Your friends are messaging you to ask why you sent them a strange link, you spotted a login alert from a country you've never visited, or you opened WhatsApp only to find your number signed out and a code you never requested sitting in your texts. A hijacked WhatsApp account feels personal because it is tied to your phone number and your closest contacts, and the attacker can impersonate you within minutes. The reassuring part is that recovery is usually fast and in your control. Because your account lives on your phone number, re-registering on your own phone instantly logs the intruder out, and your old conversations stay readable only on your own device.
Work through the actions below in order. The first steps fix the most common cases in a few minutes, the middle section covers what to do if a stolen PIN has you locked out, and the final steps seal the account so this does not happen again. Before you start, do everything on a phone, browser, and network you have used to sign in before, and confirm you are on the genuine faq.whatsapp.com domain before opening any Help Center link or entering anything sensitive.
Confirm the Compromise and Warn Your Contacts First
Take a moment to verify what is actually happening before you act. The clearest signs are messages your contacts received that you never sent, a notification that your number was registered on a new device, or being unexpectedly logged out of WhatsApp on your own phone. Any one of these means someone else has registered your number or gained access through a linked web session.
Tell your family and friends right away that your account may be compromised, because the person controlling it could impersonate you to ask them for money or codes. A quick heads-up through another channel protects the people most likely to be targeted. One warning before you do anything else: do not report the account you are trying to recover. WhatsApp states that if you report the compromised account you are trying to recover, it might ban it, and recommends trying to recover your account before reporting it. Never create a brand-new account to report the hacked one either, since that can complicate recovery of your real number.
If Your Phone or SIM Was Stolen, Block the SIM and Get a Replacement
If the takeover happened because your phone or SIM card was physically taken, your number is the key to everything, so secure it first. WhatsApp is direct that it is not possible to recover an account without a SIM card carrying the same phone number as your account. There is no email or form to disable the account from afar, and WhatsApp confirms it cannot deactivate your account for you because there is no way to verify that you are the owner of the phone number.
- 1.Call your mobile provider as soon as possible and ask them to block your SIM card.
- 2.Request a new SIM card with the same phone number.
- 3.Activate your new SIM card and insert it into your device.
Once you hold a working SIM with your original number, you can move on to re-registering. If your phone was never lost and only the account was hijacked remotely, you can skip straight to the next step.
Re-Register Your Number to Kick the Hacker Out
This is the fastest and most important action, and for most people it resolves the entire problem on its own. Re-registering on your own phone forces every other device off your account immediately. WhatsApp confirms that when you re-register your account with the 6-digit code, all devices logged into your account are automatically logged out.
- 1.Open WhatsApp on your phone.
- 2.Enter your full phone number in international format.
- 3.Enter the 6-digit code you receive via SMS or phone call.
That single code does the heavy lifting. The moment you enter it, the attacker device is signed out and your number is back under your control. There is no separate recovery tool, support form, or support email to contact, and re-registration with the 6-digit code is the official path. Never share that registration code with anyone, by message or by call. Real support will never ask for it, and anyone who does is trying to take over your number.
You can also relax about your message history. WhatsApp notes that messages are stored on your device, so someone re-registering your account on a new device cannot read your past conversations. The intruder could send messages as you, but your existing chats were never visible to them.
When You Are Asked for a Two-Step Verification PIN You Don't Know
WhatsApp two-factor protection is called two-step verification, an optional 6-digit PIN. During re-registration you may be prompted for it. If you set this PIN yourself and remember it, simply enter it and you are finished. The complication arises when you are asked for a PIN you never created.
As WhatsApp explains, you might be asked to enter a two-step verification PIN, and in rare cases someone else using your account might have enabled it. If you do not have the PIN, you wait 7 days and try again. Your options depend on whether you previously added a recovery email.
- 1.If you added a recovery email to two-step verification earlier, WhatsApp emails you a reset link so you can reset the PIN immediately and continue.
- 2.If you never added an email, lost access to it, cannot receive the SMS code, or someone else enabled the PIN on your number, you must wait 7 days and try again.
The 7-day window sounds painful, but it works in your favor. WhatsApp states that no one can access your account during the 7-day wait period, and that period begins from the last time the account successfully connected to WhatsApp. So even while you wait, the attacker is locked out too. The most reassuring detail is that whether you know the PIN or not, anyone using your account is automatically logged out after you enter the 6-digit SMS code. Deleting or reinstalling WhatsApp does not remove the PIN, so do not waste time trying that.
Review Linked Devices and Sign Out Anything You Don't Recognize
Re-registering handles the main account, but an attacker may also have connected through WhatsApp Web or a linked device. WhatsApp advises that it is important to check your linked devices regularly, and if you believe someone has access to your account through WhatsApp Web, you can log out of all your active web sessions from your phone.
- 1.Open WhatsApp settings on your phone.
- 2.Go to Linked Devices.
- 3.Review the list and remove any device or web session you do not recognize.
If anything looks unfamiliar, log out of all sessions to be safe. Make this a periodic habit even after recovery, since linked-device access is an easy thing to overlook.
Turn On Two-Step Verification With a Recovery Email
With control restored, the priority becomes making sure no one can re-register your number behind your back. WhatsApp recommends that you turn on security features to protect your account. The core control is two-step verification, so enable the optional 6-digit PIN and provide an email address in case you forget your PIN.
That email is what saves you next time. WhatsApp explains that it allows the service to email you a reset link if you ever forget your PIN, and also helps safeguard your account. With the PIN active, no one can register your number on a new device without entering it, which closes off the most common takeover route. WhatsApp will regularly ask you to enter your PIN as a reminder, roughly once a week, so choose something you will remember. There is no separate backup codes feature in WhatsApp, so the recovery email is your safety net.
Guard Against the Next Takeover Attempt
A few habits keep your account out of reach going forward. The single most important rule is to keep your codes private. WhatsApp guidance is plain that you should never share your registration code or two-step verification PIN with others. No legitimate person or service will ever need them, and handing them over is exactly how accounts get stolen.
Watch for the warning signs of an attempt in progress, too. WhatsApp cautions that if you receive unrequested emails to reset your two-step verification PIN or registration code, you should not click on any links. That kind of message is a strong signal that someone is trying to take over your number. Avoid any paid third-party account recovery service, because official recovery is free and runs entirely through your own phone and the genuine WhatsApp Help Center. If you do confront a compromise again, notify family and friends early, since the person in control could impersonate you.
For reference, the official WhatsApp Help Center pages covering compromised, lost, and stolen accounts, two-step verification, and security are at faq.whatsapp.com/1131652977717250, faq.whatsapp.com/general/account-and-profile/stolen-accounts, faq.whatsapp.com/1007324800132703, faq.whatsapp.com/2183055648554771, faq.whatsapp.com/1278661612895630, faq.whatsapp.com/1428782138011916, and faq.whatsapp.com/1095301557782068. Confirm you are on that genuine domain before entering any credentials or uploading identification.
Frequently Asked Questions
How fast does re-registering actually remove the hacker?
Immediately. WhatsApp confirms that when you re-register your account with the 6-digit code, all devices logged into your account are automatically logged out. The moment you enter the code on your own phone, the attacker device loses access.
Can the hacker read my old WhatsApp conversations?
No. WhatsApp stores your messages on your device, so someone who re-registers your number on a new phone cannot read your past conversations. They could send new messages while in control, which is why warning your contacts matters, but your existing chat history was never exposed to them.
What if I am asked for a two-step verification PIN I never set up?
In rare cases, the person who took over your account enabled the PIN. If you previously added a recovery email, WhatsApp emails you a reset link so you can reset it right away. If you did not add an email, you must wait 7 days and try again, and no one can access the account during that wait.
Is there a WhatsApp support email or form to recover my account?
No. There is no named recovery tool, support form, or support email for this. Recovery happens by re-registering your number with the 6-digit SMS or call code on your own phone. WhatsApp also states it cannot deactivate your account for you, because it has no way to verify you own the number remotely.
Should I report the hacked account right away?
Not first. WhatsApp warns that reporting the compromised account you are trying to recover might get it banned, and recommends recovering it before reporting. Re-register and secure the account first, and never create a new account just to file a report against your real one.
What stops this from happening again?
Turn on two-step verification and add a recovery email. The optional 6-digit PIN blocks anyone from re-registering your number without it, and the email lets WhatsApp send you a reset link if you forget the PIN. Never share your registration code or PIN with anyone, and ignore any unexpected reset emails or paid recovery services.
