Forgotten or unknown WhatsApp two-step verification code: the 7-day wait, email and account reset

You entered the 6-digit code from the SMS, and WhatsApp shows a new screen: it needs a two-step verification code (or password) you do not know. Either you forgot it or, more worryingly, someone who took your account turned it on with their own code. Based on the WhatsApp Help Center, this guide explains the three possible outcomes: verify another way, wait, or reset the account, and what each one erases. If you have not taken your number back yet, start with recovering a hacked WhatsApp Business account.

Two different codes, two different jobs

The confusion often comes from WhatsApp using two separate codes:

• The 6-digit registration code, sent by SMS or call (or by email if you previously added and verified an address). It proves you own the number. It is the only way to activate the account on a phone.
• The two-step verification code, which you choose. WhatsApp is gradually replacing the old 6-digit PIN with a password (at least 8 characters, with a letter and a number). It appears after registration as a second lock.

A key point WhatsApp stresses: as soon as you enter the SMS code, anyone using your account is logged out, whether or not you know the verification code. You are locked at the door, but so is the intruder.

Option 1: verify another way (email, SMS or call)

If you cannot remember the password, the app offers another verification method:

1. Tap Verify another way.
2. Choose email, SMS or Voice call.
3. Tap Continue.
4. Enter the code you receive.

This is where the email address makes all the difference. If you had added and verified your own address, recovery is quick. If the attacker added their address, the email option helps them, not you: you then have to go through the wait.

Option 2: wait 7 days

For a compromised account where you do not know the verification code, the WhatsApp Help Center gives a simple instruction: wait 7 days and try again. The delay stops someone who stole your SIM from instantly taking over a protected account, but it applies to you as well.

During those 7 days, for a business:

• The attacker is no longer using your account (your SMS code logged them out), but you cannot use it either.
• Announce a temporary number on your social media, website and Google profile, and warn customers with orders in progress.
• Do not reinstall the app over and over or request codes repeatedly: it speeds nothing up.
• Prepare what comes next: the email to add, a strong password, the devices to review.

Option 3: reset the account (irreversible)

If you cannot complete two-step verification, the option to reset your account unlocks after a few days. It sits under Verify another way, See more, then Reset account, confirmed several times. WhatsApp states that this cannot be undone, and the consequences depend on your last login:

• Less than 30 days since you last logged in: messages received since then are deleted. Your account history and profile stay active.
• More than 30 days since you last logged in: your messages and profile are deleted and cannot be recovered.

For WhatsApp Business, the profile includes the business details: description, hours, address, catalogue. If you have to reset, expect to re-enter all of it. So keep a copy of that information somewhere other than the app.

Special case: a recycled or reassigned number

If you use a new number and WhatsApp asks for a verification code on first install, the previous owner of the number may have turned on two-step verification. WhatsApp says you will then need to wait a few days before you can reset access. It happens often with numbers recycled by operators.

Once you are back in

1. Go to Settings, Account, Two-step verification, turn it on and choose a strong password. If the app mentions a delay after re-registration, try again a little later.
2. Add an email address you have access to and verify it with the code you receive.
3. Choose to trust this device if it is the business phone.
4. Review Linked devices and log out anything you do not recognise.
5. Store the password in a password manager shared in a controlled way, not in a note on the phone.

Exact labels can vary with the app version and language. The logic stays the same.

Have a team manage these accesses

In many small businesses, the WhatsApp password, the recovery email and the SIM card are held by different people, or by one person who cannot be reached on the day of the problem. Our managed services document and secure these accesses like those for your website or email. Write to us if you would like a review.