WhatsApp is the primary communication channel for most South Africans, which makes it a high-value target for hijackers. Once an attacker controls your WhatsApp, they message your contacts pretending to be you, usually asking to urgently borrow money, and by the time your friends realise it's a scam, the damage is done.
The good news is that WhatsApp hijacking is almost entirely preventable with one setting most people have never turned on: Two-Step Verification.
π The Single Setting That Prevents Most WhatsApp Hijacking
Two-Step Verification adds a PIN that's required before anyone, including you, can register your number on a new device. Without it, anyone who receives your SMS verification code (through a SIM swap or intercepted SMS) can take over your account completely.
How WhatsApp Accounts Get Hijacked in SA
WhatsApp itself uses strong end-to-end encryption for messages, so attackers don't "hack" the app directly. Instead, they exploit the registration process, which relies on receiving an SMS code to your number.
SIM swap fraud is the most consequential attack vector in South Africa specifically, because it operates entirely outside WhatsApp and bypasses every in-app protection except Two-Step Verification. A fraudster convinces your mobile network (MTN, Vodacom, Cell C, or Telkom) to transfer your number to a SIM card they control, using social engineering or a bribed insider. Once they have your number, they can register WhatsApp as you and receive every verification code meant for you, as covered in more detail in our SA cybersecurity threats guide.
Verification code sharing scams are the second most common route. You receive a message claiming to be from a friend, a competition, or a "WhatsApp support" account, asking you to forward a 6-digit code you just received "to verify you're human" or "to claim a prize." That code is your actual WhatsApp registration code. Sharing it hands your account straight to the attacker.
Setting Up Two-Step Verification
This takes about two minutes and is the single most impactful thing you can do to protect your WhatsApp account. It must be set up from the mobile app; there is no way to configure it from WhatsApp Web or Desktop.
Open Settings
Launch WhatsApp and tap Settings in the bottom-right corner (Android) or the gear icon (iPhone).
Tap Account, then Two-Step Verification
Select Account from the settings menu, then find Two-Step Verification in the list of options.
Set a 6-digit PIN
Choose a PIN you can reliably remember but that isn't guessable from public information about you, avoid birthdays or ID number digits.
Add a recovery email
This is the step most people skip, and it matters. If you forget your PIN, a recovery email is the only way to reset it without a lengthy waiting period. Make sure that email account itself has two-factor authentication enabled, and that you can access it without needing the same phone number WhatsApp uses.
π‘ Why the 7-Day Wait Matters
If an attacker tries to register your number on a new device and doesn't know your PIN, and you have no recovery email on file, WhatsApp imposes a 7-day waiting period before they can bypass the PIN. This buys you time to notice and act. Adding a recovery email removes this waiting period for you, but keeps the protection against attackers who don't have your email.
Protecting Against SIM Swap Specifically
Two-Step Verification protects WhatsApp specifically, but it's worth closing the SIM swap door itself, since the same attack also threatens your banking OTPs and email recovery.
- Set a SIM swap PIN or passcode with your network provider (MTN, Vodacom, Cell C, Telkom all offer this). This adds a password requirement before your number can be ported to a new SIM.
- Enable port-out protection if your network offers it, an extra confirmation step before your number can move to another network entirely.
- Secure your online account with your network provider with a strong, unique password, since attackers sometimes initiate SIM swaps by first compromising your carrier account online rather than calling in.
- Watch for a sudden loss of signal with no explanation. If your phone suddenly shows "No Service" or "Emergency Calls Only" for no reason, that can be an active SIM swap in progress. Contact your network immediately from another phone.
Checking Linked Devices
WhatsApp Web and Desktop create a "linked device" rather than a full second account, but a forgotten or stolen linked session is still a real exposure risk, particularly on a shared or public computer.
Go to Settings β Linked Devices
This shows every device currently logged into your WhatsApp account via the web or desktop app.
Review each entry
Check the device name and last active time. If you don't recognise a device, or it's a computer you no longer use, that's a red flag.
Log out of anything unfamiliar
Tap the device and select Log Out. If in doubt, log out of all linked devices and re-link only the ones you actually use.
What to Do if You're Hijacked Right Now
If your WhatsApp is currently sending messages you didn't write, act immediately, both to regain control and to protect your contacts from scams sent in your name.
Immediate Steps
If you still have your SIM: reinstall WhatsApp with your number right away. Registering again will automatically log the attacker's session out. Then immediately set up Two-Step Verification if you haven't already. If your SIM itself has been swapped: contact your network provider's fraud line immediately to reclaim your number before doing anything else with WhatsApp.
Once you've regained control, warn your contacts through a different channel (SMS, a phone call, or another app) that your account was compromised, so anyone who received a suspicious money request from "you" knows to ignore it.
Other Privacy Settings Worth Enabling
- Silence unknown callers: Blocks WhatsApp voice/video calls from numbers not in your contacts, reducing vishing-style scam attempts.
- Disable "Last Seen" and read receipts for anyone but your contacts, reducing the information scammers can use to time an approach.
- Enable a fingerprint or Face ID lock for the app itself, so a stolen or unlocked phone doesn't hand over WhatsApp access instantly.
For broader protection against the phishing and smishing campaigns that often precede an account takeover attempt, see our guide on how to spot a phishing scam in South Africa.
FAQ
Not directly, but a SIM swap gives them your phone number, and from there they can register WhatsApp on their own device and receive the SMS verification code meant for you. This is why Two-Step Verification is essential: it adds a PIN that a SIM swap alone cannot bypass.
It works differently. Most apps ask for a code from an authenticator app or SMS every time you log in on a new device. WhatsApp's Two-Step Verification asks for your 6-digit PIN only when someone tries to register your number on a new device or reinstall the app, which is exactly when a hijacking attempt would happen.
If you added a recovery email when you set it up, WhatsApp can send you a link to reset the PIN. If you didn't add a recovery email and forget the PIN, you may need to wait up to 7 days to re-register your number without it, WhatsApp enforces this delay specifically to stop attackers from bypassing the PIN.
Go to Settings, then Linked Devices. This shows every device currently logged into WhatsApp Web or Desktop using your account. If you see a device you don't recognise, tap it and select Log Out immediately, then change your Two-Step Verification PIN.
Immediately try to reinstall WhatsApp with your number, if you still have SIM access, this should log the attacker out. If you've lost your SIM too (a SIM swap), contact your network provider immediately to reclaim your number, then reinstall WhatsApp the moment you regain SIM control. Warn your contacts through another channel that your account was compromised, so they don't fall for money requests sent in your name.
Conclusion
WhatsApp hijacking is one of the more preventable threats facing South Africans today. The entire attack chain depends on an attacker receiving your SMS verification code, and Two-Step Verification breaks that chain completely by requiring a PIN they don't have.
π‘οΈ Your 5-Minute Checklist
- Enable Two-Step Verification and set a strong, memorable PIN
- Add a recovery email secured with its own 2FA
- Set a SIM swap PIN with your mobile network
- Check Linked Devices and log out of anything unfamiliar
- Never forward a verification code to anyone, ever
π Protect Every Account, Not Just WhatsApp
The same credential-reuse habits that put WhatsApp at risk also expose your email and banking logins. See our password security guide for how to lock down everything else.
Read the Password Guide β