Fake WhatsApp Customer Service Chatbot Scam
Scammers operate fake 'WhatsApp Support' accounts within WhatsApp itself or on the web, impersonating the platform's help team to steal account registration codes, enabling complete account hijacking.
Part of: Fake Customer-Service Chatbots
Last reviewed: 8 June 2026
WhatsApp's genuine support team can be reached through Settings > Help > Contact Us inside the app. WhatsApp does not proactively message users from within the platform to ask for their account verification codes or personal information, and it has no official support phone number.
Because WhatsApp accounts are tied to phone numbers, not usernames, the most valuable thing a scammer can steal is the six-digit registration code WhatsApp sends by SMS when a new device tries to register a number. Obtaining this code allows an attacker to register the victim's number on their own device, effectively hijacking the account and gaining access to all existing chats.
Fake support chatbots — delivered via WhatsApp message, web chat widget, or even a phishing website — are engineered specifically to elicit this code.
How this scam works on the WhatsApp brand
The victim receives a WhatsApp message from an account with a WhatsApp logo as the profile picture, claiming to be WhatsApp Technical Support. The message states the account is under review for suspicious activity and must be verified within 24 hours or it will be suspended. A code will be sent to the user's phone number and they must reply with it to complete verification.
In reality, sending the code completes a new device registration for the attacker. Once the hijack is complete, the scammer contacts the victim's WhatsApp contacts requesting money or spreading further phishing messages.
A web variant involves a page at a domain such as whatsapp-support-help.com that displays a chat widget where the 'agent' walks the victim through the same code-sharing process.
Common red flags
- WhatsApp will never message you via the platform asking for your six-digit verification code.
- The 'support' account has only a generic profile picture — not an official verified business profile.
- The message uses urgency ('your account will be deleted in 24 hours') to prevent careful thinking.
- The support URL is not whatsapp.com/contact — it contains misspellings or extra words.
- You are asked to forward or share the code you just received by SMS.
- The 'support agent' replies instantly at any hour, suggesting an automated script.
How to protect yourself
- Enable a WhatsApp six-digit PIN (Settings > Account > Two-Step Verification) — this second layer of verification is required whenever your number is re-registered, blocking hijackers who have only the SMS code.
- Never share your WhatsApp verification SMS code with anyone, including people claiming to be WhatsApp support.
- Contact real WhatsApp support only through Settings > Help > Contact Us inside the app.
- If your account has been hijacked, re-register your number on your own device immediately by reinstalling WhatsApp — this logs out the attacker.
- Alert your contacts if your account was compromised so they do not act on messages sent by the hijacker.
How to report it
- Report the fraudulent account to WhatsApp within the app: open the chat > tap the contact name > Report.
- Report to the FTC at ReportFraud.ftc.gov.
- UK users: report to Action Fraud at actionfraud.police.uk.
- Forward any phishing SMS or email to the Anti-Phishing Working Group at [email protected].
Frequently asked questions
What is Two-Step Verification on WhatsApp and why does it help?
Two-Step Verification adds a six-digit PIN that must be entered whenever your phone number is re-registered on WhatsApp. Even if a scammer obtains your SMS registration code, they cannot complete the hijack without this PIN.
Will my chats be visible to someone who hijacks my WhatsApp number?
An attacker who registers your number on their device starts with a fresh message history, but they gain full access to your contacts and can impersonate you. They cannot see your backed-up chat history unless they also access your Google Drive or iCloud backup.
How do I re-register my own WhatsApp number after a hijack?
Reinstall WhatsApp and enter your phone number. WhatsApp will send an SMS code to your number and guide you through re-registration. This automatically logs the attacker out. You should also enable Two-Step Verification immediately afterward.