Key Takeaways
- For a company, the biggest risk is a hijacked boss, colleague or business partner asking staff to transfer money. One Hong Kong firm lost about HK$15 million this way in September 2026.
- WhatsApp hijacking means a scammer logs in to your account after tricking you into sharing a 6-digit login code or an 8-digit device-pairing code.
- Hong Kong police recorded 1,993 cases from January to July 2026, up 170% year on year.
- Turning on two-step verification and checking Linked devices every month blocks most takeovers.
- Any payment request that arrives by WhatsApp should be confirmed by a phone call before money moves.
"Hi, this is the WhatsApp Security Check Centre. Please verify your account now." The sender even shows a blue tick. A few taps later, someone else is reading your chats and messaging your clients as you.
This guide explains what WhatsApp hijacking is, the routes scammers use in Hong Kong, and the settings and office rules that stop it.
What is WhatsApp hijacking?
WhatsApp hijacking is an account takeover scam. A criminal tricks you into giving away a 6-digit login code or an 8-digit device-pairing code, logs in to your WhatsApp from their own device, then reads your chats and messages your contacts as you, usually to ask for money or more codes.
Think of your WhatsApp account as your office keycard. Hijacking is not someone breaking down the door; it is someone persuading you to lend them the card for a minute.
Because the messages come from a real, familiar account, the people you talk to every day have little reason to doubt them. That trust is what scammers are really stealing.
How does WhatsApp hijacking work?
Scammers do not break WhatsApp's encryption. They persuade the account owner to complete a login for them, through a fake verification message, a phishing link, a QR code or a code "sent by mistake". Once inside, they message contacts with urgent payment requests or ask for more codes to take over further accounts.
The four routes seen in Hong Kong
- Fake "security check" with an 8-digit pairing code: a message from a "WhatsApp Security Check Centre", sometimes with a fake blue tick pasted into the profile picture, sends you to a fake page. You enter your phone number, the page shows an 8-digit code, and you are told to type it under Linked devices. That code links the scammer's device to your account (Wen Wei Po, 17 Oct 2026).
- Phishing SMS: a text claims your account will be suspended unless you act now. The link leads to a fake login page (RTHK, 31 Aug 2026).
- "I sent you my code by mistake": a friend whose account was already hijacked asks you to forward a 6-digit code. It is your own login code.
- QR codes: scanning a QR code from an unknown source can link a stranger's computer to your WhatsApp.
Police describe the trick as old technology used at scale: the same phishing SMS and fake pages, aimed at Hong Kong's most popular messaging app.
How common is WhatsApp hijacking in Hong Kong?
Very common. Hong Kong police handled 1,993 WhatsApp hijacking cases from January to July 2026, a 170% increase on the same period of 2025 and more than the 1,669 cases recorded in the whole of 2025. Reported losses for those seven months were HK$146.3 million.
Latest in Hong Kong (updated November 2026)
- January to July 2026: 1,993 cases, up 170% year on year; losses HK$146.3 million (RTHK, 31 Aug 2026).
- Late September 2026: about 50 cases in one week with losses of nearly HK$20 million. In the largest, a businessman paid about 2 million USDT, worth around HK$15 million, after his partner's account was hijacked (on.cc, 1 Oct 2026).
- Early October 2026: more than 150 cases in two weeks and losses above HK$15 million, many using the fake blue-tick "security check" (Wen Wei Po, 17 Oct 2026).
Most victims lose a few thousand to tens of thousands of dollars, but police say some cases exceed HK$10 million.
How can you tell if a WhatsApp account has been hijacked?
Watch for a device you do not recognise under Linked devices, a sudden logout from your own phone, login-code SMS you did not request, and contacts reporting strange messages from you. On the receiving side, the warning sign is a familiar contact suddenly asking for money, a code or a new bank account.
- An unknown computer or phone appears under Linked devices.
- You are logged out and asked to verify your number again.
- You receive a WhatsApp code by SMS that you did not request.
- A contact asks for a "code sent by mistake", a USDT or e-wallet transfer, or payment to a new account.
- A "WhatsApp" account contacts you first. WhatsApp support does not start chats asking you to verify, and a blue tick inside a profile picture is not a real verification badge.
How do you protect a WhatsApp account from hijacking?
Turn on two-step verification with a 6-digit PIN and a recovery email, check Linked devices every month, and never type or forward any code someone sends you. For companies, add one rule above all: payment or bank-detail changes requested by WhatsApp must be confirmed by a phone call to a known number.
For individuals: settings to change today
| Setting | iPhone | Android |
|---|---|---|
| Two-step verification | Settings > Account > Two-step verification > Turn on | ⋮ > Settings > Account > Two-step verification > Turn on |
| Linked devices | Settings > Linked devices > tap a device > Log out | ⋮ > Linked devices > tap a device > Log out |
| Recovery email | Add it when you set the two-step PIN | Add it when you set the two-step PIN |
Menu names follow WhatsApp's app wording as of November 2026 and may vary slightly by version.
For SMEs and IT teams
- Make call-back verification mandatory for any transfer, supplier bank change or crypto payment requested by chat.
- Ask staff who use WhatsApp for work to switch on two-step verification, and check it during onboarding.
- Keep a short list of who may approve payments, so a message from "the boss" alone is never enough.
- Run phishing awareness training at least once a year, using the fake security-check message as a real example.
Copy-ready notice for your staff group
Reminder: WhatsApp hijacking cases are rising in Hong Kong.
1. Never type or forward any 6-digit or 8-digit code that someone sends you.
2. Turn on Settings > Account > Two-step verification today.
3. Any request to pay, change bank details or send USDT by WhatsApp must be confirmed by phone call first.What should you do if your WhatsApp account is hijacked?
Act within the first hour. Log back in to WhatsApp with your phone number to push the scammer out, turn on two-step verification, log out every unknown linked device, warn your contacts through another channel, then report to WhatsApp and to the police, especially if money was requested or paid.
- Re-register WhatsApp on your phone with your number. This signs out the other device.
- Set up two-step verification and log out all unknown devices under Linked devices.
- Call or SMS key contacts, clients and suppliers: ignore any payment request sent from your WhatsApp.
- Follow WhatsApp's stolen account guide and report the account.
- If money was paid, call your bank immediately and report to the police. The Anti-Scam Helpline 18222 can help stop payments.
- Check suspicious numbers, links or accounts on Scameter before replying to anyone else.
Your 60-second WhatsApp security check
WhatsApp hijacking succeeds because the request comes from someone you trust. A few settings and one office rule remove most of the risk.
- Two-step verification is on.
- Linked devices shows only devices you own.
- You have never shared a WhatsApp code with anyone.
- Your team knows WhatsApp payment requests need a phone call.
- Your staff group has received the notice above.
Train your team to spot the next fake message
Most account takeovers start with one convincing message. A simulated phishing exercise followed by short staff training shows who would have clicked and teaches everyone what to check before acting.
Frequently Asked Questions
Does WhatsApp ever ask me to verify my account by chat?
No. WhatsApp does not start chats asking you to verify your account or enter a code. Treat any such message as a scam, even if it shows a blue tick.
Is WhatsApp hijacking the same as a SIM swap?
No. In a SIM swap the scammer takes over your phone number at the carrier. In WhatsApp hijacking you keep your number, but the scammer gets into your WhatsApp by tricking you into sharing a code.
Can two-step verification alone stop hijacking?
It stops most login-code attacks, because the scammer also needs your 6-digit PIN. It does not stop you from linking a device yourself, so never type an 8-digit pairing code that someone else gave you.
My friend asked me for a code they sent by mistake. What should I do?
Do not send it. Call your friend on a known number. Their account has very likely been hijacked, and the code is your own login code.