Is a WhatsApp message from a contact asking me to forward them a verification code I just received a scam?
Yes. This is account takeover fraud — your contact's account has already been hijacked and scammers are now targeting yours.
Last reviewed: 1 August 2026
Explanation
WhatsApp account takeover fraud works in a chain. A scammer compromises one person's account, then messages their contacts claiming to have accidentally sent a six-digit verification code to the contact's number and asking them to forward it. The code is actually WhatsApp's two-factor authentication code for your own account. Sharing it instantly transfers control of your WhatsApp to the scammer, who then repeats the attack on your contacts. The message is convincing because it appears to come from a trusted contact. Your real friend did not send this — their account is being used by a scammer. Never forward any verification code to anyone, even a close contact. If you receive such a request, call your contact on a voice call to alert them to the compromise.
The reason this chain spreads so effectively is that each hijacked account lends the next request borrowed trust: the message arrives in an existing conversation history, from a name and photo you know. Understanding the mechanic dissolves it — a verification code sent to your phone belongs to your account and nothing else, so there is no innocent scenario in which someone else legitimately needs it. Enabling two-step verification adds a PIN that the code alone cannot bypass, which stops the takeover even if a code is ever shared in a moment of distraction. Setting it up takes a minute in the app's security settings and is the single most effective protection available.
Common red flags
- Contact asks you to forward a code you just received
- Explanation is that they accidentally sent it to your number
- Message has unusual urgency or phrasing different from the contact's normal style
- Contact cannot explain the situation clearly if you call them
What to do now
- Do not forward the code under any circumstances
- Call your contact directly to tell them their account has been compromised
- Set up two-step verification on your own WhatsApp in settings
- Report the hijacked account to WhatsApp support
Frequently asked questions
What should I do if I already forwarded the code?
Deregister your WhatsApp immediately by requesting a new verification code to re-register your own number. Enable two-step verification as soon as you regain access.
Is there ever a genuine reason someone else needs a code sent to my phone?
No. Verification codes are tied to the account being registered on your number. Any request to share one — from a friend, a company, or a support agent — is an attempt to take over an account.