How to Secure WhatsApp: Two-Step, Linked Devices, Privacy

WhatsApp accounts are stolen with one six-digit code, usually by asking the owner for it. They are protected with another six-digit code that the owner sets. To secure WhatsApp, that second code is the whole game, and it is one menu away. Everything else in this guide is useful; that one is essential.

Menu paths below are for the current Android and iPhone apps. Where a label may differ by version, we say "under Settings, look for". Do the first three sections now; they take under ten minutes.

Step 1: secure WhatsApp with two-step verification

WhatsApp → Settings → Account → Two-step verification → Turn on. Choose a six-digit PIN that is not your phone's unlock code and not your ATM PIN. Add an email address when asked; it is the only recovery route if you forget the PIN. WhatsApp will ask for this PIN occasionally, so you remember it.

Why this matters: when anyone registers your number on a new phone, WhatsApp sends a six-digit SMS code to your SIM. Scammers get that code by SIM swap, by malware that reads SMS, or most often by simply asking you for it while pretending to be a friend, a courier or "WhatsApp support". With two-step on, the SMS code alone is not enough. The thief also needs your PIN, and it is not in any message.

Step 2: linked devices and the sessions you forgot

WhatsApp → Settings → Linked devices. This lists every computer, tablet and browser logged into your account. Anything you do not recognise, tap and log out. A linked device keeps working for weeks without the phone being online, which is how an ex, a colleague or an internet-cafe computer keeps reading your chats long after you walked away.

Check this list once a month, and immediately after using WhatsApp Web on any machine that is not your own. Never scan a WhatsApp Web QR code that someone else shows you or sends you; scanning it links their device to your account.

Step 3: privacy settings that shut the door on strangers

WhatsApp → Settings → Privacy. Work down the list.

Silence unknown callers deserves emphasis. Most sextortion in India begins with a video call from an unknown number; the screen shows explicit content, the call is recorded, and the threats begin within minutes. If unknown numbers cannot ring your phone, the attempt never starts. What to do if it does is covered separately.

Step 4: chat lock, backups and the account email

Chat lock hides selected chats behind your phone's fingerprint or a separate secret code; open a chat, tap the name at the top, and look for Chat lock. Useful on a phone that children or colleagues sometimes use. Encrypted backups are under Settings → Chats → Chat backup → End-to-end encrypted backup; without this, your Google Drive or iCloud backup is readable by anyone who gets into that cloud account. Finally, under Settings → Account, add an email address if you have not; WhatsApp uses it to send verification codes when SMS is unavailable, which also makes SIM swap less effective.

Passkeys, where available under Settings → Account → Passkeys, let you verify with your phone's fingerprint or face instead of an SMS code, and are worth switching on.

One more habit for anyone who receives payments on WhatsApp or runs a business through it: keep the business and personal numbers separate. A business number is public by design and will receive more phishing, more fake-order messages and more "your account will be suspended" notices. The personal number, with the privacy settings above, stays quiet. If a customer or supplier suddenly changes the bank account they want you to pay into, confirm it by phone on a number you already had; a hijacked contact is the usual explanation.

If your account has already been taken

Signs: friends say you are messaging them for money; you are logged out and the code will not arrive; a stranger's device is in Linked devices. Act in this order.

1. Reinstall and re-register. Delete and reinstall WhatsApp, enter your number, receive the SMS code on your SIM. The moment you register, the other phone is logged out. If the hijacker turned on two-step verification, WhatsApp may make you wait seven days before you can register without their PIN; keep trying after that period.
2. Tell your contacts another way. Call or SMS the people most likely to be asked for money, especially parents and close friends. Ask them to report and block the messages they received.
3. Report the fraud. If anyone paid, they should call 1930 and file on cybercrime.gov.in. Report the scam messages on Chakshu as well. Reporting on WhatsApp itself is through the in-app report option on the chat.
4. Turn on two-step and check linked devices the moment you are back in.
5. Check your SIM. If the phone lost signal before the takeover, it may have been a SIM swap; here is how that works and what to tell your operator.

If the account was used to defraud contacts, the people who paid are victims of cheating by personation under IT Act section 66D and BNS section 319, and you are a victim of unauthorised access under sections 43 and 66. The account hacking page lists what to put in the complaint. For help recovering an account that will not come back, or where a hijacker has locked it with their own PIN, our hacked account recovery service handles the platform escalation.

Ten minutes, once, then monthly

Two-step verification, linked devices, the privacy list, and silence unknown callers. That is the whole job to secure WhatsApp for most people, and it fits in ten minutes. Add a calendar reminder to check linked devices monthly, and do the same four steps on your parents' phones this week; they receive more of the fake "code" messages than you do. The rest of the phone is covered in our personal cyber safety checklist.