WhatsApp Business hacked: how to recover your account, step by step

In Morocco, WhatsApp Business is often a shop, a customer service desk and a till at the same time: orders come in there, the bank details (RIB) go out there, and the transfer receipt or cash-on-delivery confirmation comes back there. When that account is hacked, you do not just lose a messaging app. You lose orders in progress, customers waiting for a reply and, in the worst case, a scammer asks your customers to pay into their own account. This guide follows the official recovery procedure from the WhatsApp Help Center and adds what a business needs to do in parallel to limit the damage.

Signs a WhatsApp Business account is compromised

• WhatsApp says your number was registered on a new device, and you are logged out.
• You receive SMS messages or calls with a WhatsApp code you never requested.
• Customers or family report odd messages from your number: a request for money, a link, a "code sent by mistake".
• An unknown device appears under Linked devices.
• The app asks for a two-step verification code or an email address you never set up.

The official procedure to recover your account

WhatsApp is clear on one point: the only way to remove someone from your account is to re-register your number with the 6-digit code sent to that number. The procedure, as described in the Help Center:

1. Open WhatsApp Business on your phone, with the SIM card for that number inserted.
2. Tap Log back in, then Continue.
3. If prompted, enter your number in full international format (+212 followed by the number without the leading 0) and confirm.
4. Enter the 6-digit code you receive by SMS or phone call.

As soon as you enter that code, every device logged into your account is logged out, including the attacker's. That holds even if the app then asks for a two-step verification code you do not know.

If the app asks for an unknown two-step verification code

Sometimes the person who took your account turned on two-step verification with their own code or password. The Help Center then says to wait 7 days and try again. During that wait, the attacker is already logged out by your SMS code. Depending on the case, the app may also offer to verify another way (email, SMS or call) or to reset the account after a few days. We cover those options, and what they erase, in forgotten or unknown two-step verification code.

If you no longer have the SIM card

It is not possible to recover an account without a SIM card with the same number. If your phone was stolen or the SIM stopped working, contact your mobile operator (Maroc Telecom, Orange or inwi) to block the card and get a new SIM with the same number, then follow the procedure above.

Mistakes that make things worse

• Changing the password is not enough. WhatsApp says so: passwords and two-step verification protect an account you still have access to. They do not remove someone who has already taken it.
• Do not report your own account. The Help Center warns that reporting the compromised account you are trying to recover may get it banned, with loss of access to the account and its data. Recover first, report afterwards if needed.
• Do not pay anyone to "unlock" the account. Only WhatsApp can ban or unban an account. "Recovery services" that contact you are useless at best and a second scam at worst.
• Do not talk to the attacker or send them any code in exchange for returning the account.

Protect your customers while you recover

This is the part generic guides skip, and the one that matters most for a business. While the attacker controls your number, they can message your customers with your name, your photo and your chat history. The most common scenario: a message announcing a "new bank account" or asking for an urgent payment.

1. Warn customers through another channel: an Instagram or Facebook story and post, an SMS from another number, a banner on your website. Keep it simple: "Our WhatsApp has been hacked. We will never ask you to pay into a new account. Ignore any payment request from this number until further notice."
2. Call customers with an order in progress to confirm amounts and your usual payment account.
3. Tell your bank if your bank details or payment information were shared, and keep a written record of suspicious exchanges.
4. Screenshot the fraudulent messages your customers report: you will need them if you file a complaint.

One piece of good news: WhatsApp points out that messages are end-to-end encrypted and stored on your device. Someone who re-registers your account on a new phone cannot read your past conversations. They can, however, see your groups and contact list, and write in your name.

After recovery: lock the account down

Once you have the account back, WhatsApp recommends turning on security features and reviewing linked devices. Note that after re-registering, there may be a delay before you can turn on two-step verification: if so, try again a little later.

• Turn on two-step verification with a password of at least 8 characters (at least one letter and one number) and an email address you actually have access to.
• Add and verify your email address in the account settings: it lets you receive a login code without SMS.
• Open Linked devices and log out anything you do not recognise.
• Set a voicemail password: WhatsApp recommends it, because the code can also be delivered by phone call.
• Turn on app lock with fingerprint or face unlock.

The full checklist, tailored to businesses that sell on WhatsApp, is in how to secure WhatsApp Business.

A recurring case: the email the attacker added

On Reddit, a WhatsApp Business user describes being locked out after an attacker added an unfamiliar email address to their account, which stopped them logging back in normally. This is a user report, not an explanation verified by WhatsApp. It does illustrate a useful point: adding your own email address and two-step verification while you still have access leaves no room for someone else to fill that slot.

Stop depending on a single number

An account recovered in a few hours is an incident. An account lost for 7 days in the middle of a sales period is lost revenue. The businesses that cope best have a plan B: an order page or online store, a backup number announced in advance and an exported customer list. We explain how to set it up in selling and getting paid on WhatsApp: the backup plan.

Need help?

Our managed services include securing the accounts and tools your business depends on: WhatsApp Business, social media, website, business email and access. If your account has just been hacked, or you want to make sure it does not happen, get in touch: we help you take back control and lock everything down.