WhatsApp Business Hacked and Customers Being Scammed

A regular customer calls asking why you sent a new bank account for their deposit. You did not. Someone else holds your business WhatsApp and is working through your chat list asking people to pay.

In many cases you can stop this yourself. Re-register the number on your own phone with the SMS code, which throws the other device out. Then warn customers from channels you control, and point anyone who already paid to their bank and the National Scam Response Centre.

This guide is for business owners. It covers taking the number back, what to tell customers, the evidence to keep, and how to stop one shared phone being a single point of failure.

Last checked: 5 October 2026.

#What Should You Do When Your WhatsApp Business Is Scamming Customers?

Take the number back first, then protect your customers. Log back in on the phone with your business SIM using the 6-digit code. WhatsApp's page on recovering a compromised account says this logs out every device using the account and is the only way to remove someone who has taken it over. Remove linked devices you do not recognise, then warn customers on your website, social pages and shop front that payment requests during the takeover were fake. Customers who paid should call their bank or 997 straight away. WhatsApp decides what happens to the account.

#How a Business Number Ends Up Collecting Fake Payments

WhatsApp proves ownership with your phone number and a 6-digit registration code, not a password. Whoever enters that code holds the account. For a business, the attacker inherits a chat list of customers who already trust the number and are used to paying it.

Common ways in: a staff member forwards a code a "customer" says was sent by mistake, a former employee still has a linked laptop, or the SIM moved to another card. Once inside, the scammer tends to:

• Message customers with pending orders, saying the bank account has changed and asking for the deposit or balance to go to a new account.
• Run a fake promotion or clearance sale to the whole contact list, with payment up front.
• Ask customers and suppliers for their own WhatsApp codes, which spreads the takeover to their accounts.

Scripts arrive in whatever language the business normally uses. An illustrative Bahasa Melayu version: "Akaun bank kedai dah tukar, sila bank in ke akaun baru ni untuk deposit." An illustrative Chinese version: "我们换了新的收款账户，请把订金转到这个账号。" Any change of bank details by chat is the scam, in any language.

#What You See, What It Means, What to Do

Match your situation to a row. Screen wording varies by app version, phone and language.

#Step 1: Take the Number Back With the SMS Code

1. Use the phone that holds the business SIM. Open WhatsApp Business and tap "Log back in", then "Continue".
2. If asked, enter the full international number (+60 then the rest for a Malaysian line) and tap "Next", then "Ok".
3. Type the 6-digit code you receive by SMS or phone call. The owner or one responsible manager should enter it.
4. If WhatsApp asks for a two-step verification PIN that you know, enter it. If nobody knows it, read the callout below.

WhatsApp also says recovery is not possible without a SIM card with the same phone number. If the line is registered to a former staff member, sort that out with your carrier now.

#Step 2: Log Out Linked Devices and Review Team Access

A takeover does not always mean the number moved. A linked computer can send messages while your phone still works. WhatsApp's page on checking linked devices says to review them regularly and log out any WhatsApp Web session you believe someone else has access to.

• On the business phone, open "Linked devices" and log out every session you cannot match to a computer you own. If in doubt, log out all of them.
• On shared counter computers, untick "Stay logged in on this browser" before scanning the QR code, so the session ends when the browser closes.
• If you use Meta Business Suite for the inbox, remove anyone there who no longer needs access.

#Step 3: Warn Customers From Channels You Control

WhatsApp's recovery page tells owners to notify family and friends, because the person holding the account could impersonate them in chats and groups. For a business, the same applies to customers, which means a public notice plus direct contact with customers who have open orders.

• Pin a post on your Facebook Page and Instagram, add a website banner and update your Google Business Profile.
• Put a printed notice at the counter or shop door.
• Call or email customers with deposits or balances due, largest and most recent first.
• Once the number is back, send a broadcast confirming which bank details are correct.

A notice you can adapt (keep your own wording if you prefer):

Our WhatsApp number was taken over on [date] between [time] and [time]. Messages during that period asking you to pay, or giving a new bank account, did not come from us. Our bank details have not changed. Please do not transfer money based on those messages. If you already paid, contact your bank or call 997 straight away and make a police report. We will never ask you for a WhatsApp code.

Short versions for other languages: BM "WhatsApp kami telah digodam pada [tarikh]. Sebarang permintaan bayaran atau akaun bank baru dalam tempoh itu bukan daripada kami. Jangan buat bayaran." Chinese "我们的WhatsApp于[日期]被盗用。期间任何付款要求或新的银行账户都不是我们发出的，请勿转账。"

Do not ask customers to report your real number while you recover it. WhatsApp warns that reporting a compromised account before recovery might get it banned. Ask them to ignore those messages, and to report any different number copying your name.

#What to Tell Customers Who Already Paid

Only the customer's bank and the authorities can act on their money, but you can help them act fast. The National Scam Response Centre's own page tells victims to contact their bank's hotline or the NSRC on 997 immediately, then make a police report at the nearest station. It also says quick action can reduce losses but there is no guarantee of getting the money back.

1. Ask the customer to call their own bank's fraud hotline or 997 now, before anything else.
2. Ask them to make a police report afterwards. The report should come from the person who sent the money.
3. Send them your notice and the time window of the takeover, confirming the receiving account is not yours.
4. Keep a list of affected customers, what they were asked for and when.

Whether a business should cover a customer's loss is a legal question that depends on the facts. This article is general information, not legal advice, so speak to a lawyer before you promise or refuse anything in writing. Our guide on contacts scammed from a hacked account has more on supporting the people targeted.

#Evidence Checklist for the Police and Your Bank

NSRC asks victims for a chronology, the suspect's number, transaction receipts, links and the conversations. Collect your side of that before chats disappear.

• Screenshots of scam messages customers forward to you, with the date and time visible.
• The bank account numbers and names the scammer gave out.
• When you noticed, when you logged back in and when you posted your warning, with links to the posts.
• Any code request a staff member received before the takeover.
• A photo of the linked devices screen before you logged them out.
• Your carrier's confirmation if the SIM was replaced.

Make your own police report about the takeover as the account owner, separate from customers' reports. You can also report the incident to CyberSecurity Malaysia's Cyber999, which describes itself as the national point of contact for reporting computer security incidents.

#Copycat Numbers and Recovery Agents After Your Warning

A public warning post can attract two follow-ups. The first is a copycat number using your logo, claiming to be your "new official number". WhatsApp's page on someone pretending to be you says to report the user and the suspicious messages, and that WhatsApp might ban accounts it believes break its terms. The WhatsApp Business security guidance gives the same advice: report impersonators directly in the app. Our guide to a fake WhatsApp number using your identity covers that route in detail.

The second is the "recovery agent". After a public post, strangers may comment or message offering to get your account back, trace the scammer or recover customers' money. Treat it as a second scam.

• They ask for the SMS code, your PIN or a screenshot of a code. WhatsApp says never to share your registration code, not even with friends or family.
• They want payment up front, often by crypto or to a personal account.
• They claim to work with WhatsApp, Meta, the police or a bank, or promise a fixed outcome. WhatsApp's page on suspicious messages and scams says anyone offering to unban an account for payment is likely after your money or information.
• They offer to "track" the scammer or hack the receiving account.

NSRC adds that the NSRC, PDRM, MCMC, BNM and banks will only contact you if you already reported to them, and will never ask for a password, PIN, TAC or OTP. Our article on fake hackers offering account recovery lists more of their patterns.

#Lock the Business Number Down Afterwards

WhatsApp Business's security guidance is short. Turn on two-step verification in "Settings", "Account", "Two-step verification", which asks for a PIN whenever the number is registered on a new device. Review linked devices regularly, change the PIN as soon as someone leaves the team, and keep the app updated.

• Give the team access through Meta Business Suite instead of passing the phone around. The same guidance says this lets you assign roles without sharing login credentials or the number.
• Add an email address. WhatsApp's account security tips say it lets you recover the account without SMS or a call.
• Keep the business SIM registered to the company or owner, in a phone held by one named person.
• Put one fixed rule on invoices and your profile: bank details are never changed by chat.
• Tell staff that no customer, supplier or WhatsApp employee ever needs a code from the business phone.

If you run Instagram, Facebook or TikTok for the same business, our business account protection checklist applies the same thinking across them.

#Mistakes That Make the Damage Worse

• Reporting your own number to WhatsApp before you recover it. That risks a ban on the account you are trying to keep.
• Waiting to post a warning until you have the account back. Customers keep paying while you wait.
• Switching to a new number to escape the problem. The old account, and the trust in it, stay with whoever holds it.
• Installing unofficial WhatsApp apps or "recovery tools".
• Messaging the scammer to argue or threaten. It wastes the time you need for customers.

#When a Case Review Makes Sense

The steps above are often enough to take the number back. Outside help is worth considering when the business SIM is registered to someone you cannot reach, when the same people also took your Facebook Page or Instagram, or when copycat numbers keep appearing. SocialSafe by AwareXone reviews the case first and tells you which official routes are still open, including when you can do it yourself. It is best effort, uses only the platforms' own recovery and report processes, never asks for the SMS code, PIN or passwords, and WhatsApp makes the final decision. Some accounts do not come back. Our business and creator recovery page explains the review, and the Trust Center sets out what we will not ask for.

#Frequently Asked Questions