Verify the request before trusting the conversation. A familiar profile, encrypted chat or convincing voice does not establish that a message asking for money or account access is legitimate. This guide helps WhatsApp users anywhere check suspicious messages, protect access and choose appropriate recovery steps.
Separate identity, request and action
Ask three questions: who controls this account, what are they asking for, and what will the proposed action do? A real acquaintance’s account may be compromised. A fake profile may copy their picture. An apparently helpful conversation may lead to a request for a code, device connection or payment.
Encryption protects communication in specific ways; it does not establish the honesty of the person communicating. Judge the request independently of the app carrying it.
| Request | What to verify | Next step |
|---|---|---|
| Share a registration code | Whether you initiated the registration yourself | Keep the code private; review account access. |
| Send money to a relative | The person’s identity through an established contact method | Contact them independently before paying. |
| Pay to unlock task earnings | The employer and reason for a deposit | Use our task-scam guide. |
| Scan a QR code or connect a device | Whether you intend to grant account access | Stop if the purpose is unclear. |
| Install a support or payment app | The provider and required permissions | Find the genuine service independently. |
This is an editorial decision aid, not a complete list of scam messages. Poor spelling is not required for deception, and a foreign number alone does not establish fraud.
Protect your WhatsApp account
Review account-security settings in the current official app. Keep registration codes and account-security secrets private. Do not follow instructions to connect an unfamiliar device merely because the sender says it is necessary for a prize, job or verification.
Meta’s August 2026 announcement describes stronger two-step verification using a password, passkey options and additional context for unknown calls on Android. Current account-security announcement. Features and screens may vary during rollout; follow the controls actually available in your app rather than assuming every device uses an older six-digit PIN setup.
A passkey can help protect account access; it cannot make a fraudulent payment request honest. Keep account protection and transaction verification as separate checks. Review linked devices and remove unfamiliar access using the app’s current controls.
Verify people through another route
If an unexpected request comes from a known contact, use a saved number or another established channel to confirm it. Avoid treating a reply within the suspicious chat as independent verification. For emergency claims, contact another trusted family member if the named person is unavailable.
Messages asking you to keep a payment secret, hurry past verification or pay before receiving earnings deserve particular scrutiny. Read our payment-request verification guide before authorizing a transaction.
Block and report suspicious contact
WhatsApp provides tools to report messages or accounts and block unwanted contact. Use the current controls described in its official safety guidance. If you need records for an incident report, preserve relevant evidence first. Reporting to the app does not replace contacting your bank about a payment or the appropriate authority about a crime.
If you lose account access
Use the official app and WhatsApp’s compromised-account recovery guidance. Its safety page directs users to re-register their phone number. Follow the current recovery prompts and any displayed waiting period; do not share new codes with someone offering to recover the account.
Once access is restored, review security settings and linked devices. Warn contacts through another trusted route if someone may be messaging them from your account. If the number itself has been taken over or service unexpectedly stopped, contact your carrier; our SIM-swap guide addresses that separate problem.
If you shared a code, password or financial details, record exactly what was exposed and contact the affected provider. See our OTP response guide. Contact the payment provider promptly for money sent or unauthorized activity. Recovery and refunds are not guaranteed; reporting systems vary by location.
A household verification exercise
Using fictional messages, practice three situations: a changed-number message, an urgent money request and a request to connect a device. For each, explain how you would verify identity, what action you would refuse until verified and where you would find genuine support. Do not send practice messages that could frighten others or submit real payments.
Glossary
- Account takeover: unauthorized control of an account.
- Registration code: a code used in the app’s phone-number registration process.
- Linked device: another device connected to an account.
- Passkey: a cryptographic account sign-in method unlocked by a device’s supported verification mechanism.
- Impersonation: pretending to be a trusted person or organization.
Sources and editorial review
Updated 1 October 2026. Primary WhatsApp and Meta documentation supports the named product features. The table and exercise are original learning aids. No account takeover or recovery procedure was tested for this article. It makes no claim about worldwide scam prevalence or guaranteed recovery. Use our online-safety hub for related guides, and send corrections through our contact page.
Written and prepared by Kshitij Gupta.
