WA Folders
Home / Blog

Got a WhatsApp code you didn't ask for? What it means and what to do

Published

A text that says "Your WhatsApp code is ..." when you didn't ask for one is unsettling, and this weekend r/whatsapp filled up with people getting them. One person said someone had been trying to register their number for almost two months, with codes arriving over and over, two prompts asking whether to transfer the account to another phone, and one stretch where they were kicked out entirely. Another person got a "WhatsApp Business code" even though they don't use WhatsApp at all.

The short version is that an unrequested code on its own means you are still in control. What matters is what you do with the code and which protections you have switched on before the next attempt.

What the code actually means

WhatsApp's help center says that when you get a verification code you didn't request, someone entered your phone number and asked for a registration code. Sometimes that's a person who mistyped their own number. Sometimes it's someone trying to take over your account.

Either way, the code is sent to your phone, by SMS or call. Without it, the other person can't finish verifying your number, and WhatsApp says you keep control of your account. WhatsApp also says it can't identify who requested the code, so support won't be able to tell you who it was.

That's also why you can get a code for WhatsApp Business without having WhatsApp. Anyone can type any number into the registration screen. The code going to you is the system working as intended.

The one rule: never send the code to anyone

Almost every account takeover starts with the owner handing over the code. The UK's Action Fraud describes the usual pattern. A message arrives from what looks like a friend or someone from one of your groups. Around the same time, you get the six-digit code by text. The "friend" says they sent their code to your number by mistake and asks you to forward it. Once they have it, they log in as you and lock you out, then try the same message on your contacts.

WhatsApp's own wording is that you should never share the code with others, "not even friends or family." No real friend needs your code. If someone you know asks, call them on the phone before doing anything.

If you were logged out

Getting kicked out with a message that your number was registered on another device is scarier, but WhatsApp's recovery steps are short:

  1. Open WhatsApp and tap Log back in, then Continue.
  2. Enter your full phone number with the country code if asked.
  3. Enter the 6-digit code you get by SMS or phone call.

According to WhatsApp, re-registering with that code automatically logs out every device that was signed in to your account, including the other person's. Your past chats stay safe because messages are stored on your device and are end-to-end encrypted, so someone who registers your number elsewhere can't read your old conversations. If you had a Google Drive or iCloud backup, you can restore from it when you log back in.

You may be asked for a two-step verification PIN you don't recognize. That can mean the other person turned on two-step verification while they had your account. WhatsApp says they are still logged out the moment you enter the SMS code, whether or not you know the PIN. If you can't reset the PIN, you have to wait 7 days from the last time your account successfully connected, and WhatsApp says it can't shorten that wait. Nobody can get into the account during those 7 days.

Changing a password elsewhere won't remove someone from your WhatsApp account. Re-registering with the SMS code is the only way, according to the help center.

One more warning from WhatsApp itself. If you report the account you're trying to recover, it may get banned, and you could lose access to it along with your data. Recover it first.

Turn on these settings before the next attempt

If codes keep coming, these protections stop a code from being enough on its own:

  • Two-step verification. Go to Settings, then Account, then Two-step verification, and turn it on. You choose a 6-digit PIN that WhatsApp asks for when your number is registered on a new phone. Deleting and reinstalling WhatsApp doesn't turn it off.
  • A recovery email. Add it when you set up the PIN, or later in the same menu. With an email on file you can reset a forgotten PIN right away with a reset link, instead of waiting 7 days.
  • A passkey. In Settings, then Account, then Passkeys, you can set up a passkey that uses your fingerprint, face, or screen lock. When you register again, you can use the passkey instead of an SMS code. On Android it needs Android 9 or later, a screen lock, and a Google account on the phone.
  • Linked devices. Check the list of devices linked to your account and log out of any you don't recognize. Someone with access to a linked computer can read new messages without ever touching your phone.

Then tell your contacts that you've had takeover attempts, so they know to be suspicious if "you" suddenly ask for a code or money.

What you can't stop

There's no setting that stops other people from typing your number into WhatsApp. People on Reddit report being temporarily locked out of requesting codes after a lot of attempts, with messages telling them to wait before trying again. That's annoying when you need a code yourself, but it's a side effect of the same limits that slow attackers down.

With two-step verification and a recovery email in place, a stranger requesting codes for your number becomes a nuisance you can ignore. Delete the texts, don't reply to anyone asking about them, and keep the PIN to yourself.

FAQ

Why did I get a WhatsApp code I didn't request?

Someone entered your phone number in WhatsApp's registration screen and asked for a code. It may be a typo by someone registering their own number, or a takeover attempt. WhatsApp can't tell you who it was.

Can someone get into my WhatsApp without the code?

No. The code goes to your phone by SMS or call, and without it the other person can't finish verifying your number. WhatsApp says you keep control of your account.

What should I do with the code?

Nothing. Don't forward it to anyone, not even a friend who says they sent it to you by mistake. Delete the message.

How do I get back in if I was logged out?

Open WhatsApp, tap Log back in, enter your number and the 6-digit code you get by SMS or call. Re-registering logs out every other device on your account.

How do I stop the codes from being enough on their own?

Turn on two-step verification in Settings, then Account, add a recovery email, and consider a passkey. A stranger with a code then still can't register your number.

Sources