Guide · Security · For the owner deciding how login codes go out
Is a WhatsApp login code safe? Meta's authentication best practices: recycled numbers, binding the account, why codes never arrive, and one number per business
Sending login and password-reset codes on WhatsApp instead of SMS is cheaper in many countries and the codes arrive faster. The question an owner should ask before switching is whether it is as safe, and Meta's own answer is more careful than the sales pitch. Its best-practices page says plainly that a phone number and the WhatsApp account behind it are not always the same person, explains what to do about it, and lists the ordinary reasons a code never arrives. Here it is in the owner's terms.
Published 2 October 2026
The honest caveat Meta leads with
WhatsApp checks that a person owns a phone number once, when they sign up, by texting or calling it. After that it does not check again. Mobile companies recycle numbers, so a number your customer holds today may still be attached to a WhatsApp account the previous owner set up and never closed. Meta's page draws the conclusion itself: for anything sensitive, especially account recovery where the code is the only proof, a phone number and the WhatsApp account tied to it should not be treated as the same thing.
- Meta's first fix: verify once, then bind
- Treat WhatsApp like any new login channel. Send a first code while the customer is already signed in or registering, have them type it into your app, and from then on keep the proof that this WhatsApp account is this customer. Meta's identity change check is the mechanism: a later code goes only to the WhatsApp account that passed the first one, and fails if the number has changed hands.
- Meta's second fix: a second question
- For the most sensitive moments, ask something more than the code: a second factor, a security question, an email confirmation. The code proves someone holds the WhatsApp account; the second challenge proves it is your customer.
- What WhatsApp does on its side
- Authentication messages cannot be forwarded, which blunts the commonest phishing trick, and they travel end-to-end encrypted between Meta's servers and the customer's phone. Meta adds that it cannot vouch for unofficial WhatsApp apps, so a customer using one gets no guarantee.
Where this connects
Why a code never arrives
- The customer is not on WhatsApp. Meta's page says the usual cause of undeliverable codes is a customer choosing WhatsApp when they do not actually have it. On a phone where your app and WhatsApp live together, the app can check whether WhatsApp is installed before offering it as an option.
- The WhatsApp number is a different number. People with two SIMs often text on one and use WhatsApp on the other. An app that assumes the sign-up number is the WhatsApp number sends codes into the void. Meta's advice: when the customer picks WhatsApp, let them confirm which number their WhatsApp is on.
- Delivered, but not typed in. If codes arrive and customers still drop out, Meta points at friction and recommends one-tap autofill on Android, where the code fills itself. On iPhones running iOS 26 or later, since 15 June 2026 the code offers itself from the notification without anything extra from the business.
- Permission was never asked. Meta's messaging policy requires opt-in before any message, codes included. The pattern Meta suggests is a choice of channels at sign-up, WhatsApp among them, which doubles as the consent described in the opt-in guide.
When a code fails outright rather than silently, Meta returns a reason; the common ones are in the failure reasons guide.
One number per business, no exceptions
The page ends with a rule that matters to groups and agencies: every business must send its codes through its own WhatsApp account, its own Messaging account and its own number. Sharing a Messaging account across separate legal entities is against Meta's terms and policy, not merely untidy. A holding company with three brands needs three set-ups, and a provider that offers to run several clients' codes through one account is offering a policy breach. The two accounts are explained in the account split guide.
Questions
Is a WhatsApp code safer than an SMS code?
In transit, yes: Meta says authentication messages are end-to-end encrypted and cannot be forwarded. On the question of who holds the number, no better by itself, because numbers are recycled. Meta's page says to bind the WhatsApp account to the customer with a first verified code, after which a recycled number makes the message fail instead of reaching a stranger, which is better than SMS can do.
Can we use WhatsApp codes for password resets?
Meta's page singles out account recovery as the case where a WhatsApp code alone is not enough, because it may be the only proof. Use it there only with the binding Meta describes or with a second check on top.
Customers say they chose WhatsApp and nothing came. What is wrong?
Meta's page lists two usual causes: the customer is not actually on WhatsApp, or their WhatsApp is on a different number from the one they typed. Check for the app before offering the option, and let the customer confirm their WhatsApp number when they choose it.
We run several brands. Can one WhatsApp account send codes for all of them?
No. Meta's page says each business must use its own WhatsApp account, Messaging account and number, and that sharing a Messaging account across separate businesses breaches its terms and messaging policy.
Sources
- Meta's developer documentation: Authentication best practices, read 2 October 2026.
More plain-language notes like this one are on the guides page.
Thinking of moving your login codes to WhatsApp?
We set up a business's WhatsApp number on a proper system that sends codes through its own accounts, binds each customer's WhatsApp account with a first verified code as Meta recommends, lets customers confirm which number their WhatsApp is on, and keeps a second check for password resets. A short call is the easiest way to see whether it fits your business.
Book a demo