Ghana’s Cyber Security Authority has described fraud on everyday messaging apps as one of the biggest cyber risks facing individuals, and has urged users to turn on extra protection. WhatsApp account takeovers are a big part of that. Once a fraudster controls your WhatsApp, they message your contacts asking for urgent money, and because the message comes from your name, people believe it.

The fix is a WhatsApp feature called two-step verification. It takes about two minutes and it is free.

How WhatsApp accounts get stolen

When WhatsApp is installed on a new phone, it sends a six-digit code to your number by SMS. Whoever enters that code gets your account. So scammers try to get the code from you:

  • A message from a “friend” says they sent you a code by mistake and asks you to forward it.
  • A caller pretending to be WhatsApp, a telco or a promotion asks you to read out the code.
  • A fake link asks you to “verify” your account.

If you share that code, you hand over your account. Two-step verification adds a second lock: even with the SMS code, nobody can set up your WhatsApp on a new phone without your personal six-digit PIN.

Set it up on Android

  1. Open WhatsApp and tap the three dots, then Settings.
  2. Tap Account → Two-step verification.
  3. Tap Turn on (or Enable).
  4. Enter a six-digit PIN you will remember, then confirm it.
  5. Add an email address (recommended) so you can reset the PIN if you forget it.

Set it up on iPhone

  1. Open WhatsApp and tap Settings.
  2. Tap Account → Two-step verification.
  3. Tap Turn on or Set up PIN.
  4. Choose a six-digit PIN and confirm it.
  5. Add a recovery email address.
WhatsApp does not check the email address you type, so double-check it is correct. A typo means you cannot recover your PIN.

Choosing your WhatsApp PIN

  • Do not reuse your Mobile Money PIN or your phone lock code.
  • Avoid your birthday and simple patterns like 123456.
  • WhatsApp will occasionally ask you to enter the PIN to help you remember it. That is normal.

More settings worth turning on

  • Screen lock: lock your phone with a PIN or fingerprint, and use WhatsApp’s own app lock if your phone supports it.
  • Linked devices: check Settings → Linked devices now and then. Log out of any computer or tablet you do not recognise.
  • Group privacy: in Settings → Privacy → Groups, limit who can add you to groups, to cut down on scam groups.
  • Silence unknown callers (in Privacy settings, on newer versions) if you get spam calls.

If your account has already been taken

  1. Reinstall WhatsApp on your phone and verify your number with the SMS code. This logs the other person out.
  2. If they had already set two-step verification, you may have to wait before you can get back in. Keep trying, and contact WhatsApp support from the app.
  3. Warn your contacts immediately through another channel: SMS, a call, or a post on your status from a family member’s phone.
  4. Report any money lost to your mobile money provider and to the Cyber Security Authority on 292.

This guide was checked in October 2026. Menus and services change, so if something looks different on your phone, check with your provider.

Common questions

Is two-step verification the same as a screen lock?

No. A screen lock protects the phone in your hand. Two-step verification protects your account if someone tries to register your number on a different phone.

What if I forget my WhatsApp PIN?

If you added an email address, you can request a reset link from WhatsApp. That is why adding a correct email address matters.

Will WhatsApp ask for the PIN every day?

No. It asks occasionally to help you remember it, and whenever you register WhatsApp on a new phone.

Does two-step verification stop all WhatsApp scams?

It stops account takeovers through stolen SMS codes, which is the most common route. You still need to watch out for scams that ask you to send money, even from familiar names.

Sources