WhatsApp hacking: the code you forwarded was your account
The six-digit code WhatsApp sends by SMS is the key to your account, and WhatsApp never needs you to send it to anyone, including WhatsApp. If a friend, a relative or a "support" number asks you to forward a code that just arrived, the code is for your number, the request is coming from an account that has already been taken, and sending it hands over yours. To get an account back, reinstall WhatsApp and register your number again; the code that arrives then is yours alone.
How it plays out
The cousin who needed a code, and the forty friends who needed ₹15,000
The message is from his cousin, on his cousin's number with his cousin's photo: "Sorry, I sent a code to your number by mistake, can you forward it?" An SMS has in fact just arrived, six digits, from WhatsApp. He forwards it, because it is his cousin, and the cousin is in a hurry.
WhatsApp logs him out. When he tries to open it, it asks him to register, and the code it sends does not arrive, because his number is now registered on another phone. He assumes a glitch and goes back to work.
Over the next hour, forty of his contacts receive a message from him. A medical emergency, a payment that failed, could they send ₹15,000 to this UPI ID, he will return it tonight. Two of them do. One of them, before sending, calls him, and the phone call is how he finds out.
His cousin's account had been taken the same way the day before, which is how the message had come from the right number with the right photo. The chain is the mechanism: every account captured is used to capture the next, and to ask everyone in it for money.
₹30,000 sent by two friends to a UPI ID in his name, and an account that took a week to recover because the attacker had set two-step verification on it.
A composite of the WhatsApp account-takeover pattern as described in WhatsApp's own help pages, the Department of Telecommunications' call-forwarding advisory and Indian police advisories, including the forwarded-code and emergency-money stages. No real person or case is depicted; the amounts are illustrative.
Where it could have stopped
The request itself. A WhatsApp code is sent to the number being registered, so a code that "arrived by mistake" cannot exist: the only way a code for his number reaches his phone is that someone is registering his number. Any request to forward it, from anyone, is that someone.
High riskWhat EnfoldAI does here
Scam checker
The "forward me the code" message and the "urgent, send money" message are both text that can be pasted into EnfoldAI, and the checker recognises both scripts. The code SMS itself is genuine, which is exactly why the message asking for it is what has to be checked.
Paste any message, link or app.
Auto-check with EnfoldAIHow this scam works
The order is the explanation. Find where your own experience stops in this list. That is how far along the script has run.
- The attacker enters your number in WhatsApp on their phone. WhatsApp sends the registration code to you, by SMS or by a voice call. Everything that follows is about getting that code out of you or around you.
- The commonest route is a message from an account that was captured earlier, often someone you know: a code was sent to you by mistake, please forward it. The code you forward registers your number on their phone, and you are logged out.
- The call-forwarding route: a caller claiming to be from your operator, your bank or a delivery company asks you to dial *401# followed by a number "to fix a network problem". That code forwards your calls to that number; the attacker then asks WhatsApp to deliver the code by voice call, and receives it.
- The APK route: a file sent over WhatsApp (a wedding invitation, a bank update, a courier notice) installs an app that reads your SMS, including the code, and your OTPs. The fake apps page covers it.
- Once in, the attacker sets two-step verification so that you cannot simply re-register, then messages your contacts in your name: an emergency, a failed payment, a request for money to a UPI ID. Groups you are in are used to reach people who would not answer a stranger.
- Your contacts' accounts are attacked from yours with the same "forward me the code" message, which is how the chain continues.
- A newer corporate version sends a finance team a file disguised as a bank statement or a regulator's notice, from a senior executive's captured account, with instructions to pay a vendor.
If it has already happened
In order, and the order matters. The first step is the one that can still get the money held, so it comes before everything else.
- Reinstall WhatsApp and register your number. The code goes to your SIM, so registering again logs the attacker out. If two-step verification has been set by them, WhatsApp makes you wait before you can re-register; start the wait now.
- Tell your contacts, from any other channel (a call, SMS, another app, a family group), that the account is compromised and that any request for money from it is the attacker. Do this before anything else that can wait; the money requests go out in the first hour.
- If someone sent money because of a message from your account, they should call their bank at once on the number on their card and ask for a fraud dispute on the transfer. That is their complaint to make, and speed decides it.
- They should then report on 1930 or at cybercrime.gov.in in the same hour, with the UPI ID the money went to, so the receiving account can be held.
- Cancel any call forwarding by dialling ##002# from your phone, and ask your operator to confirm none is active.
- If a file was installed, uninstall it, and change the passwords and PINs of every account that receives OTPs on that phone.
- Once back in, turn on two-step verification yourself with a PIN only you know, and review linked devices. Report the takeover at cybercrime.gov.in, especially if money was taken from anyone.
WhatsApp hacking: common questions
The questions people actually ask about this one, answered in a line or two each.
A friend asked me to forward a WhatsApp code sent to my number. Is that ever genuine?
My WhatsApp was hacked. How do I get it back?
A caller asked me to dial *401# with a number. What is that?
A friend sent money because of a message from my hacked account. Can they get it back?
Check before you trust
Paste any SMS, link or app and get a verdict before money moves. Auto-scan flags scam messages the moment they arrive.
Suspicious message? Check it free →