8 minute WhatsApp guide
What to do when your WhatsApp account is taken over
Move in the right order: protect the phone number and email, preserve the evidence, regain the account, remove unknown access, and check what else changed.
The short answer
If WhatsApp was taken over, preserve screenshots and alerts, contact your mobile provider if the number stopped working, follow the current WhatsApp registration prompts from a trusted phone, check Linked Devices as soon as access returns, secure the connected email and cloud accounts, warn close contacts about messages they may receive, and review the handset for the access route that caused the incident.
Confirm whether this is a takeover or a linked-session problem
A full takeover may sign the primary phone out, change registration access, or place the number on another device. A linked-session problem can leave the main phone working while an unfamiliar computer, browser, tablet, or companion phone reads and sends messages. Record exactly what the app shows, whether the mobile number still receives calls and texts, and which devices remain connected.
Take screenshots of registration prompts, verification alerts, changed profile details, unknown devices, messages contacts received, and any request that preceded the incident. Note the time and the recovery steps already attempted. This information helps distinguish a stolen-code event, mobile-number issue, device-linking incident, email exposure, or wider phone compromise.
Protect the mobile number and recovery email
If calls or SMS stopped working unexpectedly, contact the mobile provider through its verified support channel and check for a SIM, eSIM, port, or account change. Restore dependable control of the number and add a carrier account PIN where available. The phone number is central to WhatsApp registration, so unresolved mobile service access can undermine every recovery attempt.
Secure the email account connected to WhatsApp and the phone's cloud services from a trusted device. Review recent sessions, recovery contacts, forwarding, filters, connected applications, and security alerts. Change exposed credentials and end unknown sessions. If the phone itself may be monitored, make urgent account changes from another trusted device rather than typing new credentials into the affected handset.
Regain WhatsApp access and remove unknown devices
Use the recovery and registration choices currently presented in the official WhatsApp application. Verification methods can change depending on the account and recent attempts, so follow the live prompt rather than a screenshot from an old tutorial. Do not pay anyone for a code, share a code, or approve a device-linking prompt you did not initiate.
When access returns, open Linked Devices, preserve unfamiliar activity, and end unknown sessions. Review profile information, privacy settings, groups, blocked contacts, archived chats, sent messages, and WhatsApp Business details where relevant. Enable or review two-step verification and its recovery email, then confirm that the phone and cloud accounts are also protected.
Warn contacts and preserve changed content
Tell close contacts through another trusted channel that messages from the account may not have been yours. Ask them to preserve suspicious requests, links, payment instructions, voice notes, or profile changes. Their screenshots can document activity that disappeared from your own chat history and show the time, wording, recipients, and response.
Do not delete unfamiliar conversations simply to make the account look normal again. Preserve relevant chats, exported content, media, notifications, and screenshots first. If messages or files vanished during the takeover, protect the old phone and backup state before reinstalling or creating a new backup. Deleted-message recovery and takeover recovery often need to be planned together.
Find and close the original access route
A recovery that stops at logging back in may be temporary. Review how the incident began: a shared verification code, a device-linking request, physical phone access, a mobile-number change, a compromised email account, an unsafe application, remote-control software, or an unlocked shared computer. The security plan should close the route that matches the supported evidence.
If access keeps returning, messages were deleted, business customers were contacted, several accounts changed together, or the phone behaves suspiciously, request an investigation. TechForensiq can map the WhatsApp, phone, number, email, cloud, linked-device, and backup activity into one case and provide a recovery and security sequence built around what actually happened.
Need a direct answer for your account?
Speak with an ethical hacker
Tell us what changed, what access remains, which devices and backups you have, and the result you need. We will review the case and explain the strongest next step.
FAQ
Questions people ask next
Preserve the alerts and what the app shows, confirm the mobile number still works, and protect the carrier and connected email account. Follow the official WhatsApp prompt from a trusted device. When access returns, review Linked Devices and warn close contacts through another channel.
WhatsApp topic cluster
Continue with a related guide
Primary sources
Official references used for this guide
Get your WhatsApp case reviewed
Share the account problem, phone type, timeline, access you still have, and the result you want. We will identify the recovery or investigation route that fits.
- 24/7 secure intake
- Confidential and discreet
- Rapid expert response
We respect your privacy. No spam. Ever. Or email support@techforensiq.com