WhatsApp hacked? 5 settings to lock your account in 5 minutes, from Pakistan's CERT

Turn on two-step verification with a recovery email, check your linked devices, and never share a six-digit code with anyone. Those three habits block most WhatsApp takeovers, according to an advisory from Pakistan’s National Cyber Emergency Response Team (National CERT), and they take about five minutes.

It is worth doing today. At its press conference on Friday, the National Cyber Crime Investigation Agency (NCCIA) again warned users to watch out for hacking of WhatsApp Business accounts, The Nation reported. A hijacked account is usually used for one thing: messaging your contacts to ask for money in your name.

How do hackers take over WhatsApp?

The National CERT advisory lists four tricks, and every one of them needs you to do something:

• The “wrong code” message. Someone, often from a friend’s hacked number, says they sent you a six-digit code by mistake and asks you to forward it. That code is your WhatsApp registration code. Sharing it hands over your account.
• Call forwarding. You are asked to dial a code starting with **21*. That forwards your calls, so when WhatsApp tries voice verification, the hacker hears the code.
• Fake links promising prizes or warning that your account will expire.
• QR codes sent by someone else for “WhatsApp Web login”. Scanning one links your account to their computer.

The 5-minute lock-down

1. Two-step verification, with email. On Android: three dots (⋮) → Settings → Account → Two-step verification → Turn on. On iPhone: Settings → Account → Two-step verification → Enable. Pick a six-digit PIN and add your email; the CERT says not to skip the email, because it lets you reset the PIN immediately instead of waiting seven days if something goes wrong.

2. Check linked devices. Settings → Linked devices. Log out anything you don’t recognise. The CERT suggests checking weekly.

3. Check call forwarding. Dial *#21# to see if your calls are being forwarded. Dial ##21# to switch it off.

4. Never share codes or your PIN. Not with a cousin, not with “WhatsApp support”. WhatsApp never asks for them in a chat or call.

5. Only scan QR codes from your own WhatsApp Web screen, never ones sent to you.

What if it has already happened?

The CERT’s recovery steps: delete and reinstall WhatsApp, enter your number, and type in the SMS code you receive. That logs the hacker out. If they had set their own PIN, tap “Forgot PIN?”; without a recovery email you may face a seven-day lockout, during which, the CERT says, the hacker cannot read your messages either.

Then warn your contacts through another channel not to send money, take screenshots, and report it through WhatsApp’s in-app support. For fraud involving money, you can also complain to the NCCIA.

If you do only one thing tonight, make it step one, and do it on your parents’ phones as well.