If a friend on WhatsApp asks me to forward them a code I just received, is it a scam?
Yes. This is account takeover fraud — the code belongs to your friend's WhatsApp, and sending it hands their account to a scammer.
Last reviewed: 1 August 2026
Explanation
WhatsApp account takeover via OTP (one-time password) forwarding is one of the most widespread account scams. The attacker first compromises or poses as one of your contacts, then texts you saying something like 'I accidentally sent a code to your number — can you forward it to me?' The six-digit code that arrives is actually the SMS verification code for your own WhatsApp account or for a WhatsApp account the attacker is registering on a new device. Forwarding the code gives the attacker control of your WhatsApp account, allowing them to impersonate you to all your contacts and repeat the scam. Never forward a verification code you receive to anyone — the person asking is always part of the fraud.
The scam works because the request arrives from a familiar name and sounds trivially small — forwarding six digits feels like passing on a misdelivered letter. In reality that code is the single key WhatsApp uses to decide which phone owns your account. It is worth understanding the chain reaction too: once your account is taken, every one of your contacts receives the same request apparently from you, which is how a single lapse spreads through families and friend groups within hours. Enabling two-step verification adds a PIN the attacker cannot obtain from any SMS, and it is the one setting that breaks this cycle.
Common red flags
- Contact asks you to forward a code you just received by SMS
- Message claims the code was sent to your number by mistake
- Request is urgent or emotional — 'I really need this right now'
- The conversation tone feels slightly off compared to normal
What to do now
- Do not forward any code — hang up or ignore the message
- If you already forwarded the code, go to WhatsApp settings and re-register immediately
- Warn your contacts that your account may have been compromised
- Enable two-step verification in WhatsApp settings to add a PIN layer
Frequently asked questions
My WhatsApp account was taken over — how do I get it back?
Re-register on your phone by verifying your number via SMS. This forces the fraudster off your account. Change any linked email account password immediately and notify your contacts.
Why would my friend's account send me that message?
Because their account has already been taken over, or is being spoofed. The attacker works through the victim's contact list impersonating them. Treat any code-forwarding request as a takeover attempt regardless of who it appears to come from, and alert your friend through another channel.