WhatsApp Hijacking: How Hackers Steal Accounts and কীভাবে বন্ধ করবেন Them

"Hey, I accidentally sent my ভেরিফিকেশন কোড to your number. Can you forward it to me?"

This innocent-sounding message is the opening move of the most common WhatsApp hijacking scam worldwide. If you fall for it, your account is gone in seconds — and the attacker starts messaging your contacts, impersonating you.

WhatsApp has over 2 billion users globally, making it the single biggest target for messenger account takeovers. According to Action Fraud data, messaging app hijackings rose 300% between 2023 and 2025.

How WhatsApp Hijacking Works

1. ভেরিফিকেশন কোড Theft

The classic method. An attacker triggers WhatsApp's login flow for your phone number, generating a 6-digit code sent to you via SMS. They then socially engineer you (or someone with access to your phone) into sharing that code.

Step	What Happens
1	Attacker enters your phone number on a new device
2	WhatsApp sends you a 6-digit SMS code
3	Attacker messages you pretending to be a friend or WhatsApp support
4	You share the code
5	Attacker logs in, you get logged out

2. SIM Swap Attacks

A more sophisticated method where criminals convince your mobile carrier to transfer your phone number to a new SIM. They then receive all your SMS messages, including ভেরিফিকেশন কোডs.

3. WhatsApp Web Exploitation

If someone gets brief physical access to your phone, they can link your account to WhatsApp Web on their computer. They can then read and send messages silently for weeks.

4. ম্যালওয়্যার and Spyware

Malicious apps installed on your device can intercept SMS messages or even capture your WhatsApp session tokens directly.

Signs Your Account Has Been Hijacked

Watch for these warning signals:

• Unexpected "Your phone number is no longer registered" messages
• Friends reporting strange messages from your account
• WhatsApp Web sessions you don't recognize
• Being suddenly logged out of WhatsApp
• Two-step ভেরিফিকেশন PIN requests you didn't trigger

Recovery Steps (If You've Been Hijacked)

Step 1: Re-register your number

Open WhatsApp, enter your phone number, and verify with the SMS code. This automatically logs out the attacker.

Step 2: Alert your contacts

Immediately notify friends and family through other channels. For sensitive communications during recovery, LOCK.PUB offers পাসওয়ার্ড-সুরক্ষিত এনক্রিপ্টেড চ্যাট রুমs that don't require any app installation — useful when your primary messenger is compromised.

Step 3: Check WhatsApp Web sessions

Go to Settings > Linked Devices and log out of all unknown sessions.

Step 4: Enable two-step ভেরিফিকেশন

Settings > Account > Two-step ভেরিফিকেশন > Enable. Set a 6-digit PIN that will be required periodically and when re-registering your number.

Step 5: Report to authorities

If financial fraud occurred, report to your local cybercrime unit (e.g., IC3 in the US, Action Fraud in the UK).

প্রতিরোধ Checklist

Setting	কীভাবে Enable	Why It Matters
Two-step ভেরিফিকেশন	Settings > Account > Two-step ভেরিফিকেশন	Requires PIN even if code is stolen
Login notifications	Enabled by default	Alerts when account is accessed
Biometric lock	Settings > প্রাইভেসি > App Lock	Prevents unauthorized physical access
Hide "Last Seen"	Settings > প্রাইভেসি > Last Seen	Reduces social engineering info

The Golden Rules

1. Never share ভেরিফিকেশন কোডs — No legitimate service or friend will ever ask
2. Enable two-step ভেরিফিকেশন — This single setting blocks most hijacking attempts
3. Lock your voicemail — Attackers can intercept codes left on default voicemail PINs
4. Be skeptical of urgency — Scammers always create artificial time pressure
5. Use a PIN for your SIM — Contact your carrier to set a SIM transfer PIN

Protecting Group Chats and Business Accounts

If you manage WhatsApp groups or business accounts:

• Restrict who can add you to groups (Settings > প্রাইভেসি > Groups)
• Use WhatsApp Business API with proper access controls
• Never share sensitive business credentials via chat messages
• For confidential document sharing, use LOCK.PUB পাসওয়ার্ড-সুরক্ষিত memos instead of sending plaintext in chat

What Happens After a Hijack?

Once an attacker controls your account, they typically:

1. Message your contacts asking for emergency money transfers
2. Join your group chats to phish more victims
3. Access your message history (if backed up to cloud)
4. Impersonate you for longer-term scams

The damage multiplies with every minute the attacker has access. Speed of response is critical.

শেষ কথা

WhatsApp hijacking is preventable. Two-step ভেরিফিকেশন alone blocks the vast majority of attacks. Take two minutes right now to enable it if you haven't already.

When আপনাকে করতে হবে share sensitive information — passwords, financial details, private documents — consider using LOCK.PUB to create পাসওয়ার্ড-সুরক্ষিত links or এন্ড-টু-এন্ড এনক্রিপ্টেড চ্যাট রুমs. It's free, requires no app installation, and keeps your data secure even if a messaging account is compromised.