Account Hijacked via SMS Code? Steps to Get It Back

If your WhatsApp account was hacked through a verification code, you can usually recover it yourself: open the app on your own phone, register your number again and enter the new SMS code. That logs the intruder out. Then warn your contacts, turn on two-step verification and check for linked devices you don't recognize.

Speed matters. In the first hour, the person who took your account is usually messaging your friends and family asking for codes or money. The checklist below is written for WhatsApp, but the same steps apply to most messaging apps that sign you in with a phone number, including JaPassa.

Signs someone logged into your account

• The app suddenly says your number is registered on another phone, or logs you out.
• You receive verification codes you didn't request.
• Friends tell you that "you" asked them for a code or for money.
• You see an unfamiliar computer or browser in the list of linked devices.
• Messages appear as sent that you never wrote.

The first sign is the most common: the hijacker registered your number on their phone, so the app signed you out. That is bad news, but it also means the fix is in your hands, because the SMS codes still go to your SIM card.

Recovery checklist: the first 15 minutes

1. Register your number again on your own phone

Open the app, enter your phone number and request a new verification code by SMS (or call, if offered). Type it in. On WhatsApp, your number can only be active on one phone at a time, so when you verify it again, the other phone is logged out.

2. If you are asked for a PIN you never set

This means the hijacker turned on two-step verification to lock you out. Don't panic and don't uninstall the app. WhatsApp's own guidance says that, without the PIN, you may have to wait 7 days before you can verify again without it. The good news, according to that same guidance, is that entering the new SMS code on your phone already logs the intruder out, even if you don't know the PIN. Keep the app installed and try again when allowed.

3. Check that your SIM still works

If you are not receiving any SMS at all, the problem may be bigger than a stolen code: someone could have moved your number to a new SIM card (a "SIM swap"). Call your mobile carrier from another phone straight away and ask them to block the transfer.

Warn your contacts before the scam spreads

While the scammer had your account, they could write to every chat and group you were in. Your contacts trust your name and photo, which is exactly what the scam relies on. Send a short warning by SMS, email, social media or a phone call to close family and active groups:

Ask anyone who already sent money to contact their bank immediately. Our guide on what to do in the first hour after sending money to a scammer covers the steps for the UK, US and Australia.

Lock the account so it can't happen again

Once you are back in, close the door the scammer used.

• Turn on two-step verification. On WhatsApp, go to the account settings and set a six-digit PIN, plus a recovery email. With it on, a stolen SMS code is not enough.
• Review linked devices. Open the list of linked devices and log out any computer or browser you don't recognize. Scammers sometimes link a web session to keep reading messages.
• Check your profile. Make sure your name, photo, "about" text and privacy settings were not changed.
• Look at your groups. If you are an admin, check that no members were added or removed and that group settings were not changed.

If you use JaPassa

JaPassa signs you in with your phone number and a six-digit SMS code too, so the same protections apply:

• Turn on Account PIN under Settings → Security. Once it is on, JaPassa asks for it as well as the SMS code when someone signs in on a new phone.
• Open Settings → Security → Sessions and devices to see every phone and computer where your account is signed in. Tap a device you don't recognize and choose "End session", or use "End all other sessions". To sign in again, that device would need a new SMS code.
• Because JaPassa keeps messages on your devices rather than on the server long-term, an intruder signing in on a new phone does not automatically get your past chat history. They could still receive new messages, which is why acting fast matters.

When you can't get the account back yourself

Sometimes the self-service steps aren't enough: the SMS never arrives, the wait period keeps resetting, or you lost the phone too.

• Contact the app's support from inside the app or its help center. Explain that your account was stolen and give your full phone number in international format. Do not trust "recovery services" that contact you on social media; many are scams themselves.
• Talk to your mobile carrier if you suspect a SIM swap or lost your phone. They can block the SIM and issue a new one with the same number.
• Report the crime if money was lost or your identity was used. In the UK (England, Wales and Northern Ireland), the national service is now Report Fraud, which replaced Action Fraud in December 2025; in Scotland, call Police Scotland on 101. In the US, report to the FTC at ReportFraud.ftc.gov.

Why this keeps happening (and how to stay ahead)

Account takeovers almost always start with one forwarded six-digit code. Scammers rarely "hack" anything in the technical sense: they persuade someone to hand over the code, often by writing from a friend's account that was taken the same way. We explain the mechanics in how the six-digit code scam works.

Two habits break the chain: never share a verification code, and keep an account PIN switched on. If you are worried about relatives, set it up for them the next time you visit. Our guide to protecting older parents walks through it.

Quick recap: your first-hour checklist

1. Re-register your number on your own phone with a fresh SMS code.
2. If a PIN you never set is requested, keep the app installed and wait for the reset period.
3. No SMS at all? Call your carrier about a possible SIM swap.
4. Warn contacts and groups through another channel.
5. Turn on two-step verification or an account PIN.
6. Log out unknown linked devices and check your profile.
7. Report any money lost to your bank and the police or fraud reporting service in your country.