Number Porting Scams on WhatsApp
Scammers use WhatsApp messages to trick subscribers into revealing the account authorisation codes needed to port their number to an attacker-controlled SIM.
Part of: Number Porting Scams
Last reviewed: 1 June 2026
WhatsApp itself uses phone numbers as identifiers, creating a paradox: a scammer who can port your number also gains control of your WhatsApp account. This makes number-porting attacks via WhatsApp particularly dangerous — the attacker gains access to your entire message history, contact list, and group memberships the moment the port completes.
The WhatsApp-based variant of this attack often targets high-profile community members, business owners, and anyone whose WhatsApp account has significant social or financial value.
How this scam works on WhatsApp
An attacker sends a WhatsApp message claiming to be from the victim's carrier or WhatsApp support, warning of a security issue. The message states that to secure the account, the subscriber must forward a six-digit code they will receive by SMS. This code is in fact a WhatsApp account-transfer verification code that the attacker has already triggered by attempting to register the victim's number on a new device.
Once the attacker has the six-digit code, they log in to WhatsApp with the victim's number. They then use the account to message the victim's contacts, requesting money transfers or sensitive information. The original owner is locked out.
In more elaborate attacks, the hijacked WhatsApp is used as a stepping stone to request port-out authorisation from the carrier through the authenticated account, completing a full SIM swap.
Common red flags
- WhatsApp message asking you to forward a six-digit code you just received by SMS
- Message claims to be from carrier support or WhatsApp security team
- You receive an unexpected SMS code you did not request
- Sudden log-out from WhatsApp on your device
- Contacts report receiving messages from your number asking for money
- Message from a known contact asking you to forward a code — they may already be compromised
How to protect yourself
- Enable WhatsApp two-step verification (Settings > Account > Two-step verification) to add a PIN
- Never forward a six-digit SMS code to anyone — no legitimate entity will ever ask for this
- If locked out of WhatsApp, use the official account recovery process through WhatsApp support
- Alert your contacts immediately if your account is hijacked to prevent further spread
- Set a carrier account PIN and enable a port freeze to prevent number transfer
- Treat any unexpected SMS verification code as a sign someone is attempting account access
How to report it
- Email WhatsApp at [email protected] if your account is compromised
- Report the attacker's number to WhatsApp via 'Report Contact' if still accessible
- Contact your carrier fraud line to prevent a port if you believe a SIM swap is in progress
Frequently asked questions
How does WhatsApp two-step verification prevent this scam?
Two-step verification adds a six-digit PIN that is required when registering your number on a new device. Even if the attacker has your phone number, they cannot complete WhatsApp registration without this PIN — which only you know.