How to Recover a Hacked WhatsApp Account: Step-by-Step

Direct answer: To recover a hacked or hijacked WhatsApp account immediately, try to register your phone number again on your mobile device. Open WhatsApp, enter your phone number, wait for the 6-digit verification code sent via SMS, and enter it in the app. Doing this immediately logs the hacker out of your account on their remote device because WhatsApp only allows one active phone session per number. If the hacker has enabled "Two-Step Verification" (asking for a 6-digit PIN code you don't know), you must wait a 7-day security period to log in without the PIN. During these 7 days, the hacker is already kicked out of your profile, and they cannot read your incoming messages or contact your friends.

Why password-protecting your WhatsApp account is critical

WhatsApp is no longer just a casual text messaging app. Today, it stores a vast array of our personal and professional lives. Work-related negotiations, bank details, personal photographs, and identification files are frequently sent and stored within chat histories. If someone gains physical access to your unlocked smartphone, they can easily read all your private exchanges, steal your digital identity, and even message your friends to request fake bank transfers or loans.

Identity theft on messaging apps has risen dramatically, with bad actors utilizing sophisticated social engineering tactics. For instance, scammers may target public Wi-Fi networks to intercept unprotected mobile traffic, or use device-level vulnerabilities. Having an app-specific lock acts as a critical line of defense, ensuring that even if your mobile operating system is bypassed or your physical device is snatched while unlocked in public, your conversations remain strictly off-limits.

Beyond physical theft, remote account hijacking is an active cyber threat. Attackers use social engineering scams to steal SMS activation codes or deploy SIM-swapping techniques at carrier stores. Without an internal security layer active, hackers can register your number on a new device instantly, locking you out of your account. Setting up biometric locks and two-step verification PINs is your best defense against these attacks.

If you ever find yourself locked out of your account due to an intrusion, check our detailed troubleshooting guide on how to recover a hacked WhatsApp account to regain access. For cases where your profile was disabled due to automated spam reports, our guide on how to recover a banned WhatsApp account outlines how to contact Meta support to submit an appeal.

How hackers hijack WhatsApp accounts: Common scams explained

To defend your personal data, you must understand the methods hackers use to steal profiles. WhatsApp uses your phone number and an SMS verification code as the master key to activate your account on any smartphone. The hijack relies on tricking you into revealing this code or intercepting your mobile network line.

The most common scams in 2026 include:

1. Fake Support and Online Listings: Scammers contact you pretending to be support staff from online marketplaces (such as Craigslist or eBay), hotels, or government departments. They claim they need to verify your account by sending you a verification code via SMS. In reality, they are triggering a registration request for your WhatsApp account, and you are handing them the keys.
2. SIM Swap (SIM Card Cloning): Cybercriminals gather your personal data from leaks and bribe carrier employees to move your phone number onto a blank SIM card they own. Your smartphone will instantly lose all network signal (showing "No Service" or "Emergency Calls Only"), while the hacker receives all your incoming SMS verification codes.
3. Linked Devices Abuse: A hacker gains physical access to your unlocked phone for a few seconds to scan a QR code, linking your profile to a web browser session that monitors your chats in the background.

If your device lost signal and is sluggish, verify that it isn't a temporary system glitch. If your device is running hot or slow due to low storage issues, see our guide on how to free up space on iPhone to optimize system speeds before diagnosing a hardware attack.

Step 1: Re-register your phone number on your device

The first action to take when you notice your WhatsApp displays the message "Your phone number is no longer registered on this phone" is to attempt to log back in immediately on your own device:

1. Open WhatsApp on your mobile phone.
2. Enter your phone number with the country code (+1 for the US, +44 for the UK) and tap Next.
3. Wait for the 6-digit registration code sent via SMS and type it on the screen.

In most instances, this resolves the problem. Since WhatsApp only runs on one smartphone at a time, registering the number on your device kicks the hacker out immediately. If your phone runs hot during this process, read our guide on iPhone overheating to cool down your device before continuing with safety setup configurations.

Step 2: What if the hacker enabled Two-Step Verification?

If you successfully enter the SMS code but the app prompts you for a 6-digit Two-Step Verification PIN code that you never created, the hacker has enabled Two-Step Verification to lock you out of your account.

While this is frustrating, WhatsApp has built-in protocols to protect the real owner of the number:

• Entering the SMS code instantly logs the hacker out of your account on their phone. This is because WhatsApp registration is session-exclusive. The hacker immediately loses access to your chat stream on their physical screen. They cannot send messages or view new incoming traffic.
• The app will place your account on a 7-day calendar hold. This security hold is designed to verify that the hacker cannot gain access to your private profile while you establish SIM ownership.
• During this 7-day hold, the account is completely suspended. The hacker is out, and you cannot read your chats yet. This ensures no new data is stolen.
• Once the 7-day period expires, open WhatsApp, tap Forgot PIN?, and reset your profile to log back in.

To prevent this scenario, you should set up your own PIN code immediately. Read our instructions on how to lock WhatsApp with password to activate two-step verification today.

Step 3: What to do in case of a SIM Swap (Line Hijack)

If your mobile phone loses cell service out of nowhere (displaying "No Service") and you are simultaneously logged out of WhatsApp, you are the victim of a SIM swap attack. You cannot receive SMS verification codes because your line is now active on the hacker's SIM card. Cybercriminals bypass standard security checks by manipulating carrier support lines.

Perform these urgent steps in order:

1. Contact your mobile carrier immediately: Call your operator from a family member's phone or visit a store to report your SIM card as stolen, which deactivates the hacker's chip.
2. Request a SIM replacement: Present your ID at your carrier's store to retrieve your phone number on a new SIM card.
3. Reclaim your WhatsApp: Insert the new SIM, open WhatsApp, and request the SMS code to log back in and secure your account.

To protect your account from SIM Swapping in the future, call your mobile carrier and request they set up a "Port Freeze" or a secondary passcode verification PIN on your account. This prevents customer service representatives from transferring your line to a new SIM card without verifying your custom password first.

If your device has battery drain issues or fails to turn on during this recovery phase, see our guide on what to do when your iPhone not charging is blocking power connections.

Step 4: Deactivating your account via email support

If you cannot retrieve your phone line immediately, if your SIM card was stolen, or if you are in a location with no cellular signal and need to stop the scammer from messaging your contacts, you can email WhatsApp support to deactivate your account temporarily.

To request deactivation by email:

1. Send an email to: support@support.whatsapp.com.
2. Use the exact subject line: "Lost/Stolen: Please deactivate my account".
3. In the body of the email, write your phone number in full international format (including country code and area code). For example: +1 (555) 123-4567.
4. Send the email.

WhatsApp's automated systems will process your request and suspend your profile within a few hours. The account will remain deactivated for 30 days. If you do not reactivate the number on a new SIM card within 30 days, your account settings and cloud backups will be deleted permanently. If you regain access and need to search for missing local chats, refer to our guide on how to recover WhatsApp messages without backup.

Step 5: Logging out of unauthorized WhatsApp Web sessions

If you can access WhatsApp on your phone but notice chats are marked as read without you opening them, or if you suspect someone is reading your messages, an unauthorized WhatsApp Web session may be active.

To disconnect all linked devices immediately:

1. Open WhatsApp on your mobile phone.
2. Go to Settings and select Linked Devices.
3. Review the list of active browsers, computers, and approximate locations.
4. Tap on any device you do not recognize and select Log Out (Sign Out).

This invalidates the session keys instantly, closing the browser window on the hacker's computer. If you use WhatsApp Web for work and have connection issues after logging out, read our guide on what to do when WhatsApp Web not working prevents secure access.

Preventing Voicemail-based Hacking Attacks

An extremely common hacking method occurs while the victim is asleep. Hackers register your WhatsApp number on their device and request verification. When the app sends an SMS, they ignore it and click the "Call Me" button instead. Since your phone is quiet or set to Do Not Disturb, the call goes to your voicemail. The automated WhatsApp robot leaves the verification code in your voicemail recording. Hackers can then access your voicemail system remotely if your carrier has a default PIN (such as 0000 or 1234). To prevent this, go to your phone settings or call your carrier to set up a strong password for your voicemail box, or turn off remote access entirely.

How to secure your WhatsApp profile against future hijack attacks

Prevention is always the best defense in digital security. Adopt these four rules to lock down your account:

• Activate Two-Step Verification: Create a personalized 6-digit PIN and add a backup email address.
• Protect your email account: Ensure the email linked to your WhatsApp has a strong password and two-factor authentication active, as it is the final line of defense for recovery links.
• Never share SMS registration codes: Even if a friend or support worker asks for a code, refuse. Call them to confirm their identity.
• Watch for unusual phone behavior: If your phone restarts constantly or shows logical errors after unauthorized setup attempts, read our guide on iPhone keeps restarting to check device health.

Conclusion

Having your WhatsApp hijacked is a stressful event that requires quick action. By logging back in with your SMS verification code, blocking your cell line after a SIM swap, or emailing Meta support for an emergency deactivation, you can stop scammers from using your identity. Setting up a secure two-step PIN remains the easiest and most robust way to protect your chats.

Frequently Asked Questions about WhatsApp Account Recovery (FAQ)