How to Protect Your WhatsApp From OTP Scams and Hijacking

WhatsApp hijacking is one of the most common online scams in Nigeria. Someone takes over your account, then messages your contacts pretending to be you, usually asking for urgent transfers. The scam almost always depends on one thing: getting you to share the 6-digit code WhatsApp sends to your phone. Once you understand how it works, it is easy to stop.

How the takeover works

Anyone can type your phone number into WhatsApp on their own phone. WhatsApp then sends a verification code to your SIM. If the scammer can get that code from you, they register your number on their device and you are logged out. They now read new messages and can chat to your contacts as you.

Common messages scammers use

• "I sent my code to your number by mistake, please forward it." Often sent from a friend's account that was already hijacked, so it looks genuine.
• Fake WhatsApp support claiming your account will be suspended unless you "verify" with the code.
• Prize or promo messages asking you to confirm a code to claim a gift, airtime or data.
• Calls from "your bank" or "the network" asking you to read out a code you just received.

The rule is simple: a code sent to your phone is only for you. WhatsApp, banks and networks never ask for it.

Five settings that protect your account

1. Turn on two-step verification

Go to Settings, Account, Two-step verification and create a 6-digit PIN. Even if someone gets your SMS code, they also need this PIN to register your number. Add an email address so you can reset the PIN if you forget it.

2. Add a passkey or email to your account

Newer versions of WhatsApp let you add an email address and, on supported phones, a passkey to your account. These give you extra ways to verify that are tied to you, not just your SIM.

3. Lock the app

Use fingerprint or face unlock for WhatsApp (in Privacy settings) so someone holding your phone cannot read or forward codes.

4. Check linked devices

Under Linked devices you can see every computer or tablet logged in to your account. Log out of anything you do not recognise.

5. Hide your number where you can

Scammers find targets in big public groups. For business or public-facing use, many people use a separate number so their personal line is not exposed. A virtual number can work for that, and our guide to getting a foreign WhatsApp number explains how to set one up safely.

If your account has already been taken

1. Reinstall or open WhatsApp on your phone and verify your number again. When the code arrives on your SIM, enter it. This logs the scammer out.
2. If you are asked for a two-step PIN you did not set, the scammer set it. You may have to wait for the waiting period WhatsApp shows before you can register again without it.
3. Warn your contacts through other channels that messages from your account are not from you.
4. Email WhatsApp support from the app or their help centre to report the account as stolen.

The same rule protects your other accounts

Banks, email and social media all use the same kind of codes. Treat every OTP like a password, and switch important accounts to an authenticator app where possible. If OTPs are not arriving at all, see nine fixes for missing OTP codes.