The first hour after someone takes over your WhatsApp
If you searched whatsapp account hacked what to do and landed here, skip the background reading and do these four things in order. One: open WhatsApp on your own phone and re-register your number, because the 6-digit code that arrives on your SIM signs the attacker's device out. Two: check Settings → Linked Devices and log out anything you do not recognise. Three: set a two-step verification PIN with a recovery email attached. Four: tell your contacts, through any channel that still works, that messages from your number may not be coming from you.
Sequence matters more than it looks here. Every hour an attacker holds the account, they are working through your address book, and the damage shifts from you to the people who trust you. For most readers, how to get back hacked WhatsApp account access really is just those four steps in that sequence; the complications further down this page affect a minority of cases.
Nobody legitimate will ever ask you for your 6-digit WhatsApp code. Not WhatsApp support, not your mobile carrier, and not us. That code is the entire account — there is no password sitting behind it. Anyone asking you to forward it is taking the number, not returning it, and that includes any paid "recovery service" whose first message is a request for those six digits.
Not certain a takeover is what happened? Our full WhatsApp recovery diagnostic guide walks through all five loss scenarios (plain reinstalls, bans, dead SIMs, missing chats, genuine hijacks) and sorts out which one you are actually in. This page assumes you already know the answer: somebody else has your account.
How do you know your WhatsApp was actually hacked?
Three mechanisms account for nearly every WhatsApp takeover we see, and telling them apart changes what you do next.
Verification-code theft. Someone messaged you, very often from a friend's account that was itself already hijacked, with a story about a code sent to the wrong number, and you forwarded the six digits. This is the most common route by a wide margin.
Linked-device hijack. The attacker scanned a WhatsApp Web QR code from your unlocked phone, or talked you into scanning a fake one. Your phone keeps working normally, which is exactly why this one goes unnoticed longest. The tell is a session under Settings → Linked Devices that you never created.
SIM swap. The attacker convinced your carrier to move your number onto their SIM. This tell is unmistakable: your own handset drops to "No SIM" or "SOS only" while wifi and everything else carries on. The FCC's consumer guidance on SIM swap scams sets out the carrier-side steps, and they are urgent — until the carrier reverses it, your whole number is gone, not just WhatsApp.
Of the 156 WhatsApp cases our team handled between January 2024 and June 2026, code theft accounted for the clear majority of takeovers. Linked-device hijacks were consistently the ones clients discovered latest, often days in. SIM swaps were the smallest group and by far the hardest to unwind, because the fix sits with a carrier rather than with WhatsApp (internal records, n=156).
If your code simply is not arriving, that is a different failure mode with its own causes. Our guide to when the six-digit code never arrives covers carrier filtering, number formatting, and rate limits.
How to recover a stolen WhatsApp account by re-registering your number
The mechanic behind how to recover WhatsApp account after hack is unglamorous: an account lives on exactly one phone at a time, and the phone that most recently passed the 6-digit check wins. You do not need to out-hack anybody. You need to prove the number is yours, from the SIM, before they entrench.
As of July 2026, stolen WhatsApp account recovery runs like this:
- Install official WhatsApp from the App Store or Google Play, not a modified client like GB WhatsApp, which will get the number banned on top of everything else.
- Enter your full phone number with country code.
- Enter the 6-digit code that arrives by SMS or voice call. Do not share it with anyone, at any point, for any reason.
- If you are asked for a two-step PIN that you set yourself, enter it.
- Open Settings → Linked Devices and log out every session you do not recognise.
- Set a fresh two-step PIN with a recovery email attached.
Step 3 is the whole game — everything people mean when they say they want to recover hacked WhatsApp account access happens in that single exchange. The moment that code verifies, the attacker's session dies — no negotiation, no appeal, no waiting on support. That is why how to recover stolen WhatsApp account has such a short honest answer, and why anyone charging hundreds for "priority recovery" of a straightforward takeover is selling you something you can do yourself, free, in about five minutes.
Two complications make it harder, and they affect a minority of cases: an attacker who set a two-step PIN before you got there, and a phone that is physically gone.
How to recover a WhatsApp account from a lost or stolen device
When the handset itself is missing, how to recover a WhatsApp account from a lost or stolen device becomes a carrier problem before it is a WhatsApp problem. Get a replacement SIM carrying the same number, since that alone restores your ability to receive the code. In parallel, email [email protected] from any address, with the subject line "Lost/Stolen: Please deactivate my account" and your number in full international format. WhatsApp's official stolen-account guidance documents that exact instruction, and deactivation freezes the account for 30 days so the thief cannot keep trading on it while you queue at a carrier shop.
Deactivation is not deletion. Register on a new phone inside that 30-day window and the account comes back. File a police report too if the device was physically taken, because carriers move faster on SIM reissue when there is a report number, and you will likely need one for an IMEI block. Once the number is back in your hands, our walkthrough on restoring WhatsApp on a replacement handset covers the backup side, and if the SIM is gone for good, recovery without a SIM sets out honestly what is and is not still possible.
The 7-day wait when the attacker sets a PIN first
Attackers who have done this before enable two-step verification within minutes of getting in, specifically to block your re-registration. You then enter your number, cannot produce a PIN you never set, and WhatsApp refuses to register the device. It starts a fixed seven-day countdown instead. There is no appeal, no escalation path, and no payment that shortens it.
That rule cuts both ways, which is the part worth holding onto. During those seven days the number cannot be registered on anyone else's device either — including theirs. Frozen for everybody, in other words. Your chats sit encrypted where they always were. Once the week elapses you register with a fresh SMS code, and the first thing to do is set your own PIN with a recovery email so the same lock cannot be turned against you twice. Anyone offering to skip that week is describing a mechanism WhatsApp does not have.
Stuck mid-recovery — a SIM swap your carrier is slow to reverse, a PIN you never set, or an attacker still messaging your contacts? Talk to a specialist about your hacked WhatsApp account in a free 60-minute case review. We will tell you honestly whether your case is recoverable before you spend anything, and we will never ask for your verification code or your PIN.
What the attacker did while they had your account
Knowing how to retrieve hacked WhatsApp account access is only half the incident. Once the account is yours again, spend ten minutes auditing what was done in your name, because whoever took it was almost certainly using it to reach people who trust you.
| Check | Where to look | What you are looking for |
|---|---|---|
| Active sessions | Settings → Linked Devices | Any device or browser you did not authorise |
| Two-step PIN | Settings → Account → Two-step verification | A PIN you did not set, or a recovery email that is not yours |
| Groups | Your chat list | Groups you were added to, or groups your account posted in |
| Sent messages | Individual chats | Money requests, code requests, or links sent to contacts |
| Profile | Settings → Profile | A changed name, photo, or About text used to impersonate you |
| Blocked list | Settings → Privacy → Blocked contacts | People the attacker blocked to slow down your warning |
The pattern we see most often runs in two waves: money requests to a handful of close contacts inside the first couple of hours, then code requests sent much wider. It is that second wave which turns one takeover into five. Attackers are working the address book, not the account.
A message you can copy and send to your contacts
Every guide tells you to warn people. Almost none of them give you the words, so here is the version our team hands to clients, short enough to read on a lock screen:
Heads up: my WhatsApp was taken over earlier today and I have just got it back. If you received a message from my number asking for money or for a 6-digit code, it was not me. Please do not send anything, and delete it. If you already replied with a code, reinstall WhatsApp and re-register your own number right now.
Send it from the recovered account and, if you can, from a second channel as well. Some contacts will have muted or blocked the number after the scam messages landed.
How to restore hacked WhatsApp account chats — and what is gone for good
How to restore hacked WhatsApp account access and restoring your messages are two separate jobs, and most guides blur them together. Access returns the moment your number re-verifies. Messages return only from a backup you already had.
WhatsApp encrypts messages end-to-end, so there is no readable copy sitting on a server for anyone to hand back to you. On Android the backup lives in Google Drive, on iPhone in iCloud, and both keep a local copy on the device. Reinstall and verify, and the app offers the most recent backup tied to that number, and only that one. Anything created after your last backup is gone. If backups were never switched on, those conversations are permanently unrecoverable. This is equally true for us, for WhatsApp, and for every service that claims otherwise.
One consequence people miss: if the attacker held the account for several days and the phone kept backing up during that window, the newest backup may capture their activity rather than your history. Check the backup date before you restore it.
What cannot be recovered, stated plainly: chat history with no backup; an account midway through the 7-day PIN wait, which nobody can shorten; a number your carrier has already reassigned to a different customer; and accounts banned for CSAM, terrorism, fraud, or sustained harassment. If a takeover ended in a ban rather than a lockout, that is an appeal rather than a recovery, and our appeal guide for a banned WhatsApp number covers that route instead.
Which "recovery services" are actually scams?
The search results you are reading right now are one of the most heavily farmed scam surfaces we track. Sites offering to "hire a hacker" to retrieve your account rank for these exact queries. Look closely and the offer is incoherent: there is nothing to hack, because recovery runs through an SMS code delivered to your SIM — but it converts anyway, because someone in the first hour of a takeover will pay almost anything to make it stop.
Three signals end the conversation, any one on its own: they ask for your 6-digit code, they ask for your two-step PIN, or they guarantee a result. We have never once seen a legitimate operator do any of the three. The same pattern runs through the wider tooling market — when our team tested the products sold as WhatsApp mass-report bots, none of them did what the sales page promised either.
Here is what we will not do, on any case: ask for your verification code or PIN, promise recovery, file false reports, or take money for an outcome we do not believe is achievable. We turn down cases we think are unrecoverable rather than bill for them. The limits of what recovery work can achieve are set out in full on our disclaimer page. Clean recoveries typically resolve inside 24–72 hours, and nothing about a PIN wait or a ban review moves faster than the platform itself allows.
Should the attacker still be running an impostor account on a second number and messaging your contacts, reporting that number is a separate and entirely legitimate step — our guide on getting a hacker's WhatsApp number actioned explains how those reports escalate. US victims whose money actually moved should file with the FBI's Internet Crime Complaint Center, because bank and carrier reversals often need a complaint reference. And where a takeover has spilled onto other platforms, the response pattern is the one we use for a hacked Instagram account or a hijacked Telegram account: re-verify, cut the sessions, harden, then warn.
When DIY genuinely runs out — a carrier dragging its feet on a SIM swap, a business number with staff depending on it, a takeover that has already spread across accounts — that is where hands-on help to restore a hacked WhatsApp account earns its place.