How WhatsApp and Facebook Accounts Get Taken Over — and Why Scammers Ask Your Contacts for Money
A WhatsApp message arrives from a friend or relative. They say they have an emergency, their mobile banking is not working, or they need you to send money to another number and promise to refund it shortly.
The name and profile picture look familiar, and the message is coming from an account you already know. That is exactly why this type of scam can be convincing. In some cases, the person asking for money is not your friend at all. A scammer has gained access to the account and is using the owner’s identity and relationships to target people who trust them.
Account takeovers do not always involve someone technically “hacking” into WhatsApp or Facebook. Criminals frequently rely on deception: stealing a verification code, tricking someone into opening a fake login page, getting access to an email account, reusing a leaked password, or persuading a victim to link an unfamiliar device.
How a WhatsApp account can be taken over
One common method begins with WhatsApp’s registration code. When a phone number is registered or re-registered, WhatsApp can send a six-digit code to confirm ownership of the number. That code should never be shared.
A fraudster may first contact the victim with a believable story. They might claim a code was sent “by mistake”, pretend to be helping with a group, competition or account problem, or impersonate someone the victim knows. If the victim gives away the registration code, the attacker may be able to register the account on another phone.
WhatsApp says that receiving a registration code you did not request can mean someone has entered your number and is attempting to register it. Without the code, that person cannot complete the normal verification process.
Another risk involves linked devices. WhatsApp allows an account to work on computers and other supported devices. If an attacker succeeds in linking an unauthorised device, they may be able to use the account without immediately taking the main phone away from its owner.
Facebook takeovers often start with a fake login
Facebook users can be targeted through phishing messages and websites designed to resemble genuine login pages. A message may claim that a page is about to be disabled, a copyright complaint has been filed, an account has violated a policy, or the user must verify their identity immediately.
The link then asks for a Facebook password or other credentials. If the information is entered into a fraudulent website, it goes to the scammer rather than Facebook.
Password reuse creates another weakness. If the same password is used on several websites and one of those services suffers a data breach, criminals may try the exposed credentials on other accounts.
An attacker who also controls the victim’s email account can cause further damage because email is commonly used for password resets and security notifications.
Why scammers immediately contact friends and relatives
Once inside an account, a scammer gains something more valuable than a random phone number: trust.
The criminal can impersonate a person whom the recipient already knows. Messages may be sent individually or to several contacts, often using urgency to discourage the recipient from stopping to verify the request.
Typical messages include claims that the account owner is stranded, needs money for hospital treatment, cannot access their M-Pesa or bank account, has reached a transaction limit, needs to pay a bill urgently, or wants money sent to a different number.
The requested amount may deliberately be kept within a range that a friend or relative could send quickly without asking many questions.
A familiar account does not guarantee a familiar person is typing
If somebody you know suddenly asks for money through WhatsApp, Facebook Messenger or another social platform, verify the request outside that conversation.
Call the person’s normal telephone number. If possible, speak to them directly. For an unusual or substantial request, a voice or video call can provide another layer of confirmation.
Be especially cautious when the sender insists they cannot receive a call, asks you not to tell anyone, changes the number to which money should be sent, or creates extreme urgency.
WhatsApp itself advises users who receive suspicious messages from known contacts to consider that the account may have been compromised. It also recommends confirming someone’s identity by voice or video call when in doubt.
Warning signs of an account takeover scam
- A friend unexpectedly asks you to send money to a number or account that is not theirs.
- The message creates an emergency and pressures you to act immediately.
- The person’s writing style, language or greetings suddenly seem unusual.
- You are asked for a WhatsApp registration code, password, PIN or one-time code.
- A message directs you to a login page through an unexpected link.
- The sender refuses a normal telephone or video call.
- You receive login or registration alerts that you did not initiate.
- WhatsApp shows a linked device you do not recognise.
- Facebook reports a login from an unfamiliar device or location.
If your WhatsApp has been taken over
Act quickly. WhatsApp’s recovery guidance says users can re-register their phone number and enter the six-digit code sent by SMS or phone call. Successfully re-registering the account logs out other users registered with that number.
If an attacker enabled two-step verification, WhatsApp may ask for a PIN or other verification method. Follow the recovery instructions shown in the official app rather than paying anyone who claims they can “recover” the account for you.
Check Linked Devices and remove anything you do not recognise. Once access has been restored, enable two-step verification and make sure the recovery email address belongs to you.
Tell friends, relatives and work colleagues that the account was compromised, particularly if fraudulent money requests were sent. A quick warning can prevent another victim from transferring funds.
If your Facebook account is compromised
Use Facebook’s official account-recovery process, change the password and review active sessions and security settings. The password for the email address connected to Facebook should also be secured, especially if there is any possibility that the email account was compromised.
Do not follow account-recovery links sent by strangers claiming to work for Meta. Open Facebook through the official app or type the legitimate site address yourself and use its security and recovery tools.
Protect your accounts before a scam happens
Use a unique password for Facebook and for the email account connected to it. Turn on two-factor authentication where available and never give another person a one-time verification code.
On WhatsApp, enable two-step verification and periodically review linked devices. WhatsApp also advises users to use the official app rather than unofficial versions that can create security and privacy risks.
Keep your phone locked with a PIN, password or biometric protection. Install operating-system and app updates, and be suspicious of messages that try to create panic before asking you to click a link or reveal information.
Before sending money, make one call
The simplest protection is also one of the most effective: verify the request independently before transferring money.
If “your brother”, “your boss”, “your friend” or “your colleague” asks for emergency cash through social media, call the number you already have for that person. Do not rely only on the profile picture, account name or previous chat history.
A two-minute phone call can be the difference between helping someone you know and sending money to a criminal using their identity.
Official security help
WhatsApp provides guidance on compromised accounts, suspicious messages, linked devices and two-step verification through its official Help Center. Facebook users should use Meta’s official account security and recovery tools when they suspect unauthorised access.
Featured image: WhatsApp account security illustration. Photo: Rahul Shah/Pexels.
Official recovery instructions
If you or a contact loses access to an account, use the platform’s official recovery flow and never share a verification code with someone claiming to help.
