Guide · WhatsApp security · For the owner whose customers message one number
Stopping someone taking over your WhatsApp business number: the two-step password, passkeys and linked-device warnings
A business's WhatsApp number is where its customers find it. Whoever controls the number sees the next message a customer sends and can answer as the business. Meta added several account protections to WhatsApp in 2026; this is what they are, and how the matching protection works on the WhatsApp Business Platform.
Published 7 October 2026 · Updated 8 October 2026
What Meta added in August
- Two-step verification became a password
- Meta said on 25 August 2026 that the extra check, until then a six-digit PIN, had been upgraded to a full password that can be longer and mix letters, numbers and special characters. Meta describes it as the layer that stops someone taking over the account even when they have the one-time code.
- Passkeys on more than one phone
- A passkey lets the owner sign back in with a fingerprint, face or screen lock instead of a code. Meta said more than a billion people had set one up, and that more than one passkey could now be added for someone who uses both an Android phone and an iPhone. Meta points to Settings, then Account, then Passkeys.
- More about unknown callers
- On Android, Meta said WhatsApp now shows more about a caller who is not in the contacts, such as whether the number is from another country and whether there are groups in common.
Why a business number needs this most
Meta's August post is about WhatsApp in general and does not name the WhatsApp Business app. Meta's own security checklist for the Business app, updated a day later on 26 August 2026, still describes two-step verification there as a six-digit PIN, asked whenever the number is registered on a new phone, and set under Settings, then Account, then Two-step verification. The business phone itself shows which one it offers.
Our reading
Warnings about linked devices
Many businesses answer WhatsApp from a computer linked to the phone. In its anti-scam campaign post of 29 September 2026, Meta said WhatsApp's Linked Device Warning alerts the owner when it detects a suspicious login attempt, a web client that was not authorised, or a possible account-linking scam. Our reading: when that warning appears on the business phone, treat it as urgent and check which computers are linked before answering any more customers.
Meta's Business app checklist adds the routine around it: give access only to the people who need it, review the linked devices regularly and remove any nobody recognises, change the PIN as soon as someone leaves the team, and keep the app and the phone updated automatically. Where several people answer customers, Meta suggests sharing the inbox through Meta Business Suite, so each person has a role of their own instead of the business's login and phone number.
The business portfolio, and calls that claim to be Meta
A person with full control of the portfolio can make it a rule for everyone else. Meta's help article on requiring it gives the path: Settings in Meta Business Suite, then Business portfolio info, then the Two-factor authentication menu under Business options, where the choice is admins only, everyone, or no one. No one is not offered where Meta has already made it compulsory. The rule applies at once, and anyone who has not set it up is asked to the next time they open the portfolio. Meta notes two side effects: in a private browser window, or a browser that clears its history on closing, a code may be asked for at every login, and a third-party app that manages the Pages or ad accounts asks for a code at its next sign-in.
On the WhatsApp Business Platform
A number on the Platform has its own two-step verification. Meta's developer page, as read on 7 October 2026, still describes a six-digit PIN that is needed whenever the number is registered, with no way to switch it off through Meta's interface for developers. A forgotten PIN is changed in WhatsApp Manager, in the number's settings under two-step verification. What else happens when a number is registered is in the registration guide, and what to do when someone copies the business's name or logo is in the fake account guide.
Questions
Can we make two-factor authentication compulsory for our staff in the business portfolio?
Yes, if you have full control. Meta's help article says to open Settings in Meta Business Suite, then Business portfolio info, and choose admins only or everyone in the Two-factor authentication menu under Business options. It applies at once.
Does our business portfolio need two-factor authentication?
Meta says it may be required before ads can be published, for people with advertising access in certain regions and in portfolios more than 90 days old. A newer portfolio can choose to require it. Each person switches it on through their own Facebook profile.
Someone phoned saying they are from Meta. How do we check?
Meta says its representatives never ask for a password, payment details or other sensitive information, and that its emails come only from its own domains, such as facebook.com or meta.com. Check the notifications in Business Support Home instead of acting on the call.
Has the two-step password reached the WhatsApp Business app?
Meta has not said so. Its announcement covers WhatsApp without naming the Business app, and its Business app checklist, updated on 26 August 2026, still describes a six-digit PIN. Open Settings, then Account, then Two-step verification on the business phone to see which it offers.
We think someone else is in our business account. What do we do?
Meta's Business app checklist says to verify the phone number again, which logs out anyone else, reset the PIN and remove any linked device you do not recognise. If someone is pretending to be your business, report them in the app.
A staff member who used our WhatsApp has left. What changes?
Meta says to change the PIN right away and remove any linked device you no longer recognise. Sharing the inbox through Meta Business Suite means the next person gets a role of their own, not the business's login.
Someone asked us for the code WhatsApp just sent. What protects us?
Never share it. Meta describes two-step verification as the layer that stops a takeover even when someone has the one-time code, which is why it should be switched on before anyone asks.
Can our passkey work on two phones?
Meta said in August 2026 that more than one passkey can now be added, for someone who uses both an Android phone and an iPhone.
We forgot the PIN on our Platform number. What now?
Meta's developer page says it is changed in WhatsApp Manager: open the number's settings, then two-step verification, then change the PIN.
Sources
- Meta Newsroom: New Account Security Features for WhatsApp (25 August 2026), read 7 October 2026.
- Meta Newsroom: Meta Partners With Government Agencies, Law Enforcement, and Safety Organizations to Launch Regional Anti-Scam Education Campaign (29 September 2026), read 7 October 2026.
- Meta's developer documentation: Two-Step Verification, read 7 October 2026.
- WhatsApp Business: Protecting your business on WhatsApp: Security best practices (26 August 2026), read 7 October 2026.
- Meta Business Help Center: About two-factor authentication for your business portfolio, read 8 October 2026.
- Meta Business Help Center: You've been contacted by a Meta representative, read 8 October 2026.
- Meta Business Help Center: How to require two-factor authentication for people in your Meta business portfolio, read 8 October 2026.
More plain-language notes like this one are on the guides page.
Want every chat in one place you own?
We set up a business's WhatsApp number on a system its team runs, so every customer conversation sits in one place the business owns. A short call is the easiest way to see how that would work for you.
Book a demo