How to secure WhatsApp Business: the anti-hacking checklist for businesses in Morocco

For many businesses in Morocco, WhatsApp Business is the main channel: orders from Instagram or Facebook arrive there, the bank details are shared there, cash on delivery is confirmed there. That account is worth money, and scammers know it. The good news: most takeovers exploit default settings or a code shared under pressure. Here is the security checklist we apply, built from WhatsApp's official recommendations.

1. Turn on two-step verification

This is the most important protection. In Settings, Account, Two-step verification, turn it on, create a strong password and confirm it. WhatsApp is gradually replacing the old 6-digit PIN with a password: at least 8 characters, with at least one letter and one number. Avoid your birth date, the shop's name or your phone number.

2. Add an email address you control

When you turn it on, WhatsApp offers to add an email address. Do not skip it. In Settings, Account, Email address, add the address and verify it with the 6-digit code you receive. This address lets you receive a login code without SMS and verify your identity if you forget the password.

3. Review linked devices every week

WhatsApp Web, the desktop app and secondary devices can stay connected for a long time. Open Linked devices, go through the list and log out anything unknown or unused (a former employee's computer, the shop tablet). Do the same every time someone leaves the team.

4. Protect your voicemail

A little-known official recommendation: set a voicemail password that is hard to guess. The WhatsApp registration code can be delivered by phone call. If you do not answer, it can land in your voicemail, and a voicemail protected by the default code can be accessed remotely. Ask your operator how to change that code.

5. Lock the app and the phone

• Turn on app lock with fingerprint or face unlock.
• Put a lock code on the shop phone, especially if it sits on the counter.
• Turn on chat lock for sensitive chats (suppliers, bank, accountant).
• Turn on end-to-end encrypted backups, protected by a password or key.

6. Recognise code scams

Most accounts are taken through social engineering: you are persuaded to hand over the code yourself. The most common scenarios:

• "I sent you a code by mistake, can you send it back?" The message often comes from a contact who was already hacked. The code is for your account.
• Fake WhatsApp support announcing that your account will be suspended and asking for a code to "verify" it. WhatsApp will never ask for your code.
• The fake customer who wants to "confirm the order" or "validate the payment" with a code received by SMS.
• The fake courier or fake bank sending a link to "release" a parcel or a transfer.

A simple rule to pin up next to the till: no code received by SMS, call or email is ever shared, with anyone. If you get registration-code emails or texts you did not request, do not click any link: someone is probably trying to register your number.

7. Secure the SIM card

Your account depends on a SIM card. If the phone is lost or stolen, WhatsApp recommends calling your operator immediately to block the card and request a new SIM with the same number. Also set a PIN on the SIM and keep the PUK code somewhere safe. Ideally, the WhatsApp Business number is registered to the company, not to an employee.

8. Check your Meta Account

If WhatsApp is linked to your Meta Account (the accounts centre shared with Facebook and Instagram), a compromised Facebook page or Instagram account can be a way in. WhatsApp recommends reviewing the profiles in your Meta Account, removing any suspicious one and, if in doubt, temporarily moving WhatsApp out of the Meta Account until everything is secured.

9. Organise access within the team

• One person responsible for the account, and a backup person who knows the procedure.
• The two-step verification password stored in a password manager, not in a WhatsApp group.
• Staff use linked devices, logged out when they leave.
• A written sheet: number, operator, recovery email, where the SIM is, who to call.

10. Prepare for the day it happens anyway

No checklist removes all risk. What makes the difference is knowing what to do in the first hour: the hacked account recovery procedure, the message to post to warn customers, and a fallback channel to keep selling, described in the backup plan for your sales and payments.

We can handle it for you

A business's security does not stop at WhatsApp: website, email, social media and banking access are all connected. Our managed services secure and document the whole set, and support you during an incident. Contact us for an access review.