Treat it as a scam. The code is your account: whoever has it can sign in to your WhatsApp and message everyone you know.
Take out passwords, codes and card numbers first.
What it looks like
A message from a friend's account, which has often already been taken over:
Hey! I sent a code to your number by mistake, can you send it back to me?
Other versions:
- A link asking "is this you in this photo?" that opens a fake Meta page and links your WhatsApp to their device. Spain's INCIBE named this "GhostPairing" in June 2026.
- Getting the code from your voicemail, which often still has its default PIN.
Once they're in, they write to your contacts asking for money.
Red flags
- Anyone asking for a code, even a friend.
- A link to "a photo of you" or a page asking you to log in with Meta.
- A WhatsApp code you didn't ask for.
- A device you don't know under Linked devices.
If it's happening now
- Don't send the code to anyone.
- Turn on two-step verification in WhatsApp's settings.
- Change your voicemail PIN from the default.
- Check Linked devices in WhatsApp and remove any you don't know.
Already shared it?
- Sign back in to WhatsApp with your number straight away. The new code you get logs them out.
- Turn on two-step verification once you're back in.
- Warn your contacts by another app or a call that anyone asking for money "as you" isn't you.
- Lost your number too? Ask your phone company to block the SIM and give you a new one with the same number, then sign back in to WhatsApp. Report it to the police if money was asked for.
Where to report it
If money has gone or you shared card details, call your bank first, on the number on your card or in its app, never a number from the message.
Which country are you in?
- Free help, every day 8:00–23:00. INCIBE: call 017, WhatsApp 900 116 117 or Telegram @INCIBE017. Official page
- Report a scam message. Forward the email, or a screenshot of the text, to incidencias@incibe-cert.es. Official page
- If you lost money. Report it online at denuncias.policia.es, then sign it at a police station within 72 hours. Call 091 if it's happening now. Official page
- If your bank says no. Complain to your bank's customer service, then to the Banco de España if it won't help. Official page
- Report a scam text. Forward it to 7726, free. Official page
- Report a scam email. Forward it to report@phishing.gov.uk. Official page
- If you lost money. Report Fraud, at reportfraud.police.uk or 0300 123 2040 (England, Wales, Northern Ireland). In Scotland, Police Scotland on 101. Official page
- Report a scam text. Forward it to 33700, free. Official page
- Free help. 17Cyber, at 17cyber.gouv.fr. Official page
- Report a fake website. Pharos, at internet-signalement.gouv.fr. Official page
- If you lost money to an online scam. Complain online through THESEE on masecurite.interieur.gouv.fr. Official page
- If your card was used online. Block the card, then report the payments through Perceval on masecurite.interieur.gouv.fr. Official page
- Report a scam text. Forward it to 7726. Official page
- Report a scam. ReportFraud.ftc.gov. Official page
Read on the official pages on 12 November 2026.
Questions people ask
It came from my friend's real account. Isn't it safe? No. Their account has usually been taken over already, and you're the next one.
What is two-step verification? A PIN you choose that WhatsApp asks for when your number is set up on a new phone. Even with your code, nobody can get in without it.
Why does my voicemail matter? WhatsApp can send the code as a voice call. If you don't answer, it goes to voicemail, and a default PIN lets someone else listen to it.
Does this happen on Instagram too? Yes. The same trick works with any app that sends a code by text.
Can Kiwi check the message? Yes. Press the button, paste it, and Kiwi tells you what looks wrong.