You’ve probably seen it happen to someone you know. A friend’s WhatsApp starts messaging their contacts asking for money urgently, or claiming they’re stranded somewhere. The account is real. The person behind it isn’t.
That kind of takeover is common in Nigeria, and it usually works the same way: someone gets hold of your SIM through a swap, or tricks you into reading out the six-digit code WhatsApp texts you. Two-step verification shuts that down, because even with your SIM and your verification code, they still can’t get in without a PIN only you know.
What Two-Step Verification Actually Does
It adds a six-digit PIN that WhatsApp asks for whenever your number is registered on a device again.
To be clear about what it is and isn’t:
- It does stop someone else setting up your WhatsApp on their phone, even if they have your SIM or your SMS code.
- It does not lock your existing chats on your own phone. For that you’d use fingerprint lock or chat lock.
- It does not stop someone who already has your unlocked phone in their hand.
WhatsApp will also occasionally prompt you for the PIN while you’re using the app normally. That’s deliberate, so you don’t forget it, and there’s no way to switch those prompts off.
How to Turn It On
- Open WhatsApp.
- On Android, tap the three dots in the top right and choose Settings. On iPhone, tap Settings in the bottom right corner.
- Tap Account.
- Tap Two-step verification.
- Tap Turn on.
- Enter a six-digit PIN.
- Enter it again to confirm.
- Add an email address you can actually get into.
- Confirm the email and tap Save or Done.
That’s it. Nothing changes about how you use WhatsApp day to day.
Please Add the Email. Here’s Why It Matters
WhatsApp lets you skip the email, and plenty of people do. It’s a bad idea, and the reason is worth understanding.
If you forget your PIN and you have an email on file, WhatsApp sends you a reset link and you’re back in within minutes.
If you forget your PIN and you don’t have an email on file, you have to wait seven full days from your last use of WhatsApp before you can register your number again without the PIN. There is no shortcut, no support ticket, and no appeal. Seven days with no WhatsApp.
It gets worse. When you finally do reregister after that wait, any messages that were sitting undelivered are wiped. And if your number goes unused for more than 30 days and is then reverified without the PIN, the account is deleted outright and a fresh one is created in its place.
Type the email carefully. A typo means you’ve effectively added no email at all, and you won’t find out until the day you need it.
The Seven-Day Rule Is Also Protecting You
That same rule works in your favour, and it’s the part that actually defeats a SIM swap.
If someone swaps your SIM today and tries to set up your WhatsApp on their phone, they’ll be asked for your PIN. They don’t have it. So they’re told to wait seven days, counted from the last time you used WhatsApp. Seven days is a long time in a scam, and it gives you a wide window to notice, report the SIM to your network, and lock things down.
Without two-step verification, they’d be in within minutes of getting your SIM.
Picking a PIN That Isn’t Guessable
- Skip the obvious ones: 123456, 000000, 111111.
- Don’t use your birthday, your year of birth, or anything on your NIN or ID.
- Don’t reuse your bank or POS PIN. If one gets compromised, you don’t want both going at once.
- Avoid the last six digits of your phone number, which is easier to guess than people think.
Pick something you’ll remember without writing down, then trust the periodic prompts to keep it fresh in your memory.
Add Passkey Sign-In Too, If You Can
Separate from the PIN, WhatsApp now supports passkeys, which let you sign in using your fingerprint, face, or screen lock instead of waiting for an SMS code.
The security benefit is direct: if you’re not relying on an SMS code to log in, there’s no code for a scammer to trick out of you and nothing useful for a SIM swapper to intercept. It needs Android 9 or iOS 16 and above, and you’ll find it under Settings > Account > Passkeys. Use it alongside your PIN, not instead of it.
Changing or Turning It Off
- Go to Settings > Account > Two-step verification.
- Choose Change PIN, Change email address, or Turn off.
Changing the email is worth doing if you’ve since abandoned the address you originally used. Turning the feature off entirely is worth doing basically never.
What to Do If Your Account Is Already Taken Over
If someone is already using your WhatsApp, act quickly:
- Reregister your number. Open WhatsApp, enter your number, and request a new verification code by SMS. Entering that code signs the other person out immediately, because only one phone can hold an account at a time.
- Turn on two-step verification straight away so they can’t simply come back.
- Warn your contacts by any other channel you have. Post a status, send a group message, call the people most likely to have been targeted. Money requests sent from your account are the whole point of the attack.
- Contact your network provider if you think your SIM was swapped, and get the line blocked and reissued.
- Check your money apps. If your phone or SIM is gone, the same access can reach your banking apps. Our guide on blocking your account if your phone or card is stolen covers that side.
Two Other Five-Minute Jobs Worth Doing
While you’re in the settings, these pair well with two-step verification:
- Set up a chat backup and encrypt it. A PIN protects your account, but it won’t bring your chats back if the phone is gone. See how to back up WhatsApp chats to Google Drive, including the encryption step most people skip.
- Turn on fingerprint or face lock for the app itself under Settings, Privacy, App lock. That covers the gap two-step verification doesn’t, which is someone picking up your unlocked phone.
A few broader phone security habits are worth reading alongside this if you handle money or business on your phone.
Frequently Asked Questions
What happens if I forget my WhatsApp PIN?
With an email on file, you request a reset link and you’re back in quickly. Without one, you must wait seven days from your last use of WhatsApp before you can register the number again, and undelivered messages are lost when you do.
Does two-step verification stop someone reading chats on my phone?
No. It only applies when your number is being registered on a device. To lock the app itself, use fingerprint or face lock under Privacy settings.
Can I stop WhatsApp asking for my PIN so often?
No. The periodic prompts exist so you don’t forget the PIN, and there’s no setting to disable them while two-step verification is on.
Will this protect me if my phone is stolen?
Partly. It stops the thief moving your account to another phone, but not from reading what’s already open on your device. Pair it with app lock and a strong screen lock.
Does two-step verification work on WhatsApp Business?
Yes, the setting works the same way and sits in the same place under Settings, Account.
Two minutes now saves you an enormous amount of trouble later. Set the PIN, add a real email address you can access, and add a passkey if your phone supports it. Then tell the people in your life to do the same, because the scam that hits your contacts usually starts with someone else’s unprotected account.
