Overview
- NCCIA warns WhatsApp users about account takeovers and urges immediate re-registration if access is lost or suspicious use is detected.
- Users are instructed to uninstall and reinstall WhatsApp, enter their phone number, then input the six-digit SMS verification code without delay.
- Entering the SMS code logs out the intruder because a WhatsApp account can be active on only one mobile device at a time.
- If two-step verification was enabled by the attacker and the PIN is unknown, WhatsApp may require a seven-day wait during which no one can use the account or read messages.
- Users who previously linked an email can select “Forgot PIN” to reset two-step verification immediately, and NCCIA urges ongoing vigilance and adherence to security guidance.