To keep your WhatsApp safe, do four things today: turn on two-step verification, never share the 6-digit code WhatsApp sends you, check Linked devices and remove anything you don't recognise, and never install APK files or modified apps like GB WhatsApp. These steps stop most account takeovers in India, where a hijacked WhatsApp is often used to ask your friends and family for money.
Never share your WhatsApp code. If someone, even a friend, says "I sent a code to your phone by mistake, please forward it", do not. That code lets them register your number on their phone and take over your account.
The WhatsApp security checklist
Menu names below are from the current Android and iPhone apps; they can move slightly between versions.
1. Turn on two-step verification
Go to Settings → Account → Two-step verification → Turn on. Choose a 6-digit PIN that is not your birthday or ATM PIN, and add an email address so you can reset it. Now, even if someone gets your SMS code, they also need this PIN to register your number on a new phone (UK Ministry of Justice security guidance on WhatsApp).
2. Never share the 6-digit registration code
WhatsApp sends this code by SMS or call only when someone tries to register your number. Nobody from WhatsApp, your bank, the police or a "prize team" ever needs it. If you get the code without asking for it, someone is trying to take over your number; ignore it, do not forward it, and make sure two-step verification is on.
3. Review Linked devices
Open Settings → Linked devices (on Android you may find it under the three-dot menu). You will see every computer, browser or tablet where your WhatsApp is open. Tap anything you don't recognise and choose Log out. Do this every few weeks, and always after giving your phone to someone for repair. A scammer only needs a few seconds with your unlocked phone to scan a WhatsApp Web QR code.
4. Tighten privacy settings
Go to Settings → Privacy. There is also a guided Privacy checkup on the same page that walks you through these options (AlternativeTo).
| Setting | Suggested choice | Why |
|---|---|---|
| Last seen and online | My contacts (or Nobody) | Strangers can't track when you are active |
| Profile photo | My contacts | Scammers copy photos to create fake accounts in your name |
| About | My contacts | Keeps personal details away from strangers |
| Groups (who can add me) | My contacts, or My contacts except… | Stops strangers adding you to "investment tips" and "task job" groups |
| Calls → Silence unknown callers | On | Calls from unknown numbers are silenced (they still show in your call list), which cuts down scam video calls |
5. Lock the phone and the app
Use a screen lock on your phone. WhatsApp also offers a fingerprint or face lock for the app itself under Privacy (named App lock, Fingerprint lock or Screen lock depending on your phone), which helps if your phone is shared at home.
6. Never install APK files sent on WhatsApp
A common trick in India is an APK (Android app file) sent on WhatsApp with a believable name: a wedding card, an RTO / traffic challan, a bank KYC update or a bill. Once installed, these apps can read OTPs and take over your WhatsApp and bank accounts, and some send themselves to all your contacts.
- Himachal Pradesh's State CID cyber unit warned in July 2025 about fake traffic challans sent on WhatsApp with malicious APK links that give criminals access to WhatsApp and the phone (The Tribune).
- In November 2025 police warned about fake wedding invitations carrying APK files, pointing out that genuine invitations are shared as JPG images or PDFs, not APKs (The Tribune).
Rule of thumb: if a file name ends in .apk, delete it. Keep Install unknown apps switched off in your Android settings. Check doubtful links with our link checker and read how to check if a link is fake.
7. Avoid GB WhatsApp, FM WhatsApp and other mods
Modified WhatsApp apps promise extra features like hiding blue ticks or seeing deleted messages. They are built by unknown third parties, downloaded from random websites as APKs, and have full access to your chats and phone. WhatsApp has said it cannot validate their security and has temporarily banned accounts that use unsupported apps (Gulf News). Back up your chats and switch to the official app from the Play Store or App Store.
8. Recognise WhatsApp scams, not just hacks
- "Friend in trouble": a known contact (whose account was hijacked) urgently asks for money on UPI. Call them on a normal phone call before paying.
- Video calls from "police" or "CBI": this is the digital arrest scam. Real officers don't arrest people on WhatsApp.
- Part-time job / investment groups: small "task" payments first, then large deposits you never get back.
- Unknown international numbers with missed calls or job offers. Block and report them inside WhatsApp, and on Chakshu at sancharsaathi.gov.in. See also how to identify a fraud call.
WhatsApp hacked? What to do
These steps follow WhatsApp's help page "How to recover a compromised account" and the UK Ministry of Justice guidance:
- Log in again with your own number. Open (or reinstall) WhatsApp, enter your number and the 6-digit code you receive by SMS. This automatically logs out the person using your account.
- If it asks for a two-step PIN you never set, the hacker set it. Without the PIN you may have to wait 7 days before you can log in; the hacker is still disconnected once the new code is sent.
- Tell your contacts quickly (by SMS, calls or a family member's WhatsApp) not to send money or codes to "you".
- Once back in: log out all Linked devices, turn on two-step verification with your own PIN, and add an email address.
- Check your phone for a malicious app if the takeover followed an APK or a link. See risky app permissions.
- If money was lost (yours or a contact's), call 1930 and file at cybercrime.gov.in. Our first-hour guide lists the steps.
વોટ્સએપ સુરક્ષા: ટૂંકમાં
- ટુ-સ્ટેપ વેરિફિકેશન ચાલુ કરો: Settings → Account → Two-step verification માં જઈને તમારો પોતાનો 6 આંકડાનો PIN સેટ કરો.
- 6 આંકડાનો કોડ કોઈને ન આપો, ભલે મિત્ર કહે કે "ભૂલથી તમારા ફોન પર આવ્યો છે". એ કોડથી તમારું વોટ્સએપ બીજાના હાથમાં જાય છે.
- Linked devices તપાસો અને અજાણ્યું કમ્પ્યુટર કે બ્રાઉઝર દેખાય તો Log out કરો.
- .apk ફાઇલ ક્યારેય ઇન્સ્ટોલ ન કરો, ભલે એ કંકોત્રી, RTO ચલણ કે બેંક KYC ના નામે આવી હોય. સાચી કંકોત્રી ફોટો કે PDF માં આવે છે.
- GB WhatsApp જેવી નકલી એપ વાપરશો નહીં. ફક્ત Play Store કે App Store માંથી ઓફિશિયલ વોટ્સએપ જ રાખો.
- વોટ્સએપ હેક થાય તો તમારા નંબરથી ફરી લૉગિન કરો, મિત્રો-સગાંને તરત જાણ કરો, અને પૈસા ગયા હોય તો 1930 પર ફોન કરો.
Frequently asked questions
How do hackers take over WhatsApp accounts?
Most often they trick you into sharing the 6-digit code WhatsApp sends by SMS, usually while pretending to be a friend who sent it "by mistake". Others get in through a malicious APK file, or by linking WhatsApp Web on your phone while you are not looking.
What is WhatsApp two-step verification?
It is a 6-digit PIN you set yourself under Settings, Account, Two-step verification. Anyone trying to register your number on a new phone needs this PIN as well as the SMS code, so it blocks most takeovers.
How do I know if someone is using my WhatsApp?
Open Settings, Linked devices and look for any computer or browser you do not recognise; log it out. Other signs are messages you did not send, or contacts telling you that "you" asked them for money.
Is GB WhatsApp safe?
No. GB WhatsApp, FM WhatsApp and similar modified apps are made by third parties, are installed from outside the Play Store, and WhatsApp cannot check their security. WhatsApp has also temporarily banned accounts that use unofficial apps.
My WhatsApp is hacked. Can I get it back?
Usually yes. Reinstall WhatsApp, register with your own number and enter the 6-digit SMS code; this logs the other person out. If they set a two-step PIN you do not know, you may have to wait 7 days before you can log in, so warn your contacts meanwhile.
This guide is general information, not legal advice. If you have lost money to fraud, call 1930 immediately or report at cybercrime.gov.in.