Guide · WhatsApp security · For the owner who can't get into the shop's number

Your WhatsApp business number was taken over: getting it back with the 6-digit code, the 7-day wait, and the locks to switch on after

The shop's WhatsApp opens on someone else's phone, or yours says the number was registered on a new device. Whoever has it could pretend to be you in chats and groups, WhatsApp's Help Center warns. This guide puts WhatsApp's Help Center steps for getting the number back in order, then the locks to switch on once it is yours again.

Published 15 October 2026

Getting the number back

WhatsApp's article How to recover a compromised account gives these steps, and says you need a SIM card with the same number:

1. Log back in: Open WhatsApp and tap Log back in > Continue.
2. Your number: If asked, enter your full international phone number and tap Next > Ok.
3. The 6-digit code: Enter the 6-digit code that arrives by SMS or phone call. Never share it with anyone, not even friends or family.
Everyone else is logged out: When you register again with the 6-digit code, every device logged into the account is logged out automatically.
A PIN you never set: In rare cases the person using your account may have turned on two-step verification. If you don't have the PIN, the article says to wait 7 days and try again. Whether you know the PIN or not, anyone using your account is logged out once you enter the 6-digit code.
You need the SIM: The article says it isn't possible to recover an account without a SIM card with the same phone number.

Our reading

For a business number, keep the SIM in a phone the owner controls. If the SIM sits with a former employee or an agency, getting it back comes first. Registration codes that don't arrive, dual SIM and travelling are in our guide Registering your WhatsApp Business app number.

What doesn't work, and what not to do

Changing the password: The recovery article says changing your password won't remove someone else from your account. Passwords and two-step verification protect an account you still have. The only way to remove someone who has taken it over is to register again with the 6-digit code.
Turning on security first: Account security tips says the same: turning these features on can't restore lost access or remove someone already using your account. Recover the account first.
Reporting your own account: If you report the account you're trying to recover, WhatsApp might ban it for breaking its Terms of Service, and you could lose the account or its data. The article says to recover it before reporting.
Asking who did it: WhatsApp can't tell you who accessed your account, or when or where.
Your old chats: Messages are end-to-end encrypted and stored on your device, so someone who registers your account on a new device can't read your past conversations.
Your contacts: The article says to tell family and friends, because the person could pretend to be you in chats and groups.

Our reading

For a shop, “family and friends” means customers and suppliers. Post a short notice on your other channels: don't pay or send details to anyone messaging from the number until you say it's safe. If the screen said you were banned rather than logged out, that is a different problem, covered in WhatsApp business number restricted or temporarily banned.

A code arrived that you didn't ask for

WhatsApp's article Received verification code without requesting it says WhatsApp sends a notification when someone tries to register your number. It often happens because another user mistyped their own number, and it can also be a takeover attempt.

You are still in control: Without the SMS code sent to your number, nobody can finish registering it, so the account stays yours.
Never share the code: The article says you should never share your WhatsApp verification code with others.
No name: WhatsApp doesn't have enough information to tell you who tried.

Our reading

If anyone, including a “customer” or someone claiming to be WhatsApp, asks you to forward a WhatsApp code, treat it as an attempt to take the number. Tell staff the same. The scam signs WhatsApp lists are in our guide Is that message really from WhatsApp?

Someone is using your shop's name or photo

WhatsApp's article What to do if someone is pretending to be you covers accounts using a profile photo that isn't theirs to scam people:

Report: Report the user and the suspicious messages. When you report someone in a one-to-one chat, WhatsApp receives up to five of the last messages they sent you, and it might ban the account after review.
Block: Blocking stops that number contacting you on WhatsApp again.
Screenshots: WhatsApp blocks people from taking screenshots of other users' profile photos.
Privacy settings: You can control who sees your profile photo and about information, and who can contact you.

The two-step password, and forgetting it

WhatsApp's article How to manage two-step verification settings says WhatsApp is upgrading the 6-digit PIN used in two-step verification to a password. About two-step verification says you can choose your phone number, a password or an email address as the extra check. About passwords says a password needs at least 8 characters, at least 1 letter and at least 1 number. Why Meta made the change is in our guide Stopping someone taking over your WhatsApp business number.

WhatsApp's article Can't remember password gives two ways back:

Verify another way: Tap Verify another way, choose email, SMS or Voice call, tap Continue and enter the code you receive.
Reset account: If you can't complete two-step verification, the option to reset your account unlocks after a few days, under Verify another way > See more. It can't be undone.
Logged in within 30 days: The reset deletes the messages you received since you last logged in. Your account history and profile stay.
Not logged in for over 30 days: The reset deletes your messages and your profile, and they can't be recovered.
Changing it: While logged in you can set a new password without the old one: your profile > Account > Password > Change password (Android; on iPhone, You > Account > Password > Change password).

Our reading

Keep the business number's password with the owner, not with whoever answers the phone. When someone who knew it leaves, change it the same day.

A recovery email and a passkey

Recovery email: WhatsApp's article Add your email to your WhatsApp account says an email lets you recover the account even without a connection for SMS or phone call. Add it under Settings > Account > Email Address; WhatsApp sends a verification code to the email.
Passkey: About passkeys says a passkey uses your phone's fingerprint, face or screen lock. When you register your number or restore your account, you can use it instead of an SMS code. Your biometric data never leaves your device.

Our reading

Use an email the business owns and the owner can always open, not a staff member's personal inbox.

App lock and chat lock on a phone staff can pick up

App lock on the phone: WhatsApp's 5 Tips article says app lock needs your fingerprint or face (Android), or Touch ID or Face ID (iPhone), to open WhatsApp. You can still reply from notifications and answer calls while it is locked.
App lock on WhatsApp Web: How to use app lock (the WhatsApp Web version) uses a password of 6 to 128 characters, and can lock after 1 minute, 15 minutes, 1 hour or 8 hours. Notifications don't appear while it is locked.
Chat lock: Swipe left on a chat, or tap and hold it, then more options > Lock Chat. Locked chats move to a folder behind extra authentication, and no one else in the chat is told.
What chat lock doesn't stop: Turn chat lock on or off says calls from contacts in locked chats still come through, and notifications for locked chats hide the content and the contact.
A forgotten secret code: If you hide locked chats and forget the secret code, unlock and clear returns them to the chat list but clears every message, photo and video in them. You can only restore what was in a backup made before.

Our reading

App lock keeps people who aren't enrolled out of the app, but anyone holding the phone can still reply from a notification. On a counter phone several people handle, decide who should be able to open WhatsApp before turning it on. If you hide locked chats, keep the secret code with the owner: forgetting it means unlock and clear, which wipes those chats unless a backup made before has them. Linked computers are covered in Answering customers from a computer.

Privacy settings and privacy checkup

WhatsApp's article How to change your privacy settings lists the defaults:

Anyone: Any user can see your profile photo, read receipts and when you're online, and anyone can add you to groups or mention you in a status. Unknown callers can call you.
Contacts: Your contacts can see your statuses, about information, profile links and when you were last seen.
Your number: There is no way to hide your phone number on WhatsApp, and you can't hide group members' numbers in a group.
Privacy checkup: About privacy checkup says Settings > Privacy > Privacy Checkup puts these in one place: who can contact you, your personal info, privacy in your chats, and protection for your account (two-step verification, a passkey and a recovery email).
Silence unknown callers: How to silence unknown callers (Android version): Settings > Privacy > Calls. Silenced calls still show in the Calls tab and your notifications, but the phone won't ring. Once you call or message a silenced caller, their calls can't be silenced again.

Our reading

A sales line wants new customers to reach it. Silencing unknown callers means a first-time customer's call won't ring, and hiding the profile photo from everyone hides your logo from them too. Run privacy checkup, but switch on the account protections and leave the contact settings open.

Strict account settings is not for a sales line

WhatsApp's article How to use Strict account settings says the feature is built for the very few users who may be the target of sophisticated cyber attacks, and most people are not. When it is on:

Unknown senders: Attachments and media from unknown senders are blocked, link previews are turned off, and your chats with people outside your contacts have limitations.
Calls: Calls from unknown numbers are silenced and your IP address is hidden in calls. How to protect your IP address on WhatsApp calls says this relays calls through WhatsApp's servers, and call quality might be reduced.
Profile and groups: Last seen, profile photo, about and profile links are locked to contacts or a chosen list, and only known contacts or that list can add you to groups.
Where: Settings > Privacy > Advanced, and only from your primary device.

Our reading

On a business number this would block new customers' photos and silence their calls. Keep it for a personal number if you believe you are being targeted, not for the shop's line.

AI: who else can read the shop phone's screen

WhatsApp's article About Google's on-screen AI features on WhatsApp, for Android only, says Google's optional AI features can view what is on the phone's screen:

Off by default: These Google AI features are turned off by default.
If switched on: They can view the messages on your screen while you use WhatsApp and make suggestions. Google processes this under its own terms of service and privacy policies, which may include processing in the cloud. WhatsApp doesn't have access to the suggestions.
Off for WhatsApp only: In the phone's Settings app, tap Apps > WhatsApp, and under Screen access turn Proactive Assistance off. Other Google AI features keep working.

Our reading

A shop phone holds customers' addresses, order details and payment screenshots. If the phone's AI assistant is on, decide whether it should see WhatsApp, and turn Proactive Assistance off for WhatsApp if not.

What this means for your shop

BitByteCore is a verified Meta Tech Provider (since 9 September 2026). This guide repeats WhatsApp's Help Center as we read it on 15 October 2026, and is not legal advice. The articles describe WhatsApp in general, not only the WhatsApp Business app.

Our reading

The order matters: get the number back with the 6-digit code, warn customers, then add the password, a recovery email and a passkey, and check linked devices. Moving to a new phone or losing one is in New phone, new number or lost phone.

Questions

How do I get my hacked WhatsApp Business number back?

WhatsApp's Help Center says to tap Log back in > Continue and enter the 6-digit code sent to your number by SMS or call. Every other device is then logged out. You need the SIM with that number.

Will changing my WhatsApp password remove the hacker?

No. WhatsApp says changing your password won't remove someone else from your account. Only registering again with the 6-digit code does.

WhatsApp asks for a PIN I never set. What do I do?

WhatsApp says the person using your account may have turned on two-step verification. If you don't have the PIN, wait 7 days and try again.

Should I report my hacked account to WhatsApp?

Recover it first. WhatsApp says that if you report the account you're trying to recover, it might ban it and you could lose the account or its data.

Can the hacker read my old customer chats?

WhatsApp says messages are end-to-end encrypted and stored on your device, so someone who registers your account on a new device can't read your past conversations.

I got a WhatsApp code I didn't ask for. Is my account hacked?

Not by itself. WhatsApp says it often means someone mistyped their own number, and it can also be someone trying to take over your account. Without the SMS code nobody can register your number, so never share it.

What happens if I reset my account because I forgot the password?

WhatsApp says the reset can't be undone. If you logged in within 30 days, it deletes messages received since then; after more than 30 days, it deletes your messages and profile.

Who is BitByteCore?

BitByteCore is a verified Meta Tech Provider (since 9 September 2026). This guide repeats WhatsApp's Help Center, and is not legal advice.

Sources

WhatsApp Help Center: How to recover a compromised account, read 15 October 2026.
WhatsApp Help Center: Received verification code without requesting it, read 15 October 2026.
WhatsApp Help Center: What to do if someone is pretending to be you on WhatsApp, read 15 October 2026.
WhatsApp Help Center: Account security tips, read 15 October 2026.
WhatsApp Help Center: About two-step verification, read 15 October 2026.
WhatsApp Help Center: How to manage two-step verification settings, read 15 October 2026.
WhatsApp Help Center: About passwords, read 15 October 2026.
WhatsApp Help Center: Can't remember password, read 15 October 2026.
WhatsApp Help Center: Add your email to your WhatsApp account, read 15 October 2026.
WhatsApp Help Center: About passkeys, read 15 October 2026.
WhatsApp Help Center: 5 Tips to keep your WhatsApp account safe and secure, read 15 October 2026.
WhatsApp Help Center: How to use app lock (WhatsApp Web version), read 15 October 2026.
WhatsApp Help Center: Turn chat lock on or off, read 15 October 2026.
WhatsApp Help Center: How to change your privacy settings, read 15 October 2026.
WhatsApp Help Center: About privacy checkup, read 15 October 2026.
WhatsApp Help Center: How to silence unknown callers, read 15 October 2026.
WhatsApp Help Center: How to use Strict account settings, read 15 October 2026.
WhatsApp Help Center: How to protect your IP address on WhatsApp calls, read 15 October 2026.
WhatsApp Help Center: About Google's on-screen AI features on WhatsApp, read 15 October 2026.

This guide describes WhatsApp's pages as we read them, and is not legal advice. More plain-language notes like this one are on the guides page.

Want customer conversations in one place you own?

We set up a business's WhatsApp number on a system its team runs, so every customer conversation sits in one place the business owns. A short call is the easiest way to see how that would work for you.

Book a demo