◢How your WhatsApp account gets stolen

WhatsApp only works with one phone number at a time. To take over your account, the thief installs WhatsApp on their phone with your number, and to finish the job they need the 6-digit code WhatsApp texts to you. They can't guess it: they need you to hand it over. These are the most common tricks:

Once they have the account, they message your contacts pretending to be you: they ask for urgent money transfers, or for the code they just received, and the chain carries on.

◢How to recover your account step by step

According to WhatsApp's official guide:

1. ▹Open WhatsApp on your phone, tap "Log back in" and then "Continue". If the app was deleted or won't respond, reinstall it.
2. ▹If asked, enter your number with the international dialling code.
3. ▹Enter the 6-digit code you receive by text message or phone call.

As soon as you enter that code, WhatsApp logs your account out of every other device, including the thief's. You need the SIM card with that number: without it, there's no way to recover the account.

◢What if it asks for a PIN I don't know?

It means the thief turned on two-step verification to keep the account. WhatsApp's guide is clear: if you don't have the PIN, wait 7 days and try again.

The important part is not to stop there. Even without the PIN, entering the text message code already logs out whoever was using your account, so they can't keep writing as you while you wait. And if the app tells you to wait a few hours before sending another code, that's normal after several attempts: wait and try again.

◢What doesn't work, and what can make it worse

Changing your password doesn't kick anyone out. WhatsApp says so itself: passwords, two-step verification and its other security features protect an account you still have access to. If someone has taken it from you, the only way to remove them is to register it again with the code, as in the steps above.

Don't report your own account inside WhatsApp while you're trying to recover it, either. WhatsApp warns that it could be banned for breaking its terms and you'd lose access. Recover it first.

And if the thief asks for money to give it back, don't pay.

◢Warn your contacts as soon as possible

While the thief has the account, they can message anyone as if they were you, including in groups. Warn people through another channel, with a call, a text or on social media, especially the older people in your family, who are the ones most often asked for money.

One reassurance: the thief can't read your previous conversations. According to WhatsApp, messages are encrypted and stored on your phone, so whoever registers your account on another phone starts with an empty history.

◢If you can't get it back

If you still can't recover the account, INCIBE recommends writing to WhatsApp support (support@whatsapp.com) explaining what happened. If that doesn't solve it, the next step is contacting WhatsApp's data protection officer and, if there's no answer within a month, filing a complaint with your country's data protection authority.

◢How to stop it happening again

It almost all comes down to one rule: never give anyone a code you receive by text message, not a relative and not someone claiming to be from WhatsApp. WhatsApp won't call you to ask for it.

• ▹Two-step verification, which asks for more than the text message code when your account is registered on another phone.
• ▹An email address on the account, which helps you recover it even if text messages don't arrive.
• ▹A passkey, which ties the account to your phone's fingerprint, face or screen lock.
• ▹App lock, so nobody can open WhatsApp if they pick up your phone.

Check your linked devices from time to time too, meaning the computers and browsers where WhatsApp Web is open, and log out of any you don't recognise. And don't share your screen on a video call unless you're sure who you're talking to.

◢It happens at work too

Plenty of teams organise themselves on WhatsApp, which makes it another way in. A stolen account can be used to ask a colleague, a client or a supplier for an urgent payment on behalf of someone they trust. It's the same old trick on a different channel, just like phishing emails: confirm any request for money or codes through another channel before doing anything.

If you want your team to recognise these scams, it's one of the cases I cover in my cybersecurity training for companies.