How it works
It starts with a message from someone you know: a friend, a cousin, a colleague. The problem is that their account has already been stolen.
In English: "Hi! Sorry, I sent you a code by text by mistake. Could you send it back? I need it urgently."
At the same moment, you receive a real text from WhatsApp with a 6-digit code. That code isn't your friend's: it's the code to register your account on another phone. If you send it, the scammer signs in to WhatsApp with your number, and you're locked out.
Then the cycle repeats: the scammer messages your contacts as you, asks for their codes, or asks them for "urgent" money with a believable story.
Other common variants:
- "Vote for me in a contest": a link that asks you to "verify" your number, which means handing over the code.
- "I need money urgently, I'll pay you back tomorrow": from a relative's stolen account.
- "I'm from WhatsApp support": WhatsApp never contacts you to ask for your code.
The one rule to remember
Protection: 2 minutes that stop this scam
Turn on two-step verification in WhatsApp. With it, even if someone gets the code from your text messages, they can't sign in without your 6-digit PIN.
- Open WhatsApp and go to Settings.
- Choose Account, then Two-step verification.
- Tap Turn on and choose a 6-digit PIN you don't use anywhere else.
- Add an email address, so you can reset the PIN if you forget it.
Menu names can vary slightly from phone to phone.
If your account has been stolen
- Sign back in to WhatsApp with your number. You'll get a new code by text; registering again logs the scammer out. If they've turned on two-step verification, you may have to wait a few days. Contact WhatsApp from the app (Help › Contact us).
- Warn your contacts through another channel (text, Facebook, a call): "My WhatsApp account has been stolen. Don't send codes or money."
- Check whether others were asked for codes and whether anyone sent money. If so, report it to the police as soon as possible.
- Turn on two-step verification as soon as you get your account back.
Why it matters for businesses
In many Albanian companies, work happens on WhatsApp: orders, invoices, approvals. A manager's stolen account can be used to ask accounts for an "urgent" payment. The team rule should be clear: any payment request that arrives by message is confirmed with a phone call, to a number you already have.