The WhatsApp verification code scam is one of the easiest ways to lose your account in Nigeria, and it usually begins with a message from someone already saved in your phone. WhatsApp sends a six-digit code by SMS whenever your number is being registered on a new device, and whoever types that code in can move your whole account, chats, groups and all, onto their own phone.
The National Information Technology Development Agency has warned Nigerians never to share WhatsApp verification codes, even with people claiming to be from WhatsApp, and to switch on two-step verification. Most people who fall for it aren’t careless at all. They simply trust the name at the top of the chat, and the scam is built around exactly that trust.
The message looks like it’s from your friend because it’s coming from their account
By the time the request reaches you, the scammer has usually taken over your friend’s or relative’s account already. They message people in that contact list with a story about sending a code to your number by mistake and asking you to forward it, or they say they’re trying to log in and the code keeps going to your line. What’s actually happening is that they’ve started registering your number on their phone, so the code that lands in your SMS is the key to your own account.
Once you send it, you’re logged out, and the scammer starts working through your contacts the same way. Some will be asked for the code, while others get a request for money with an urgent reason, a hospital bill, a stuck transfer or a promise to pay back by evening. If the account number they send carries a name that has nothing to do with the person you think you’re chatting with, treat that as a clear warning sign.
Two-step verification makes a stolen code useless on its own
Open WhatsApp and go to Settings > Account > Two-step verification, then tap Turn on. You’ll create a six-digit PIN and can add an email address, which is worth doing because it lets you reset the PIN if you forget it. With this switched on, anyone who tricks you into sharing your SMS code still needs your PIN before they can get into the account, and WhatsApp will ask you for that PIN from time to time so you don’t forget it.
While you’re in the app, check Linked devices (in Settings on iPhone, or the three-dot menu on Android) and log out of any computer or browser you don’t recognise. Keep WhatsApp updated from the Play Store or App Store too, and be careful with links and files from contacts who suddenly start writing in a way that doesn’t sound like them.
If your account has already been taken, act quickly
Reinstall or open WhatsApp, sign in with your phone number and enter the six-digit code sent to you by SMS. Verifying your number this way automatically logs out whoever is using your account on the other phone. If WhatsApp then asks for a two-step verification PIN you never set, the scammer has added one, and according to WhatsApp’s guidance on stolen accounts you’ll have to wait seven days before you can sign in without it. They lose access as soon as you verify your number, even during that wait.
In the meantime, call or text your close contacts, and post on your other social media accounts, telling people not to send money or codes to your WhatsApp. If you’re an admin in family, church or estate groups, ask a co-admin to remove the hacked number and warn the group. Group members who mute WhatsApp groups as soon as they join may miss a typed warning, so a voice note from another admin can help. If anyone has already sent money, they should call their bank straight away and report it, since a quick report gives the bank the best chance to act.
A one-minute call beats any code or transfer request
Whenever a friend asks for a code or urgent money on WhatsApp, call them on their normal line before you do anything. The real person will usually have no idea what you’re talking about, and that short call can save you from losing both your account and your money. The same instinct helps with other tricks doing the rounds, like the fake transfer screenshot that isn’t money until it shows in your balance, and the NITDA website carries more advisories on staying safe online.
Turn on two-step verification today, even if you think nobody would bother hacking you, and tell the people in your family group chat to do the same. If an older relative isn’t comfortable with phone settings, sitting with them for a minute to set the PIN could be the most useful thing you do on WhatsApp this week.
Join the conversation