WhatsApp Account Hijacking: How to Spot the Six-Digit SMS Code Scam Targeting Australian Small Businesses

Summary

This guide helps you troubleshoot and resolve: WhatsApp Account Hijacking: How to Spot the Six-Digit SMS Code Scam Targeting Australian Small Businesses. Follow the steps below to fix the issue.

Common Causes

WhatsApp account hijacking is a growing threat to Australian small businesses. Attackers attempt to take control of your business messaging account by requesting a six-digit SMS verification code sent to your mobile number. If you share this code, the scammer can register your WhatsApp account on their own device, locking you out and potentially using your identity to scam your clients, suppliers, and staff.

How the Six-Digit SMS Code Scam Works

The attacker installs WhatsApp on a new device using your mobile number. WhatsApp sends a six-digit verification code via SMS to your phone. The scammer then contacts you—often pretending to be a friend, colleague, or WhatsApp representative—and asks you to forward the code they "accidentally" received. Once you provide the code, the attacker completes the registration on their device and your WhatsApp session is logged out.

Enable Two-Step Verification

Two-step verification adds a six-digit PIN that you create. Even if an attacker obtains your SMS code, they cannot register your number without this PIN.

1. Open WhatsApp on your mobile device.
2. Tap Settings (iOS) or the three-dot menu and select Settings (Android).
3. Tap Account, then tap Two-step verification.
4. Tap Enable.
5. Enter a six-digit PIN of your choice and confirm it.
6. Provide an email address for account recovery, or tap Skip if you do not wish to add one (adding an email is recommended).
7. Tap Next or Done to finish.

Regain Access to a Hijacked Account

1. Install WhatsApp on your phone if it is not already installed.
2. Enter your mobile number when prompted.
3. Enter the six-digit SMS code sent to your device.
4. Once you successfully verify, the attacker is automatically logged out of all active sessions.
5. If two-step verification was enabled by the attacker and you do not know the PIN, you must wait seven days before you can reset it without the email address.

Check Linked Devices

Review which devices are linked to your WhatsApp account and log out any that you do not recognise.

1. Open WhatsApp.
2. Tap Settings, then tap Linked Devices.
3. Review the list of computers and tablets.
4. Tap any unfamiliar device, then tap Log out.

Troubleshooting

I Already Shared My SMS Code

Verify your number in WhatsApp immediately. This will log the attacker out. After regaining access, enable two-step verification and review your linked devices for any unknown sessions.

I Am Not Receiving the SMS Verification Code

• Ensure your mobile has signal and can receive SMS messages.
• Check that your phone number is entered correctly, including the Australian country code (+61) without the leading zero.
• Wait a few minutes and request a new code rather than guessing.
• If you are travelling overseas, ensure roaming is active or use a local number capable of receiving SMS.

My Contacts Received Strange Messages from My Number

Your account may have been accessed by an attacker. Regain control of your account immediately, enable two-step verification, log out all linked devices, and alert your contacts to ignore any unusual requests for money or sensitive information.

Tip: WhatsApp will never call or message you to ask for your verification code. If someone asks for an SMS code, it is a scam.

Warning: If your WhatsApp account is linked to business operations, customer data, or payment discussions, a hijacking can lead to serious privacy breaches and financial fraud. Act quickly to secure your account.

If you need assistance securing your business communications or suspect a security breach, Open a Ticket with 220 Internet Services support.

Still Having Issues?