Your customers message you on WhatsApp to ask for a quote, confirm a booking or check on an order. If someone else takes over that number, they can answer those chats as you and ask for money. Reports dated October 15, 2026 describe a surge in hacked business WhatsApp accounts in Zimbabwe, and the routes scammers use work on any account, anywhere.
The good news is that the fix is mostly a ten-minute settings check, and you can do it today without paying anyone. Start with the three settings that matter. If access is already gone, go straight to recovery, then tell your customers.
Key Takeaways
WhatsApp says to never share your registration code with anyone, including friends and family, because it is what lets someone register your number on their phone.
Turn on two-step verification with a recovery email your business controls, and review Linked devices, logging out anything you do not recognize.
Entering your number and the six-digit code on your own phone logs out every other device; if an attacker set a PIN you do not know, WhatsApp says to wait seven days and try again.
Use your website, email, Facebook or Instagram to tell customers not to trust payment requests or changed bank details from the hacked number.
How do I lock down my WhatsApp Business account in ten minutes?
Most takeovers start with one of two things: someone talks you into reading out a code, or someone gets their device linked to your account. Both are cheap to check, and the check takes about as long as making coffee. Do these in order, on the phone that runs the account, and tell any staff who use it what you changed.
- Confirm you still control the number: Check that the SIM is in the phone and that you can receive a text or call. If the phone suddenly shows no service, call your carrier before anything else.
- Turn on two-step verification: In WhatsApp Business, open Settings, then Account, then Two-step verification (on Android, tap More options first), and follow the prompts. WhatsApp lets you choose your phone number, a password or an email address for the extra check, so pick an email address your business controls. WhatsApp explains the setup in its two-step verification help page.
- Review Linked devices: On iPhone open Settings, then Linked devices. On Android tap More options, then Linked devices. Tap any device you do not recognize and choose Log out. WhatsApp describes this in its linked devices help page.
- Add a passkey where it is offered: Open Settings, then Account, then Passkeys. Availability depends on your phone and rollout, so if you do not see it, skip this step and repeat the check later.
- Agree one rule with your team: Nobody shares the six-digit code, the two-step PIN or a passkey approval with anyone, whoever they claim to be.
Write down who owns the phone, which email is on the account and who is allowed to link a device. That one note saves hours if the account is ever challenged.
How do scammers actually get into a WhatsApp Business account?
Knowing the routes helps you spot the moment it is happening. WhatsApp says an attacker cannot finish registering your number without the six-digit code sent to it. So, the usual job for a scammer is to get you to hand that code over, often by pretending to be WhatsApp support, a customer, your mobile carrier or a colleague. WhatsApp's help page on codes you did not request says you should never share the code, not even with friends or family.
A second route is a linked device. If you scan an unknown QR code or approve a linking request, someone else's phone or computer can use your account alongside yours. A third route goes through the phone number itself. The Zimbabwe Republic Police published a case from October 21, 2025 in which a suspect used social engineering to get a replacement SIM card, took over victims' WhatsApp accounts and asked their contacts for money. Replacing a SIM is a carrier process, so a SIM swap shows up as your phone losing service rather than as a strange message.
| Route | What it looks like | What closes it |
|---|---|---|
| Registration code | A code arrives that you did not ask for, or someone asks you to read one out | Never share it; keep two-step verification on |
| Linked device | An unfamiliar device in the Linked devices list | Log it out; only scan QR codes you created |
| SIM replacement | Your phone suddenly has no service | Call your carrier at once; then re-register on WhatsApp |
An unexpected code does not prove you have been hacked. WhatsApp says it can come from another person typing your number by mistake. It does mean you should check two-step verification and Linked devices that day, and never repeat the code to anyone who asks for it.
How can I tell if someone else is using my WhatsApp?
People often search for this as "is my WhatsApp cloned." The warning signs are specific. You may be logged out without doing anything, receive a verification code you did not request, see a device in Linked devices that you do not recognize, or hear from customers about messages you never sent. Any one of these is worth acting on the same day.
The quickest test is the Linked devices list, because a stranger who has linked a device appears there. If the list shows only your own devices and you are still logged in, nobody has registered your number on another phone. If you have been logged out and cannot log back in, assume the number has been registered somewhere else and go straight to recovery.
What do I do in the first hour if my account has been taken?
Recover the number first, before you spend time on anything else. On the phone with your SIM, open WhatsApp Business, choose to log back in, tap Continue, enter your full international phone number, then enter the six-digit code sent by text or call. WhatsApp says this logs out other devices automatically, which is the step that removes the attacker. The full steps are on its recovery help page.
If WhatsApp asks for a two-step verification PIN you never set, the attacker may have added one. WhatsApp's recovery help page says that if you do not have the PIN, wait 7 days and try again, and that anyone using your account is logged out as soon as you enter the 6-digit code. If you see the message that your number was registered on a new device, WhatsApp's help page for that message shows how to log back in. Plan for that wait now by moving customer chats to another channel.
A few cautions help during recovery:
- Do not rely on changing a password: WhatsApp says changing a password does not remove someone who has already taken over the account; re-registering does.
- Do not pay a "recovery service": Recovery runs through the steps above, using your own SIM, and WhatsApp controls it.
- Call your carrier if the SIM stopped working: A replaced SIM has to be reversed at the carrier before you can receive the code.
How long recovery takes depends on the route. If you still hold the number and the attacker added no PIN, it can be done in minutes. If a PIN was added, it is seven days. If the SIM was swapped, it depends on how fast your carrier acts.
How do I warn customers without causing panic?
Customers are the ones at risk, so warn them in the first hour, and use a channel the attacker does not control. Your website, email list, Facebook page or Instagram account all work, as does a phone line. Keep the message short and factual, and do not wait for the account to be fully back.
A message like this works: "Our WhatsApp account was accessed by someone else on [date]. Do not act on any payment request, changed bank details, link or urgent message that came from our WhatsApp number during that time. If you are unsure, contact us at the number on our website."
After you recover the account, set a standing rule for money. Any change to bank details or any payment request that arrives in chat gets confirmed by a call to a number you already know. That rule protects your customers even if a different account of yours is hacked someday.
What did Meta announce on October 13, 2026?
Meta's newsroom post of October 13, 2026 says it removed more than 3.7 million accounts, Pages and Groups from Facebook and Instagram in a joint operation against scam networks based in West Africa. Meta says 14 other technology companies and law enforcement from ten countries took part. The figure covers Facebook and Instagram, so it does not count WhatsApp Business accounts and it does not mean 3.7 million people.
For your business, the practical meaning is that scam networks are organized and active across Meta's apps. If your Instagram or Facebook page is where you would warn customers, secure that too. Our post on what to do when a business Instagram or Facebook page is hacked covers that recovery.
When is it worth paying for help with WhatsApp security?
For a single owner with one phone, the checks above are enough, and you do not need an agency. Paid help starts to make sense when the setup is bigger than one person. That means several staff using the same number, customer payments agreed over chat, a SIM that a carrier will not give back, or social accounts and a website that could also be exposed.
In those cases the work is a process, not a repair: who owns the phone and the recovery email, who may link a device, who gets told when something looks wrong, which second channel customers are sent to, and a written plan for the first hour. Nobody can promise that WhatsApp cannot be compromised, and WhatsApp alone controls registration, so no outside party can restore a number for you. What help can do is cut the confusion and downtime if access is ever challenged. A website security audit also checks the website that customers are sent to as the second channel, since that page needs to be safe and always reachable.
If you are still setting up WhatsApp for customers, our post on the WhatsApp Business app for a small business covers the app, the profile and the cost.
Is your WhatsApp Business account locked down?
Pick an answer to begin.
1. A customer asks you to read out the six-digit code WhatsApp just sent. What do you do?
2. You are logged out of WhatsApp Business and cannot get back in. What is the first move?
3. Where do you warn customers that the account was taken?
Frequently Asked Questions About whatsapp business account hacked how to protect
Can someone take over my WhatsApp Business account with only my phone number?
Not with the number alone. WhatsApp says the attacker needs the six-digit registration code, or another route such as an unauthorized linked device or a SIM replacement.
What should I do if WhatsApp sends me a code I did not request?
Do not share it with anyone. It may be a typing mistake by someone else, or an attempted takeover, so check two-step verification and Linked devices the same day.
How do I check whether someone is using my WhatsApp on another device?
Open Linked devices (Settings on iPhone, More options on Android). Tap any device you do not recognize and choose Log out. If you are logged out and cannot get back in, re-register your number.
How long does it take to get a hacked WhatsApp Business account back?
If you still have the SIM and no PIN was added, re-registering can take minutes. If the attacker set a PIN you do not know, WhatsApp says to wait seven days and try again. A SIM swap depends on your carrier.
Does changing my password remove the hacker?
No. WhatsApp says the account has to be re-registered, which logs out every other device using it.
What should I tell my customers if the account was hacked?
Tell them through your website, email, Facebook or Instagram that messages from the number during that time may not be yours, and that they should not act on payment requests or changed bank details.
Final Thoughts
A hacked WhatsApp Business account usually comes down to a shared code, an unknown linked device or a swapped SIM. Keep the code private, turn on two-step verification with a recovery email you control, review Linked devices, and if access is lost, re-register your number and warn customers on another channel. Those steps are free and take minutes.
Doing the check now means a bad day stays a short one. You will know who owns the phone, where the recovery email goes and where customers will hear from you first. Customers who trust that your messages are really yours keep sending the quotes and bookings that keep the business running.
If you want a hand turning these checks into a routine for your team, Web Leveling can help with a plan that covers your social media marketing accounts and a second way for customers to reach you. We work with small and medium businesses across the country and overseas. Tell us how customers reach you through the contact page and we will suggest where to start.
Terms
WhatsApp security words in this post
Tap a term to see what it means.
Registration code. The six-digit code WhatsApp sends by text or call when a number is registered on a device.
Two-step verification. An optional PIN, with a recovery email, that WhatsApp asks for when your number is registered again.
Passkey. A sign-in that uses your phone's fingerprint, face recognition or screen lock instead of a code you can read out.
Linked device. A phone, tablet or computer connected to your WhatsApp account by a QR code or linking request.
SIM swap. A criminal getting a carrier to move your phone number onto a SIM they control.
Re-register. Signing in again with your number and the six-digit code, which logs out every other device.
