If your WhatsApp account has been hacked, act quickly: every minute a criminal controls it, they can message your contacts asking for money in your name. The good news is that, as long as you still have the SIM card for your number, you can usually take the account back yourself. This guide follows the recovery steps in WhatsApp's own Help Center.
What happened in Jamaica in June 2026
On June 25, 2026, the Jamaica Gleaner reported on several people whose WhatsApp accounts had been compromised within a few days. According to the Gleaner, the criminals messaged each victim's contacts with a friendly request for a favor that quickly became a request for money. In one exchange, the person controlling the account asked for US$820 and avoided a voice call by claiming to be in a meeting. One victim said his account was taken over after he responded to a message from someone he thought was a trusted contact, and described the scam as a web of deception spreading from one account to the next.
The Gleaner also reported that the Jamaica Cyber Incident Response Team (JaCIRT) had not seen an increase in reports of WhatsApp hijacking at the time, and encouraged the public to report incidents. Many takeovers are never reported.
How WhatsApp accounts get taken over
Verification code scams
When someone registers WhatsApp on a new phone, WhatsApp sends a 6-digit code by SMS or phone call to the number. A criminal starts registering your number on their phone, then messages you, often from a friend's hijacked account, asking you to forward the code they "sent by mistake". If you do, they have your account. WhatsApp's guidance is clear: never share your registration code with anyone, not even friends or family.
Because the code can also be delivered by phone call, WhatsApp recommends setting a voicemail password that is hard to guess, so nobody can retrieve a code from your voicemail.
Fake WhatsApp Web pages and linked devices
WhatsApp lets you link up to four other devices, such as a computer running WhatsApp Web, by scanning a QR code or entering a code from your phone. Criminals abuse this with fake pages and messages that ask you to scan a QR code or enter a code to "verify" your account or claim a prize. Doing so can link the criminal's browser to your account, while your phone keeps working normally.
What to do immediately to recover your account
- Re-register your number. Open WhatsApp on the phone with your SIM card and tap Log back in, then Continue. If prompted, enter your full phone number, then enter the 6-digit code sent by SMS or phone call. According to WhatsApp, re-registering logs out every device that was logged in to your account, including the criminal's.
- If you are asked for a two-step verification PIN you do not know, the criminal may have set one. WhatsApp says that without the PIN you must wait 7 days and try again. The criminal is still logged out once you enter the 6-digit code, so they cannot keep using your account during that wait.
- Do not rely on changing a password. WhatsApp states that changing your password won't remove someone else from your account. Re-registering with the code sent to your phone number is the only way.
- Get your SIM back if you need to. WhatsApp says it is not possible to recover an account without a SIM card with the same phone number. If your phone or SIM was lost or stolen, contact your mobile provider for a replacement SIM on the same number.
- Recover before you report the account to WhatsApp. WhatsApp warns that if you report the account you are trying to recover, it may be banned and you could lose access to it and your data.
- Check your linked devices in WhatsApp under Linked devices, and log out any device you do not recognize.
Because messages are stored on your device, WhatsApp says someone who re-registers your account on a new phone can't read your past conversations.
Warn your contacts
WhatsApp advises telling family and friends if your account is compromised, because the criminal can impersonate you in chats and groups. Use a channel the criminal does not control, such as phone calls, SMS or social media. Tell them not to send money or codes to anyone using your account, and to call you on a number they already know if they get an unusual request. Anyone who has already sent money should contact their bank straight away.
Lock it down: two-step verification and passkeys
Once you are back in, turn on the security features WhatsApp offers. They protect an account you control, but cannot remove someone who already has access.
- Two-step verification: go to Settings > Account > Two-step verification and turn it on. WhatsApp is moving from a 6-digit PIN to a password for this feature. Choose one that is hard to guess and that you do not use anywhere else.
- Add an email address: WhatsApp says an email address on your account gives you a way to recover it without relying on SMS or a phone call. Use an address you will keep and can always reach.
- Passkeys, where available: a passkey links your WhatsApp account to your phone's fingerprint, face or screen lock. WhatsApp says you can use it instead of an SMS code when you register your number or restore your account.
- Review linked devices regularly, and never scan a WhatsApp QR code or enter a linking code that someone else sends you.
- Set a strong voicemail password on your phone line.
Report it
JaCIRT, the national Cyber Incident Response Team, has a Report a Cyber Issue form on its website, cirt.gov.jm, and its director encouraged the public to report WhatsApp takeovers. If money was requested or lost, also make a report to the Jamaica Constabulary Force at your local police station; the JCF's Communication Forensics and Cybercrime Division is its specialist cybercrime unit. If you sent money, call your bank or payment provider immediately.
Protecting a business that runs on WhatsApp
Many Jamaican businesses take orders and arrange payments on WhatsApp, so a takeover can mislead customers, divert payments and expose customer conversations. A few habits reduce the risk:
- Turn on two-step verification on every business number, and use an email address the business controls, not a staff member's personal address.
- Keep business SIM cards in company phones, record who holds each one, and check linked devices every week.
- Tell customers you will never ask for verification codes, and will confirm any change to your bank details by phone.
- Confirm any request to pay money or change bank details by calling a number you already have, even if the message comes from a colleague or a long-standing supplier.
- Write down who recovers the account and who warns customers, before you need it.
If business chats hold customer or staff personal data, a takeover may also be a personal data breach under the Data Protection Act. A breach that affects personal data must be reported to the Information Commissioner within 72 hours of becoming aware of it, so include WhatsApp in your breach plan. Our Data Protection Act compliance checklist explains the wider duties.
Most takeovers succeed because someone shares a code or scans a QR code without thinking. Our security awareness training teaches staff to recognize these tricks, and you can test yourself and your team with our free Spot the phish quiz.