Skip to content
Cyberschutz.io

Protect WhatsApp and social media: secure your accounts against takeover

How to stop someone taking over your WhatsApp, Instagram or other social media account: second factor, linked devices, codes and changing numbers.

Checked on · Cyberschutz.io editorial team

Contents

Short answer

Most account takeovers start with a stolen password or a code that was passed on. Protect yourself with a unique password, two-step verification, up-to-date recovery details and a regular look at linked devices. Never pass on verification codes – not even to friends.

How accounts are typically taken over

Stolen login details

Passwords from data breaches are tried on other services. Anyone reusing the same password is especially exposed.

Phishing and fake login pages

Messages lure you to imitation sign-in pages that capture password and code.

Shared one-time codes

Often a supposedly known contact writes that a code was sent to you “by mistake”. Forwarding it often unlocks your own account.

Compromised email account

Whoever controls your inbox can reset passwords for many services.

Lost device or number problems

An unlocked phone, or a phone number that passes to someone else, can give access to your messenger.

Signs of a takeover attempt

  • Unexpected verification codes by SMS or call
  • Login notifications from unknown devices or places
  • A contact asks you to forward a code
  • New linked devices you don’t recognise
  • Emails about changed passwords, email addresses or phone numbers

Step by step

  1. 01

    Unique password and second factor

    Use a separate password for each account and turn on two-factor sign-in. If the service supports passkeys, they’re a good option. Our guide to passkeys and MFA explains the basics.

  2. 02

    WhatsApp: two-step verification

    Turn it on in the account settings. When re-registering, it additionally asks for a PIN you chose, which is different from the six-digit SMS code. Add an email address so you can reset the PIN.

  3. 03

    Check linked devices and sessions

    In WhatsApp look under “Linked devices”, and in social networks check active sessions in the security settings. Sign out anything you don’t recognise.

  4. 04

    Keep recovery details up to date

    Check the stored email address and phone number. Outdated details make recovery harder for you and can help others.

  5. 05

    Only use QR-code logins deliberately

    Only scan a login QR code when you’re linking a device yourself. Someone asking you to scan a code for them may gain access that way.

  6. 06

    Take login notifications seriously

    Check alerts about new sign-ins directly in the app, not via links in emails. If it wasn’t you, change your password.

  7. 07

    Keep device, app and system up to date

    Lock your phone with a code and install updates promptly. Depending on the platform there are further security features – check them in the settings.

  8. 08

    Change numbers the right way

    Change your number in WhatsApp first via “Change number” before giving up the old one. Otherwise chats and account can pass to whoever later gets the old number.

Checklist

  • Every account has its own password.
  • Two-factor sign-in or two-step verification is on.
  • Recovery email and phone number are current.
  • Linked devices and sessions are checked.
  • I never pass on verification codes.
  • Phone is locked, app and system are up to date.

Common mistakes

  • Forwarding a verification code to a “friend”.
  • Scanning someone else’s QR code for them.
  • Using the same password for email and social networks.
  • Cancelling the old phone number without changing it in WhatsApp first.
  • Checking login warnings via a link in the email.

Frequently asked questions

Can someone take over my WhatsApp account with just my phone number?

Usually not with the number alone – registration requires a verification code. It becomes dangerous if that code is passed on or the number goes to someone else. Two-step verification adds an extra hurdle.

What are linked devices?

Other devices such as a computer or tablet where your WhatsApp account also runs. You’ll find them in the settings and can sign out unknown devices there.

Do all services offer passkeys?

No. Whether a service offers passkeys or particular two-factor methods depends on platform, device and rollout. Check the security settings.

I’ve already been locked out – what now?

Then the immediate steps in our incident help for hacked social media accounts will guide you.

Why is a friend messaging me about a code?

Often their account has already been taken over and the message comes from scammers. Check via another channel and pass nothing on.

Sources

Checked on 7 October 2026.

Read next