TL;DR:

  • WhatsApp Business account takeovers are rising — most succeed by tricking you into sharing your six-digit verification code
  • Enable two-step verification immediately; it adds a PIN that attackers can’t bypass even with your SMS code
  • Your WhatsApp Business account contains a catalogue of customer conversations that may include personal data under GDPR — its security matters beyond just losing access

WhatsApp Business has become an essential tool for UK small businesses — appointments, order confirmations, customer queries, local service bookings. For many businesses, it’s the primary way customers reach them. That makes a WhatsApp Business account a target.

Account takeovers are happening. The attack is usually low-tech but effective: you receive a message (often from a contact whose account has already been compromised) asking to forward a six-digit code “by mistake.” You forward the code. Within seconds, the attacker registers your number on their device. You’re locked out. Your customer conversations are in their hands.

Here’s how to protect yourself properly.

Enable Two-Step Verification Right Now

Two-step verification (2SV) adds a six-digit PIN to your WhatsApp account that’s required any time your number is registered on a new device. Even if an attacker obtains your SMS verification code, they can’t complete registration without the PIN.

To enable it:

  1. Open WhatsApp Business → tap the three dots (menu) → Settings
  2. Tap Account → Two-step verification
  3. Tap Enable and create a six-digit PIN you’ll remember
  4. Add an email address for PIN recovery (use a secure email, not the same account attackers might also target)

Once enabled, anyone attempting to re-register your number — including yourself — must provide this PIN. It’s the single most effective protection against account takeover.

Do not share this PIN with anyone. WhatsApp will never ask for it. If a contact asks you to share any code, verification number, or PIN, refuse and report the conversation.

Understand How the Verification Code Scam Works

The most common attack goes like this:

  1. A scammer gains access to one of your contacts’ WhatsApp accounts
  2. They message you from that contact’s account (so it looks legitimate): “Hi, sorry, I accidentally sent a WhatsApp verification code to your number. Could you forward it to me? It was meant for my account”
  3. Meanwhile, they’ve entered your phone number on WhatsApp on their device, triggering WhatsApp to send a real six-digit SMS code to your number
  4. If you forward that code, they immediately register your number on their device

The code they’re asking for is your code — not theirs. There’s no such thing as a code “accidentally sent to the wrong number.” Any message asking you to forward a WhatsApp verification code is a scam, regardless of who it appears to come from.

If this happens to you: do not forward anything. Tell the contact (via another channel if possible) that their account may have been compromised.

Protect Access to Your Registered Phone Number

WhatsApp is tied to your phone number. If someone can receive SMS messages on your number — through SIM swapping, call forwarding manipulation, or simply physical access to your phone — they can take over your account.

Practical steps:

Call your mobile provider and add account security. Ask them to add a PIN or security question to your account, required before any SIM changes, redirects, or number transfers. UK networks (EE, O2, Vodafone, Three) all offer this. It takes five minutes and makes SIM swapping significantly harder.

Keep your phone’s lock screen active. If someone picks up your unlocked phone, they can view incoming SMS codes and add your WhatsApp to another device.

Be careful with call forwarding settings. If your business number has call forwarding set up, check that voice messages aren’t being forwarded somewhere you don’t control — WhatsApp offers voice verification as an alternative to SMS, and intercepted calls can be used for account takeover.

Your WhatsApp Business Data Under GDPR

Here’s something most small businesses haven’t considered: the customer conversations in your WhatsApp Business account almost certainly contain personal data. Names, phone numbers, addresses, health-related details if you’re in a relevant sector, purchase history. Under the UK GDPR, you’re responsible for protecting that data.

When your WhatsApp Business account is taken over, you’ve had a data breach. The ICO requires you to consider notifying affected customers if the breach poses a risk to their rights and freedoms. A breach involving a messaging account with customer personal data can qualify.

What this means practically:

  • Don’t retain conversations longer than necessary. WhatsApp doesn’t offer automatic deletion at a business-defined interval (unlike WhatsApp’s “disappearing messages” feature for individual chats), but you can manually clear old conversations.
  • Don’t use WhatsApp Business for sensitive data — health information, financial details, identification documents. If customers try to send these, redirect them to a more secure channel.
  • Have a basic incident response plan. If your account is taken over, know who to call (your mobile provider to temporarily block the SIM, WhatsApp support to report the compromise) and what to tell affected customers.

Security for WhatsApp Business API Users

If you’re using the WhatsApp Business Platform (the API, typically via a solution provider like Twilio, MessageBird, or Vonage), the attack surface is different. Your risk is less about account takeover via SMS codes and more about:

  • API credential security: API keys give access to your WhatsApp Business Account. Store them in a secrets manager, not in code repositories or .env files committed to version control.
  • Webhook security: Verify that inbound webhook requests come from WhatsApp/Meta using the X-Hub-Signature header. Failing to verify allows attackers to fake inbound messages.
  • Template message abuse: If your account is compromised, attackers can use your approved message templates to send spam to your customer list, damaging your reputation and potentially resulting in your number being banned by Meta.

Recovering a Compromised Account

If you’ve lost access to your account:

  1. Immediately contact your mobile provider and ask them to block outgoing SIM transfers and confirm no SIM changes have been made recently.
  2. Re-register your number on WhatsApp on your device. This sends a new verification code to your SIM. Once you verify, the attacker’s session is terminated (WhatsApp only allows one active registration per number).
  3. Enable two-step verification immediately after recovering access, if you didn’t have it before.
  4. Check your business profile and catalogue for any changes the attacker made.
  5. Review what conversations may have been accessed and assess whether customer notification is appropriate under UK GDPR.

Report the compromise to WhatsApp support (via the app: Settings → Help → Contact Us) so they’re aware of the attack pattern and can help secure your account.

Quick Security Checklist

  • Two-step verification enabled with a strong PIN
  • Recovery email added to two-step verification (using a secure email account)
  • Mobile provider account PIN set to prevent unauthorised SIM changes
  • Team members briefed not to forward any verification codes
  • Sensitive customer data not stored in WhatsApp conversations
  • Old conversations deleted periodically
  • API credentials (if using API) stored securely, not in code

Most WhatsApp Business account compromises happen because the account lacked two-step verification. That one setting prevents the vast majority of attacks. Do it now.