Topic
WhatsApp Hacked
Recover a compromised WhatsApp account quickly and methodically. Prioritize account control, message confidentiality, and device hygiene while coordinating with carriers and contacts to minimize harm.
Immediate Containment
1
- If you are still signed in on any device, open WhatsApp and revoke all linked devices from Settings > Linked Devices. This terminates active sessions elsewhere.
- Notify close contacts via alternate channels that your account is compromised. Ask them to ignore unusual requests involving money or sensitive information.
- If you lost access, attempt account re‑verification using your phone number. Enter the 6‑digit code received by SMS or call. Do not share this code with anyone.
- Enable two‑step verification (6‑digit PIN) immediately after regaining access. Add a recovery email to prevent lockouts.
SIM Swap and Carrier Coordination
2
- Contact your mobile carrier to check for SIM swap activity. Unauthorized swaps allow attackers to intercept WhatsApp verification codes.
- Ask your carrier to place a SIM swap lock or additional verification on your line. Provide identification as required.
- If your SIM is missing or unresponsive, request an immediate SIM replacement and re‑register WhatsApp with the restored number.
Device Hygiene
3
- Scan devices for malware. Remove suspicious apps and unknown configuration profiles that could intercept notifications or manipulate network settings.
- Update OS and WhatsApp to the latest version. Security patches close known vulnerabilities that attackers exploit.
- Review notification previews and lock‑screen exposure. Limit sensitive information that can be read without unlocking your phone.
Privacy and History
4
- Change privacy settings for profile photo, last seen, and groups to reduce exposure to unknown accounts.
- Review group membership and exit any unknown or risky groups added during the compromise.
- Consider clearing sensitive chat histories or exporting important threads securely before cleanup.
Escalation and Support
5
- Use the in‑app support or WhatsApp official help channels to report the compromise and request assistance where needed.
- Collect timestamps, verification prompts, carrier interactions, and device logs to support any investigation.
- If financial loss occurred, coordinate with your bank and file a report to the appropriate authorities.
Communication Plan
6
- Draft a short message to broadcast to contacts clarifying the incident and asking them to ignore unusual requests.
- Update status or profile temporarily to warn new contacts until stability is confirmed.
Post‑Incident Hardening
7
- Rotate device unlock codes and review notification preview policies.
- Enable two‑step verification PIN reminders and store recovery email securely.
Regional Guidance
8
- Verify local carrier policies regarding SIM swap locks and identity re‑verification.
- Use official USSD or apps to check line status after recovery.
Evidence Archive
9
- Export chat logs that may contain evidence and store securely off device.
- Keep a timeline of events to assist support or law enforcement.
Recovery Timeline
10
- Plan staged checks over a week: session review, privacy settings audit, and contact confirmations.
- Monitor for residual anomalies like unknown group additions or sudden verification prompts.
Checklist
Work through these steps in order.
- Reverify number and enable two‑step PIN.
- Revoke linked devices; notify contacts.
- Check for SIM swap; lock line.
- Scan devices; remove suspicious apps.