The WhatsApp “Send Me the Code” Scam: How It Works and How to Stay Safe

WhatsApp accounts are tied to a phone number, and whoever can receive the verification code for that number can register the account on a new phone. Scammers exploit that by getting the account owner to hand over the code. The trick works because the message often comes from a friend's account that was already hijacked, so it feels trustworthy. This guide explains how the scam unfolds, the warning signs, the settings that stop it, and the steps to recover if your account was taken.

How does the scam work?

The scammer enters your phone number in WhatsApp on their own device. WhatsApp sends a verification code to your phone by SMS. At the same time, the scammer messages you, often from a contact's account they already control, with something like “Sorry, I sent my code to your number by mistake, can you send it to me?”

If you forward the code, they complete registration and your WhatsApp logs out on your phone. They can then message your contacts as you, repeat the scam on them, ask for money, or join your groups. Variants claim to be WhatsApp support, a competition, or a delivery service needing the code to confirm something.

• An unexpected WhatsApp code arrives by SMS.
• Someone, even a friend, asks you to send them the code.
• The request feels urgent or embarrassed: “please quick.”
• You're told the code is for a prize, a vote or a verification.

Why does it work so well?

The request usually comes from someone you know, and the story is plausible: anyone can mistype a number. It also asks for something that seems harmless, just six digits. Most people don't realize that the code is the key to their entire account.

WhatsApp's own SMS warns you not to share the code, but people skim those messages. A good rule of thumb is that there is no legitimate reason for anyone else to need a code sent to your phone.

How to protect your WhatsApp account

Two-step verification is the most important setting. It adds a six-digit PIN you choose, which WhatsApp asks for when the number is registered on a new phone. Even if someone gets the SMS code, they can't finish registration without the PIN. Turn it on under Settings, then Account, then Two-step verification, and add an email address so you can reset the PIN if you forget it.

WhatsApp has also added passkeys on supported phones and email verification for accounts. Using these reduces how much depends on SMS alone. Keep your WhatsApp app updated so you get the newest protections.

• Never share a WhatsApp code with anyone, including friends and support staff.
• Turn on two-step verification and add an email.
• Set up a passkey if your phone supports it.
• Ask your carrier for an account PIN or port-out lock to reduce SIM swap risk.

Step by step

1. Don't share the codeIgnore any request for a WhatsApp code, even from a friend.
2. Turn on two-step verificationSettings > Account > Two-step verification, then set a PIN.
3. Add an emailUse it to reset your PIN and as an extra verification route.
4. Warn the contactReach your friend another way; their account may be compromised.
5. Re-register if hijackedVerify your number on your own phone to log the scammer out.

What if a friend's account asks for your code?

Assume their account may have been hijacked. Don't send the code. Contact your friend another way, such as a phone call or a different app, to warn them. If you have the scammer's chat open, you can report and block the contact within WhatsApp.

If you receive a WhatsApp code you didn't request, it simply means someone typed your number. Ignore it. Without the code they can't get in, and two-step verification adds another lock.

What to do if your account was taken

Open WhatsApp on your phone and register your number again. WhatsApp will send a new code to your SIM. When you verify, the scammer is logged out. If they enabled two-step verification first, you may have to wait before you can register without the PIN; WhatsApp has used a waiting period of several days in this case.

While you recover, warn your contacts through other channels not to send money or codes. You can also email WhatsApp support from the help pages in the app. Afterward, turn on your own two-step verification. Never try to recover with a temporary number: WhatsApp accounts belong to the number they were registered with, and temporary numbers should only ever be used to verify your own new accounts.