How to Protect Your WhatsApp Business Account from Takeover

For a lot of businesses in Nairobi, Mogadishu or Hargeisa, WhatsApp is the shop. Orders come in there, customers send payment confirmations there, suppliers negotiate there. So when someone takes over the account, it hurts twice: you lose your customers’ messages, and the thief starts asking those same customers for money in your name.

The good news is that almost every takeover we hear about uses one of two simple tricks, and you can block both in about ten minutes. Here’s how to protect your WhatsApp Business account.

How accounts actually get stolen

Trick one: the code. You get a message, often from a friend’s number that’s already been hacked: “Sorry, I sent you a code by mistake, can you forward it to me?” That six-digit code is WhatsApp’s registration code for your number. Whoever has it can move your account to their phone.

Trick two: linked devices. Someone gets your unlocked phone for a minute, maybe a “helpful” person at a repair shop or someone in the office, and scans a QR code to link WhatsApp Web on their computer. After that they can read everything, quietly, for weeks.

1. Never share the six-digit code

Not with friends, not with “WhatsApp support”, not with anyone. WhatsApp staff will never ask for it. If someone asks, that alone tells you it’s an attack.

2. Turn on two-step verification

1. Open WhatsApp Business and go to Settings → Account → Two-step verification.
2. Set a six-digit PIN. Don’t reuse your M-Pesa or EVC Plus PIN, and don’t use your birth year.
3. Add a recovery email address that you control.

Now, even if someone tricks you out of the SMS code, they still need this PIN to register your number.

3. Check linked devices every week

Go to Settings → Linked devices. Every computer or tablet connected to your account shows up here. If you see anything you don’t recognise, log it out. Make this a Monday-morning habit.

4. Add a passkey or verified email

Newer versions of WhatsApp let you add a passkey or a verified email address in the account settings. It gives you another way to prove the account is yours if something goes wrong. If your version has it, turn it on.

5. Lock the phone and the app

Use a screen lock on the phone, and turn on app lock (fingerprint or face) in WhatsApp’s privacy settings. A borrowed or lost phone shouldn’t mean a stolen business.

If your account has already been taken

1. Reinstall WhatsApp Business and register your number again. You’ll get a new SMS code, and using it logs the other person out.
2. If two-step verification blocks you because the thief set their own PIN, use the recovery steps by email.
3. Tell customers on your other channels (Facebook, Instagram, SMS) that any message asking for payment is fake.
4. Report the problem to WhatsApp from inside the app, or through the WhatsApp Help Center.

Account takeovers are part of a bigger pattern of scams in local languages. Our article on phishing in Somali and Swahili explains the other tricks to warn your staff about, and 7 small business security mistakes covers the rest of your setup.