Short answer: WhatsApp’s two-step verification is not a standard 2FA code — it is a six-digit PIN you choose, which WhatsApp asks for when your number is registered on a new device. Turn it on at Settings → Account → Two-step verification → Turn on, pick a PIN you will remember, and add an email address so you can reset it. This is the single most effective defence against the WhatsApp takeover scam.
Why WhatsApp works differently
Most services generate a secret and your authenticator app computes rotating codes. WhatsApp does not. There is no QR code, no authenticator app, and no 30-second timer. If you are used to that model, our comparison of SMS codes versus authenticator apps explains the difference.
Instead, WhatsApp ties your account to your phone number. When you install it on a new device, it texts a six-digit registration code to that number. Two-step verification adds a second, permanent PIN that only you know — so the SMS code alone is not enough.
That distinction matters because of how WhatsApp accounts are actually stolen.
The scam this stops
You get a message from a friend — whose account has already been taken over. It says they accidentally sent you a code and asks you to forward it.
Meanwhile the attacker has entered your number on their own device, triggering a genuine registration SMS to your phone. If you forward that code, they register your account, you are logged out, and they begin messaging everyone in your contacts asking for money.
With two-step verification on, the registration code is useless without your PIN. The attack simply fails.
WhatsApp will never ask for your registration code, and neither will a real friend. Anyone requesting it is running this scam, including — especially — someone who appears to be someone you know. It is a textbook example of the one-time password scams circulating today.
How to turn it on
- Open WhatsApp → Settings.
- Tap Account → Two-step verification.
- Tap Turn on (or Set up PIN).
- Enter a six-digit PIN and confirm it.
- Add an email address when prompted.
- Check the email address carefully for typos — WhatsApp does not verify it.
On iPhone the path is Settings → Account → Two-step verification. On Android it is the three-dot menu → Settings → Account → Two-step verification. Other messaging apps use a similar PIN, as our guide to setting up 2FA on Telegram shows.
The email step people skip
The recovery email is not optional in any practical sense. Without it, forgetting your PIN means waiting seven days before you can reset the account — with no shortcut and no support override.
Worse, WhatsApp does not send a confirmation to verify the address. A typo goes unnoticed until the day you need it and discover the reset link went to an address that does not exist.
Type it twice. Read it back. Make sure the email account itself is protected — see our Google account 2FA guide if it is Gmail.
Choosing a PIN
WhatsApp asks for it periodically to help you remember, which is useful — but pick something you will not forget after a long gap.
- Do not use your birth year, 123456, repeated digits, or the last four of your phone number.
- Do not reuse your phone unlock PIN or bank PIN.
- Do store it in a password manager. This is exactly what secure notes are for.
Our guide on storing recovery credentials safely applies here too — anywhere except a screenshot in your photo library.
What it does not protect
Be clear about the limits:
- It does not protect WhatsApp Web sessions. Check Linked devices regularly and remove anything unfamiliar.
- It does not stop someone with your unlocked phone from reading your messages.
- It does not prevent SIM swapping — though the PIN does block the attacker from completing registration, which is precisely why it works.
- It does not encrypt your backups by default. Enable end-to-end encrypted backups separately under Settings → Chats → Chat backup.
Frequently asked questions
Can I use Google Authenticator with WhatsApp?
No. WhatsApp uses its own PIN system rather than the TOTP standard, so authenticator apps do not apply. Our explainer on how TOTP codes work covers the difference.
What if I forget my WhatsApp PIN?
Use the recovery email to reset it. Without one, you must wait seven days after the last time you used WhatsApp, then reset without the PIN. Your chat history may be lost.
Will WhatsApp ask for the PIN every time I open it?
No. It is requested when registering your number on a new device, and occasionally as a memory check. Normal daily use is unaffected.
Does this protect my chat history?
It protects your account from being taken over. For the chats themselves, enable end-to-end encrypted backups in Settings → Chats → Chat backup.
Someone is asking me to send them a code — what do I do?
Do not send it. Contact that person by phone or in person to confirm. Their account is almost certainly compromised and the request is automated.
Can I turn it off?
Yes, under the same menu — but there is no good reason to. It costs nothing in daily use and blocks the most common attack on WhatsApp accounts.
The bottom line
Two minutes, one PIN, one email address — and the takeover scam that circulates constantly stops working on you. Add the email address, check it for typos, and store the PIN somewhere you will find it in a year. Then never forward a code to anyone, whoever they appear to be. While you are at it, check you are not making any of the other common 2FA mistakes.
One Response