'Your security code changed' in a customer chat: what it means, Code Verify for WhatsApp Web, and the fake-app and spyware warnings

WhatsApp's article About security code change notifications says every end-to-end encrypted chat between you and one other person has its own security code. The code is used to check that the calls and messages you send in that chat are end-to-end encrypted.

Where it is

On the contact info screen, both as a QR code and a 60-digit number.

One per chat

Each one-to-one chat has its own code. The two people in the chat can compare codes to confirm their messages are end-to-end encrypted.

Not the keys

WhatsApp says security codes are just visible versions of the special keys shared between you, not the keys themselves, which are always kept secret.

WhatsApp says you can get a notification when the security code changes for a contact's phone in an end-to-end encrypted chat, and that you need to turn the setting on separately on each device where you want to see it.

Android

Settings > Account > Security notifications, then turn Show security notifications on this device on or off.

iPhone

Tap Settings or your profile picture, then Account > Security Notifications, then turn Show Security Notifications on This Phone on or off.

Computer

Settings > Account > Security notifications, then turn Show security notifications on this computer on or off.

WhatsApp's article Why am I seeing a new system message in my WhatsApp chats? is written for the customer. It says some businesses choose to use Meta or another company to help them manage their messages, and when a business manages its messages with another company, WhatsApp shows the customer a system message saying so. A business that manages its chats by itself shows a different system message. The article shows both messages as pictures.

Ads

Even if a business uses Meta to manage its messages, WhatsApp says Meta won't automatically use the customer's messages to inform the ads they see.

The business's own marketing

WhatsApp says businesses can use their conversations with customers for their own marketing, which may include advertising on Facebook or elsewhere, just as with a call centre or email.

Delivery

Every WhatsApp message is protected by the Signal encryption protocol, and a message to a WhatsApp business account is delivered securely to the destination the business chose.

"Cannot validate the page due to another browser extension"

WhatsApp says your other active extensions might be able to read or change what you see on WhatsApp Web. Pause them, run the check again, then unpause them; you may need to reload WhatsApp Web. If it keeps happening, turn off any extension you're unsure of while you use the page. If you trust your other extensions, no action is needed.

"Network timed out. Unable to validate this page."

The connection may be unstable or something is disrupting the check. Reload the page and open the extension again, try another Wi-Fi network, or pause other extensions and check again. If it persists, WhatsApp says to proceed with caution and consider logging out of WhatsApp Web or using WhatsApp on your phone, because your messages on the web might no longer be private.

"Validation Failure"

WhatsApp lists three causes: another extension getting in the way, the code running your WhatsApp Web page not matching everyone else's, or something going wrong on WhatsApp's side. Pause other extensions and check again, then see whether Meta has addressed it publicly on its Engineering at Meta website. If it is not a known issue, log out of WhatsApp Web and use WhatsApp on your phone, because your messages on the web might no longer be private.

WhatsApp's article Protecting users from spyware says its teams work against threats including commercial spyware companies trying to put malware on people's phones. It says these attackers look for weaknesses in apps or the phone's operating system, or try to trick people into clicking malicious links or downloading malware.

If WhatsApp believes your phone has come under threat, it says it may tell you directly in a WhatsApp chat. That chat has a system message at the top confirming it is the official WhatsApp Support account, and a blue checkmark next to WhatsApp Support. How to recognise the real WhatsApp chat is in Is that message really from WhatsApp?

The article describes Strict account settings as an advanced, optional feature built for people who may face elevated risk, to be turned on only if you believe you might be targeted. Both Strict account settings and Privacy Checkup are covered in Your WhatsApp Business number was taken over.

A separate article, Protecting our users from a video calling cyber attack, says that in May 2019 WhatsApp stopped a highly sophisticated attack that used its video calling system to send malware to some users' phones. The attack did not need the person to answer the call. WhatsApp says it quickly added new protections, issued an update to WhatsApp, and took legal action.