🔑 WhatsApp Verification Code Explained — Why You Got One and What to Do

Saturday, 19 September 2026

A WhatsApp verification code is a short code WhatsApp sends to your phone to prove that a phone number belongs to you. You should only ever see one in two situations: when you install WhatsApp on a new phone, or when you set WhatsApp up again on your own device.

If a code has arrived when you didn't ask for one — or if somebody has just asked you to "pass on a code" — treat it as a warning, not a glitch.

⚡ Quick answer: a WhatsApp verification code is the key to your account. Never send it to anyone. Not a friend, not a family member, not "WhatsApp support", not your bank. If you did send one, re-register your number on your own phone now and turn on two-step verification.

🚨 Has someone asked you for a code?

Don't share it. The code only ever belongs to you.
The request is the attack. Someone is trying to register your number on their phone.
Already shared it? Re-register your number and switch on two-step verification — steps below.
Warn your contacts — the next messages will come from your name.

What a WhatsApp verification code is

WhatsApp ties an account to a phone number, not to a device. To set the app up on a new phone, you enter your number and WhatsApp texts a 6-digit code to that number. Enter the code, and the account is registered on that device.

So the code exists for one purpose: to prove that the person holding the phone is the person who owns the number.

That also makes it the one thing a scammer cannot get on their own. They can buy your number, copy your name and photo, and message your contacts — but the code is texted to your phone. They need you to hand it over.

Why you got a code you didn't ask for

If you didn't just install WhatsApp, there are a few realistic explanations:

Someone is trying to register your number on their own device. They entered your number into WhatsApp and triggered the code. This is the account-takeover attempt.
Someone you know has been hacked and your number is being used. Hijacked accounts work through contact lists — your number came from a friend's phone book.
You are actually setting the app up yourself on a new or replacement phone, and forgot you had started — check before you worry.
A number has been recycled. If you recently received a new SIM with a recycled number, an old owner's account activity can occasionally trigger messages.

If it's the first two, the code sitting on your screen is the last line of defence.

The rule that never changes

Your code is for your eyes only.

WhatsApp will never ask you to read out a code
Your bank will never ask for a WhatsApp code
No company, courier, government department or police officer needs it
A genuine friend who is locked out of their own account still does not need your code — their code goes to their phone

If someone asks for a code, the message is a scam even when it comes from a real account belonging to someone you know. That account has been taken over.

What happens if you send it

The scammer types your code into WhatsApp on their phone
Your account registers on their device — and yours is logged out
They message your contacts, pretending to be you
Those messages ask for codes ("I sent you one by mistake") or money ("I'm stuck, can you transfer it?")
Each person who helps becomes the next hijacked account

That chain is why speed matters. Recovering your account quickly stops the spread.

What to do in the next five minutes

If you have already sent the code:

Re-register your number on your own phone. Open WhatsApp, enter your number, and when it asks for the 6-digit code, don't re-enter the old one — tap "Didn't receive the code?" → "Resend". A fresh code is sent and can log the hijacker out
Turn on two-step verification — Settings → Account → Two-step verification → set a PIN. This stops the code alone from being enough
Check linked devices — Settings → Linked devices → remove anything you don't recognise
Warn your contacts — before the scammer messages them
If money was lost, report to Action Fraud and call your bank's fraud line

If you have not sent it (and won't):

Do nothing with the code — let it expire, and never forward or screenshot it
Turn on two-step verification anyway, so a code alone can never take your account
Block and report whoever asked, then tell the person whose account messaged you — they are a victim too

Two-step verification: the setting that makes the code useless

Two-step verification adds a PIN that you set yourself. When someone tries to register your number on a new device, WhatsApp asks for that PIN as well as the SMS code. Without the PIN, a stolen code takes them nowhere.

Set it once, in under a minute: Settings → Account → Two-step verification → Enable, then add a recovery email so you can reset the PIN if you forget it.

Stop it spreading to your contacts

Your contact list is the scammer's next target. Warn them in a way they'll act on:

"My WhatsApp was compromised today. If you get a message from my number asking for a code or money, it isn't me. Please don't send anything — call me on my usual number to check."

Also worth doing:

Post it as a WhatsApp status so everyone who has your number sees it
Tell the people most likely to pay quickly — parents, grandparents, close friends
Pass on the rule: no codes, no money, verify by calling a saved number

How to report it

Report the chat inside WhatsApp — block the number first
Report to Action Fraud on 0300 123 2040 or actionfraud.police.uk — especially if money was lost
Call your bank's fraud line if a payment was made — bank transfers may be recoverable under APP fraud rules: how to get your money back after a scam
Note your crime reference number — you'll need it for bank and insurance claims

Common questions

"Is a WhatsApp code the same as a bank one-time passcode?" No — they are different codes from different systems, and both are dangerous to share. If someone says they are from your bank and asks for a code, see the fake bank-call scam.

"Can I just send the code to a friend who is locked out?" No. Their own code goes to their own phone. A request for your code is the scam.

"Why do I keep getting codes?" Someone keeps trying to register your number. Keep refusing to share, and switch on two-step verification so the codes can't be used.

"The code arrived but nobody asked me for it — am I safe?" Yes, as long as you didn't share it. The attempt failed. Turn on two-step verification in case they try again.

"I shared my code and now I can't get back in — what now?" Re-register your number first, then follow the recovery steps in our WhatsApp code scam guide, including contacting WhatsApp support if a PIN you didn't set is blocking you.

Related guides

CyberAware UK — helping families report crime, recover from scams, and stay safe online.