WhatsApp is how many of us talk to family, run small businesses, join community groups and even receive school and church announcements. That makes it a favourite target for scammers and snoops. The default settings are not always the safest, but you can fix most of the risks in about ten minutes.
Note: menu names can differ slightly between WhatsApp versions and between Android and iPhone. Look for the closest match if a label is different on your phone.
1. Turn on two-step verification (the most important one)
Two-step verification adds a PIN that WhatsApp asks for when someone tries to register your number on a new phone. Go to Settings → Account → Two-step verification, set a six-digit PIN that is not your birth year, and add an email address so you can recover it. Do not use the same PIN as your mobile money PIN.
2. Never share your six-digit WhatsApp code
A common takeover trick works like this: a stranger or a hacked contact asks you to send them “the code that just arrived by SMS.” That code is the key to your account. No one needs it, ever. If you get a code you did not request, ignore it.
3. Control who can add you to groups
Open Settings → Privacy → Groups and choose My contacts (or “My contacts except…”). This stops strangers from adding you to scam, betting or investment groups.
4. Limit what strangers can see
Under Settings → Privacy, review Last seen and online, Profile photo, About and Status. For most people, My contacts is the sensible choice. If you run a business account, decide what customers truly need to see.
5. Silence unknown callers
In Settings → Privacy → Calls, turn on Silence unknown callers. Calls from numbers not saved in your phone will not ring, which cuts down on spam and scam calls.
6. Lock private chats
Open a chat, tap the contact name, and look for Chat lock (the name may vary). Locked chats move to a hidden folder that needs your fingerprint, face or phone passcode. This helps if someone borrows your phone.
7. Check Linked devices
Go to Settings → Linked devices. Anything listed that you do not recognise should be logged out right away. Scammers sometimes link your account to a computer or browser to read your messages.
8. Review your Privacy Checkup
WhatsApp has a guided Privacy Checkup (in Settings → Privacy) that walks you through the main controls. It is a good way to catch anything this guide missed.
9. Use encrypted backups carefully
Chat messages are end-to-end encrypted while they travel, but backups to your cloud storage can be less protected unless you turn on end-to-end encrypted backup in Settings → Chats → Chat backup. If you enable it, store the password or key somewhere safe, because you may not be able to recover your backup without it.
Spot the scams that use WhatsApp
- “Hi, it’s me, I changed my number.” Verify by calling the old number before sending money.
- Urgent requests for mobile money from a friend’s account. Call them first, because their account may be hacked.
- Job or investment offers that ask for a fee up front.
- Links to “free data” or “win a phone.” Do not click them, and do not forward them.
If your account has been taken over
- Reinstall WhatsApp on your own phone and register your number again. You will receive a new code by SMS.
- Turn on two-step verification straight away.
- Warn your contacts through another channel that your account was compromised.
- Check Linked devices and log out anything unfamiliar.
- Visit WhatsApp’s official help centre for the latest recovery steps.
Frequently asked questions
Can someone read my WhatsApp chats without my phone?
Not normally, unless your account is linked to another device or you shared your verification code. That is why checking Linked devices and using two-step verification matters.
Is WhatsApp safe to use for business?
It can be, with the right habits: two-step verification, a locked phone, and careful handling of payment requests. Consider keeping customer chats separate from personal ones.
What should I do if a friend’s account sends me a strange message?
Do not reply with money or codes. Call your friend on a normal phone call to confirm, and tell them to check their account.
Final thoughts
Ten minutes today can save you a lot of trouble later. Turn on two-step verification, limit group invites, and never share your verification code. Then share this guide with the relatives who are most likely to be targeted.
