN or password, or specify a waiting period. Recovery is not always immediate. Let your contacts know through another channel so they can be wary of requests made in your name. Recovering a compromised account.
If there has been a fraudulent transfer, contact your bank as soon as possible through its official channel. If your mobile line has stopped working, contact your carrier. Keep the evidence and report the incident; do not pay someone who messages you promising to recover the account.
You can start with one thing today: open the app and check two-step verification. Looking after that account also helps protect the people who trust the messages they receive from you.
Ronald Barrios