Your WhatsApp Was Hacked: What to Do in the First Hour

WhatsApp account takeovers are the most reported digital security incident in Malaysia. The attack is simple: the perpetrator obtains your six-digit WhatsApp verification code — usually by impersonating a friend who "accidentally" sent it to your number — and uses it to register your account on their device.

Within minutes, they are messaging your contacts pretending to be you, typically requesting urgent money transfers via DuitNow or bank transfer. Your contacts trust the message because it comes from your number.

The first 60 minutes are critical. Here is exactly what to do.

The standard Malaysian WhatsApp takeover follows a predictable sequence:

1. You receive a WhatsApp message from a contact (whose account has already been compromised) saying something like: "Eh, I accidentally sent a verification code to your number. Can you forward it to me?"
2. Shortly after, you receive a legitimate WhatsApp SMS verification code.
3. If you forward the code, the attacker registers your WhatsApp account on their device.
4. You are immediately logged out of WhatsApp on your phone.
5. The attacker begins messaging your contacts requesting money.

The entire process takes under five minutes.

Signs your WhatsApp has been taken over:

• You are suddenly logged out of WhatsApp
• You receive a notification that your account is registered on a new device
• Contacts message you asking about unusual requests they received

Do not panic. The account is recoverable.

Open WhatsApp and enter your phone number. WhatsApp will send a new six-digit SMS verification code to your number. Enter it.

This is the most important step. WhatsApp only allows one active registration per phone number. By re-registering with your number, you force the attacker's session to expire. They are immediately logged out.

If the attacker has enabled Two-Step Verification on your account (a PIN they set), you will be asked for it. You won't know it. In this case:

• Tap "Forgot PIN"
• WhatsApp will send a recovery link to your registered email address
• If you don't have an email registered, you must wait 7 days for the PIN to reset

This 7-day window is why enabling Two-Step Verification on your own account — before an attack — is critical.

Immediately after recovering your account, send a broadcast message or post a status update:

"My WhatsApp was hacked earlier. Please ignore any messages asking for money or personal information sent from my number in the past [X] hours. I am now back in control of my account."

This is not optional. Your contacts may have already transferred money to the attacker. The faster you alert them, the more you limit the damage.

Once you have recovered access:

1. Enable Two-Step Verification immediately. Go to Settings → Account → Two-Step Verification → Enable. Set a PIN you will remember and add a recovery email.

2. Check linked devices. Go to Settings → Linked Devices and remove any devices you don't recognise.

3. Review your privacy settings. Set your profile photo, last seen, and status to "My Contacts" or "Nobody" to reduce your exposure.

4. Change your phone's voicemail PIN. Some attackers intercept verification codes via voicemail. Your carrier's default voicemail PIN (often 0000 or 1234) makes this trivial.

If any of your contacts transferred money to the attacker believing it was you, they should:

1. Contact their bank immediately — DuitNow transfers can sometimes be reversed within 24 hours
2. Report to PDRM at the nearest police station or via the CCID hotline: +603-2610 1559
3. Report to Bank Negara Malaysia via +603-2174 1717
4. File a report with NACSA at +603-8008 7000

The bank report must be filed within 24 hours for the best chance of reversal. After that window, recovery becomes significantly harder.

If the attacker had access to your WhatsApp for an extended period before you recovered it, they may have read sensitive conversations, downloaded media, or used your account to perpetrate further fraud against your contacts. If you also suspect your phone itself was compromised during the attack, a phone hack investigation can determine whether malware was installed alongside the account takeover.

A forensic investigation into social account takeovers can establish exactly what was accessed, document the attack timeline, identify the attacker's device fingerprint, and produce a report suitable for police proceedings or civil claims. If significant financial harm occurred to you or your contacts, this documentation is essential.