Lock It Down: The Complete Guide to Securing Your WhatsApp
Your WhatsApp account is not just a chat app. It is your identity, your contacts, your banking OTPs, your family photos, and your most private conversations. When criminals take it over, they use it immediately to impersonate you and defraud everyone you know. This guide walks through every meaningful control available to you, explains what each one actually does, and shows you exactly where to find it on both Android and iPhone.
1. Why WhatsApp Accounts Are Stolen and What Happens Next
WhatsApp accounts are stolen for one reason above all others: they are immediately profitable. The moment an attacker controls your account, they have a trusted identity backed by a full contact list and message history, and they can impersonate you to your family, friends, and colleagues within minutes of gaining access.
The most common pattern in South Africa and across the world is deceptively simple. An attacker gets your phone number, triggers a WhatsApp registration, intercepts or tricks you into sharing the six-digit OTP, and your account transfers to their device. You are locked out while they are already inside and messaging people who trust you.
1.1 The Four Most Common Attack Patterns
Attack Type 1: The OTP Forwarding Scam
This is the most widespread attack and it works entirely by exploiting trust. Someone messages you, claims to be a friend or colleague, and says they accidentally sent a verification code to your number. They ask you to forward it quickly. That code is your WhatsApp OTP, and forwarding it immediately hands them complete control of your account.
Example of what this looks like:
+27 82 xxx xxxx: Hey! It’s Sipho from work. Sorry to message out of the blue. WhatsApp sent a verification code to your number by mistake when I was trying to log in. Can you send it to me quickly? It’s urgent, I’ve been locked out all day.
+27 82 xxx xxxx: The code would be a 6-digit number, starts with something like 123-456. WhatsApp support said it happens sometimes with number recycling.
Warning: No legitimate WhatsApp process involves sending your OTP to another person. Ever.
Attack Type 2: The Family Emergency Impersonation
Once an attacker has any compromised account, they use it to impersonate the owner to their contacts. The messages typically fabricate an emergency requiring an urgent money transfer, and the instruction to avoid calling is a classic social engineering deflection designed to prevent you from verifying the request through a channel the attacker cannot control. Always verify money requests by calling the person on a known number, regardless of how urgent the message sounds.
Example of what this looks like:
Mom (compromised account): Hi love, I’m stuck at Pick n Pay. My bank card is blocked and I need to pay R850 for groceries. Can you SnapScan or send me the money? Will pay you back tonight. Please it’s urgent.
You: Sure mom, sending now, are you okay?
Mom (compromised account): Yes just embarrassed! Please don’t call I’m at the till.
Warning: “Please don’t call” is the signal. Always verify on a number you already know before sending any money.
Attack Type 3: The Voicemail OTP Interception
Many people do not realise their mobile network voicemail often uses a predictable or default PIN. Attackers can call your number repeatedly until it goes to voicemail, at which point WhatsApp’s fallback system leaves the OTP as a voicemail message. The attacker then calls your voicemail directly, guesses or knows the default PIN (many South African networks use 0000 or 1234), retrieves your code, and completes the account takeover without you receiving any notification that this happened. Changing your voicemail PIN to something non-obvious or disabling voicemail entirely closes this vector completely.
Immediate action required: Call your mobile network operator today and either change your voicemail PIN to something unique and non-obvious, or disable voicemail entirely. This closes a significant attack vector that bypasses WhatsApp’s own security completely.
Attack Type 4: The Malicious WhatsApp Web QR Code
Attackers have been known to send phishing pages that look identical to the real WhatsApp Web login screen. When a victim scans the displayed QR code, the attacker gains a linked device session to the victim’s account without any further interaction required, and the victim’s account continues working normally on their phone while the attacker has full read and write access through the linked session, often for extended periods before the victim notices anything unusual.
2. Understanding SIM Swap and the Stolen Phone Problem
Two physical attacks sit underneath most WhatsApp fraud and deserve careful explanation because they operate at a layer below the app itself. No setting inside WhatsApp alone will protect you from these without additional controls on your network account and device.
2.1 SIM Swap Fraud
A SIM swap is when an attacker convinces your mobile network operator to port your number to a new SIM card in their possession. They typically do this by using personal information obtained from data breaches, social media, or social engineering calls to your network’s customer service team. Once your number is on their SIM, every SMS and call intended for you goes to them, including WhatsApp OTPs, banking OTPs, and password reset messages for every account that uses your phone number as a second factor.
The warning sign of a SIM swap is a sudden and unexplained loss of all mobile signal, where your phone simply stops making calls or connecting to mobile data. If this happens unexpectedly, you should call your network operator immediately from another phone and ask them to investigate whether a SIM swap has been processed on your account.
South Africa specific: MTN South Africa requires a SIM swap protection PIN to process a SIM swap, which you can activate via the MyMTN app or by calling 135. Vodacom and Cell C offer similar RICA-anchored controls. Contact your operator and ask specifically how to add SIM swap protection to your account before you need it.
2.2 The Stolen Phone Problem: Moving a SIM Into Another Device
A common misconception is that a thief needs to crack your locked phone to access your WhatsApp, but the attack is actually much simpler than that. If your phone is stolen, the thief can remove your SIM card and insert it into any Android device or an iPhone without a SIM lock, reinstall WhatsApp, enter your number, and receive the OTP directly on their device. Your six-digit screen lock PIN or fingerprint is entirely irrelevant to this attack path because the attacker never attempts to unlock your original phone at all.
How this attack plays out step by step:
- Phone stolen or SIM removed – Attacker removes SIM card from your locked device without needing to unlock the screen
- SIM inserted into attacker’s phone – Any unlocked Android device will accept the SIM immediately, as will an unlocked iPhone
- WhatsApp installed and registration triggered – Attacker enters your mobile number into a fresh WhatsApp installation
- OTP received directly on the attacker’s phone – Your SIM is physically in their device, so no interception is needed and the code arrives instantly
- Account registered without further friction – Unless Two-Step Verification is enabled, which is the subject of the next section and the single most important step in this guide
This is precisely why the controls that follow are designed as layers rather than a single solution. A PIN lock on your phone protects the content already on it, Two-Step Verification protects the registration of your number on any new device, and passkeys with email recovery ensure you can regain access and that the recovery process itself cannot be weaponised against you.
3. Registering an Email Address: The Recovery Anchor
Adding an email address to your WhatsApp account is often the least appreciated control and one of the most important. Its purpose is recovery rather than active authentication, and WhatsApp uses your registered email to allow you to reset your Two-Step Verification PIN if you forget it, giving you an out-of-band recovery channel that does not depend on your phone number being in your possession.
3.1 What It Does
When you register an email address, WhatsApp sends account recovery links to that address, and if an attacker has your phone number but not access to your email account, they cannot complete the PIN reset process. The email address becomes an independent second factor for account recovery that sits entirely outside the telephone network and therefore cannot be bypassed through SIM swap or OTP interception.
3.2 What It Does Not Do
Registering an email address alone does not prevent someone from taking over your account if they have your phone number and you have not set a Two-Step Verification PIN. It also does not prevent a linked device from being added without your knowledge unless you periodically review your linked devices list. It is a recovery mechanism, not a primary access control, and it only becomes meaningful when combined with Two-Step Verification.
On Android:
- Open WhatsApp and tap the three-dot menu (top right)
- Tap Settings
- Tap Account
- Tap Email address
- Enter a personal email you actively monitor
- Verify via the confirmation link sent to that address
On iPhone (iOS):
- Open WhatsApp and tap Settings (bottom right)
- Tap Account
- Tap Email address
- Enter a personal email you actively monitor
- Verify via the confirmation link sent to that address
Critical detail: The email address you register must be one only you control, with its own strong password and two-factor authentication enabled. If your Gmail or Outlook account has no 2FA, registering it with WhatsApp adds little meaningful protection, so you should secure the email account first before relying on it as a recovery anchor.
4. Two-Step Verification: The Most Important Control You Are Not Using
Two-Step Verification (2SV) is a PIN you set inside WhatsApp that must be entered whenever your phone number is registered on any device, whether new or existing. It is the single most impactful control available to ordinary WhatsApp users because it directly closes the SIM swap and stolen phone attack described in the previous section. When it is enabled, an attacker who has your SIM card in their hands and receives your OTP directly on their device will still be stopped at a second screen asking for a six-digit PIN that only you know, and without that PIN WhatsApp will not activate the account regardless of any other access the attacker has obtained.
4.1 What It Does
Two-Step Verification requires your PIN to complete any fresh registration of your phone number in WhatsApp on any device anywhere in the world, and it applies regardless of whether the registration was triggered legitimately or by an attacker. Even if someone has physical possession of your SIM card, they cannot activate your WhatsApp without this PIN, which is why it functions as the foundational layer of account security and the first thing you should enable.
4.2 What It Does Not Do
Two-Step Verification does not protect an already-active WhatsApp session. If an attacker adds a linked device through WhatsApp Web while your phone is unlocked, the 2SV PIN is not requested for linked device sessions since it only applies to full re-registration of the number. It also does not protect the content already on your phone if your device is physically compromised and someone has access to the unlocked screen.
On Android:
- Open WhatsApp, tap the three-dot menu, then tap Settings
- Tap Account
- Tap Two-step verification
- Tap Enable
- Create a 6-digit PIN (do not use your birth year or phone number)
- Confirm the PIN
- Add your email as a fallback recovery option
On iPhone (iOS):
- Open WhatsApp and tap Settings
- Tap Account
- Tap Two-step verification
- Tap Enable
- Create a 6-digit PIN
- Confirm the PIN
- Add your email as a recovery fallback
Best practice: Choose a PIN that is not predictable from your personal information, avoiding birth dates, phone number fragments, ID number fragments, and common sequences. Write the PIN down and store it somewhere physically secure and separate from your phone, since WhatsApp will periodically prompt you to enter it to keep it fresh in memory.
5. Passkeys: The Strongest Authentication WhatsApp Offers
Passkeys represent a fundamental shift in how authentication works, and WhatsApp has supported them since 2023. Unlike a PIN or password that you memorise and type, a passkey is a cryptographic key pair where the private half lives securely inside your device’s secure enclave (the same hardware chip that protects your fingerprint data) and the public half is registered with WhatsApp. Authentication happens through a biometric or device PIN prompt on your side, and no secret is ever typed or transmitted across the network, which removes the entire category of credential-theft attacks from the threat picture.
5.1 What Passkeys Actually Do
When you log into WhatsApp with a passkey, your phone proves to WhatsApp that it holds the registered private key by signing a challenge using that key, with your biometric or screen lock confirming the operation locally. WhatsApp verifies the signature using the stored public key, and because no password or PIN travels over the network, there is nothing for an attacker to intercept, steal from a database, or guess. Passkeys are also inherently phishing-resistant because the key pair is bound to the specific WhatsApp domain at the time of registration, which means a fake WhatsApp phishing site cannot trigger or accept a passkey authentication since the device recognises that the domain is wrong and refuses to respond.
5.2 What Passkeys Do Not Do
A passkey is tied to the specific device it was created on, so if you lose your phone and have no backup or recovery mechanism set up, you cannot use a passkey from a device that has never had it registered. Passkeys also do not prevent someone from using your unlocked phone, since any biometric enrolled on the device can approve the authentication challenge. They are designed to protect account access in transit and against remote attacks, not against a thief who already has your unlocked device.
On Android:
- Open WhatsApp, tap the three-dot menu, then tap Settings
- Tap Account
- Tap Passkeys
- Tap Create a passkey
- Authenticate using your fingerprint, face, or screen lock PIN
- Confirm the passkey is saved to Google Password Manager or your device
On iPhone (iOS):
- Open WhatsApp and tap Settings
- Tap Account
- Tap Passkeys
- Tap Create a passkey
- Authenticate with Face ID or Touch ID
- Passkey saves to iCloud Keychain for cross-device availability
Note on iCloud Keychain: On iOS, passkeys sync via iCloud Keychain, making them available across all your Apple devices signed into the same Apple ID. This is convenient but it means your iCloud account security directly affects your WhatsApp passkey security, so you should ensure your Apple ID has a strong password and two-factor authentication enabled.
6. Additional Security Controls and How to Enable Them
6.1 Linked Devices: Know What Is Connected to Your Account
WhatsApp allows you to use your account on up to four additional devices simultaneously, such as a tablet, laptop, or desktop, and any device linked this way has full access to your messages without needing your phone nearby. Attackers who have had brief physical access to your phone, or who have tricked you into scanning a QR code, may have added a linked device without your awareness, which is why this list should be reviewed periodically rather than assumed to be trustworthy by default.
On Android:
- Tap the three-dot menu, then tap Linked devices
- Review every device listed carefully
- Tap any unrecognised device, then tap Log out
On iPhone (iOS):
- Tap Settings, then tap Linked devices
- Review every device listed carefully
- Tap any unrecognised device, then tap Log out
6.2 Screen Lock: Require Biometrics to Open the App
WhatsApp has a built-in screen lock feature that requires fingerprint or face authentication to open the app independently of your device’s own lock screen, which protects your messages from someone who picks up your already-unlocked phone and attempts to browse your conversations or read your banking OTPs.
On Android:
- Tap the three-dot menu, then Settings
- Tap Privacy, then Fingerprint lock
- Toggle on and set timeout to Immediately
On iPhone (iOS):
- Tap Settings, then Privacy
- Tap Screen Lock
- Enable Face ID or Touch ID, and set to Immediately
6.3 Privacy Settings: Limit Your Attack Surface
Information visible on your profile can be harvested by attackers before they attempt social engineering, and setting your last seen, profile photo, and about section to My Contacts or Nobody limits the reconnaissance available to someone who does not already know you. You can find these settings under Settings > Privacy on both platforms, and at minimum you should configure Last seen, Profile photo, About, and Status to My Contacts.
6.4 Live Location and Silence Unknown Callers
Live location sharing is a persistent feature that continues broadcasting until you manually stop it, so you should audit any active shares under Settings > Privacy > Live location and remove anything you did not intentionally start. Unknown caller silencing sends calls from numbers not in your contacts directly to voicemail, reducing the exposure surface for vishing attacks where criminals call to extract personal information by voice, and you can enable it under Settings > Privacy > Silence unknown callers.
7. The Complete Control Reference
| Control | What It Blocks | What It Does Not Block | Priority |
|---|---|---|---|
| Two-Step Verification PIN | New device registration with your number, even if the attacker has your SIM and OTP | Active linked device sessions; content on a physically compromised device | Critical |
| Passkey | Phishing login pages; credential interception; remote account takeover; replay attacks | Attacks from an unlocked device in hand; registration takeover without 2SV | Critical |
| Registered Email Address | Attacker resetting your 2SV PIN; provides out-of-band recovery outside the phone network | Primary account takeover; does nothing if 2SV is not set | High |
| App Screen Lock (Biometric) | Message access from a physically unlocked phone left unattended | Account registration attacks; SIM swap; linked device access | Medium |
| Linked Devices Audit | Ongoing access from a device an attacker previously linked | Real-time monitoring; does not alert you when a new device is added | High |
| Silence Unknown Callers | Vishing calls from attackers probing for personal information | SMS-based attacks; impersonation from compromised contacts | Medium |
| Privacy Settings | Reconnaissance by attackers building a targeting profile | Active attacks in progress; not useful once attacker has your number | Medium |
| Network Voicemail PIN Change | Voicemail OTP interception through a weak or default voicemail PIN | Direct SMS interception; SIM swap; attacks not using voicemail | High |
| Network SIM Swap Protection | Operator-level SIM swap fraud | Physical SIM theft from a stolen phone; insider threats at the operator | Critical |
8. Your Priority Action List
If you take nothing else from this guide, work through the items below in order. Everything marked as high priority can be completed in under fifteen minutes and should be treated as overdue the moment you finish reading this.
Do right now:
- Enable Two-Step Verification with a non-obvious PIN
- Register an email address on your account
- Change your network voicemail PIN from the default
- Contact your operator and activate SIM swap protection
- Review and remove any unknown linked devices
Do this week:
- Set up a Passkey on your device
- Enable App Screen Lock set to Immediately
- Set Last Seen and Profile Photo to My Contacts
- Enable Silence Unknown Callers
- Ensure your registered email has 2FA enabled
Ongoing habits:
- Review linked devices monthly
- Never share OTP codes with anyone for any reason
- Verify money requests by calling a known number
- Audit live location shares regularly
- Keep WhatsApp updated to the current version
The golden rule: WhatsApp will never ask you to share your six-digit verification code or your Two-Step Verification PIN with anyone, through any channel, for any reason. No one you know has a legitimate reason to ask you to forward a WhatsApp code to them, and if you receive such a request from a friend, a family member, a company, or a support contact, you should refuse it immediately and treat the account that sent it as already compromised.
9. If Your Account Is Already Compromised
If you suspect your account has been taken over, it is important to act quickly because WhatsApp has a 30-day window before an account registered on a new device can fully displace your access and change your core security settings.
- Reinstall WhatsApp and register your number again. Entering a new OTP on your own device will immediately log out the attacker’s session and lock them out of your account.
- If the attacker has set Two-Step Verification, WhatsApp will ask for a PIN you do not know, so use the “Forgot PIN” option and recover via your registered email. You will be locked out for seven days during this process, and that delay is intentional because it prevents the attacker from immediately re-registering once you begin recovery.
- Alert your contacts immediately via SMS, another messaging platform, or a phone call, telling them your WhatsApp was compromised and that any recent messages asking for money or codes were not from you.
- Contact your bank and review recent transactions. Attackers with access to your WhatsApp history may have seen OTPs, account references, or used the account to social engineer your contacts into making payments.
- Report to WhatsApp directly by emailing [email protected] with the subject “Lost/Stolen: Please deactivate my account” to formally request that WhatsApp deactivate the compromised account from their side while you work through the recovery process.
Securing WhatsApp is not technically difficult, and every control described in this guide is built into the app and takes minutes to enable. The gap between knowing and doing is the only thing standing between you and a very bad afternoon explaining to your contacts why your account sent them a payment request at two in the morning.
Published on andrewbaker.ninja