# WhatsApp Business Hacked and Customers Being Scammed > WhatsApp Business hacked and a scammer is asking your customers in Malaysia to pay? Take the number back, warn customers and point those who paid to 997. - URL: https://www.awarexone.com/research/whatsapp-business-hacked-customers-scammed - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-05 - Topics: WhatsApp, Account recovery, Malaysia - Related service: Business and creator recovery: https://www.awarexone.com/services/business-creator-recovery ## Short answer Open WhatsApp Business on the phone with your business SIM, log back in and enter the 6-digit code sent to that number. That logs the hijacker out. Remove unknown linked devices, then warn customers on your website and social pages that recent payment requests were fake. Customers who paid should call their bank or 997 immediately. ## Summary - If a scammer is messaging your customers from your WhatsApp Business number, someone has registered that number on their own device or linked one to it. - Re-register the number on your own phone with the 6-digit SMS code, which logs every other device out, then remove any linked device you do not recognise. - Warn customers from channels you still control, saying that payment requests and new bank details sent during the takeover did not come from you. - Tell any customer who already paid to call their own bank or NSRC on 997 straight away and to make a police report themselves. - Never give the SMS code or your two-step verification PIN to anyone, including people who message your business offering to recover the account. - WhatsApp makes the final decision on the account, recovery needs a SIM with the same number, and money already sent may not come back. A regular customer calls asking why you sent a new bank account for their deposit. You did not. Someone else holds your business WhatsApp and is working through your chat list asking people to pay. In many cases you can stop this yourself. Re-register the number on your own phone with the SMS code, which throws the other device out. Then warn customers from channels you control, and point anyone who already paid to their bank and the National Scam Response Centre. This guide is for business owners. It covers taking the number back, what to tell customers, the evidence to keep, and how to stop one shared phone being a single point of failure. Last checked: 5 October 2026. ## What Should You Do When Your WhatsApp Business Is Scamming Customers? Take the number back first, then protect your customers. Log back in on the phone with your business SIM using the 6-digit code. WhatsApp's page on [recovering a compromised account](https://faq.whatsapp.com/1131652977717250) says this logs out every device using the account and is the only way to remove someone who has taken it over. Remove linked devices you do not recognise, then warn customers on your website, social pages and shop front that payment requests during the takeover were fake. Customers who paid should call their bank or 997 straight away. WhatsApp decides what happens to the account. ## How a Business Number Ends Up Collecting Fake Payments WhatsApp proves ownership with your phone number and a 6-digit registration code, not a password. Whoever enters that code holds the account. For a business, the attacker inherits a chat list of customers who already trust the number and are used to paying it. Common ways in: a staff member forwards a code a "customer" says was sent by mistake, a former employee still has a linked laptop, or the SIM moved to another card. Once inside, the scammer tends to: - Message customers with pending orders, saying the bank account has changed and asking for the deposit or balance to go to a new account. - Run a fake promotion or clearance sale to the whole contact list, with payment up front. - Ask customers and suppliers for their own WhatsApp codes, which spreads the takeover to their accounts. Scripts arrive in whatever language the business normally uses. An illustrative Bahasa Melayu version: "Akaun bank kedai dah tukar, sila bank in ke akaun baru ni untuk deposit." An illustrative Chinese version: "我们换了新的收款账户，请把订金转到这个账号。" Any change of bank details by chat is the scam, in any language. ## What You See, What It Means, What to Do Match your situation to a row. Screen wording varies by app version, phone and language. *Common signs when a business WhatsApp number is misused, and the first action for each, at the time of writing.* | What you see | What it likely means | What to do now | | --- | --- | --- | | Your phone shows a logged out screen and customers report odd messages | The number was registered on another device | Log back in with the SMS code on your business SIM | | You still have the account, but messages you did not send appear in chats | A linked device (WhatsApp Web or desktop) is in someone else's hands | Open "Linked devices" and log out anything you do not recognise | | WhatsApp asks for a two-step verification PIN nobody on your team set | Someone using your account may have turned on two-step verification | Enter the SMS code anyway, which logs them out, then wait 7 days and try again | | Customers forward messages from a different number using your logo and name | A copycat account is impersonating the business, separate from a takeover | Report that number in the app and warn customers which number is real | ## Step 1: Take the Number Back With the SMS Code 1. Use the phone that holds the business SIM. Open WhatsApp Business and tap "Log back in", then "Continue". 2. If asked, enter the full international number (+60 then the rest for a Malaysian line) and tap "Next", then "Ok". 3. Type the 6-digit code you receive by SMS or phone call. The owner or one responsible manager should enter it. 4. If WhatsApp asks for a two-step verification PIN that you know, enter it. If nobody knows it, read the callout below. > Warning: **A PIN you never set, and things that do not help.** WhatsApp says a hijacker may have turned on two-step verification. Without the PIN, wait 7 days and try again. Anyone using your account is logged out once you enter the SMS code, PIN or not, so keep the business SIM active during the wait. Changing a password does not remove someone else. WhatsApp also says recovery is not possible without a SIM card with the same phone number. If the line is registered to a former staff member, sort that out with your carrier now. ## Step 2: Log Out Linked Devices and Review Team Access A takeover does not always mean the number moved. A linked computer can send messages while your phone still works. WhatsApp's page on [checking linked devices](https://faq.whatsapp.com/1428782138011916) says to review them regularly and log out any WhatsApp Web session you believe someone else has access to. - On the business phone, open "Linked devices" and log out every session you cannot match to a computer you own. If in doubt, log out all of them. - On shared counter computers, untick "Stay logged in on this browser" before scanning the QR code, so the session ends when the browser closes. - If you use Meta Business Suite for the inbox, remove anyone there who no longer needs access. ## Step 3: Warn Customers From Channels You Control WhatsApp's recovery page tells owners to notify family and friends, because the person holding the account could impersonate them in chats and groups. For a business, the same applies to customers, which means a public notice plus direct contact with customers who have open orders. - Pin a post on your Facebook Page and Instagram, add a website banner and update your Google Business Profile. - Put a printed notice at the counter or shop door. - Call or email customers with deposits or balances due, largest and most recent first. - Once the number is back, send a broadcast confirming which bank details are correct. A notice you can adapt (keep your own wording if you prefer): > Our WhatsApp number was taken over on [date] between [time] and [time]. Messages during that period asking you to pay, or giving a new bank account, did not come from us. Our bank details have not changed. Please do not transfer money based on those messages. If you already paid, contact your bank or call 997 straight away and make a police report. We will never ask you for a WhatsApp code. Short versions for other languages: BM "WhatsApp kami telah digodam pada [tarikh]. Sebarang permintaan bayaran atau akaun bank baru dalam tempoh itu bukan daripada kami. Jangan buat bayaran." Chinese "我们的WhatsApp于[日期]被盗用。期间任何付款要求或新的银行账户都不是我们发出的，请勿转账。" Do not ask customers to report your real number while you recover it. WhatsApp warns that reporting a compromised account before recovery might get it banned. Ask them to ignore those messages, and to report any different number copying your name. ## What to Tell Customers Who Already Paid Only the customer's bank and the authorities can act on their money, but you can help them act fast. The National Scam Response Centre's [own page](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) tells victims to contact their bank's hotline or the NSRC on 997 immediately, then make a police report at the nearest station. It also says quick action can reduce losses but there is no guarantee of getting the money back. 1. Ask the customer to call their own bank's fraud hotline or 997 now, before anything else. 2. Ask them to make a police report afterwards. The report should come from the person who sent the money. 3. Send them your notice and the time window of the takeover, confirming the receiving account is not yours. 4. Keep a list of affected customers, what they were asked for and when. Whether a business should cover a customer's loss is a legal question that depends on the facts. This article is general information, not legal advice, so speak to a lawyer before you promise or refuse anything in writing. Our guide on [contacts scammed from a hacked account](https://www.awarexone.com/research/friends-scammed-from-my-hacked-account-malaysia) has more on supporting the people targeted. ## Evidence Checklist for the Police and Your Bank NSRC asks victims for a chronology, the suspect's number, transaction receipts, links and the conversations. Collect your side of that before chats disappear. - Screenshots of scam messages customers forward to you, with the date and time visible. - The bank account numbers and names the scammer gave out. - When you noticed, when you logged back in and when you posted your warning, with links to the posts. - Any code request a staff member received before the takeover. - A photo of the linked devices screen before you logged them out. - Your carrier's confirmation if the SIM was replaced. Make your own police report about the takeover as the account owner, separate from customers' reports. You can also report the incident to CyberSecurity Malaysia's [Cyber999](https://www.cybersecurity.my/portal-main/services/cyber999-overview), which describes itself as the national point of contact for reporting computer security incidents. ## Copycat Numbers and Recovery Agents After Your Warning A public warning post can attract two follow-ups. The first is a copycat number using your logo, claiming to be your "new official number". WhatsApp's page on [someone pretending to be you](https://faq.whatsapp.com/1739028180144800) says to report the user and the suspicious messages, and that WhatsApp might ban accounts it believes break its terms. The [WhatsApp Business security guidance](https://whatsappbusiness.com/resources/resource-library/protecting-your-business-on-whatsapp-security-best-practices/) gives the same advice: report impersonators directly in the app. Our guide to [a fake WhatsApp number using your identity](https://www.awarexone.com/research/remove-fake-whatsapp-number-pretending-to-be-me) covers that route in detail. The second is the "recovery agent". After a public post, strangers may comment or message offering to get your account back, trace the scammer or recover customers' money. Treat it as a second scam. - They ask for the SMS code, your PIN or a screenshot of a code. WhatsApp says never to share your registration code, not even with friends or family. - They want payment up front, often by crypto or to a personal account. - They claim to work with WhatsApp, Meta, the police or a bank, or promise a fixed outcome. WhatsApp's page on [suspicious messages and scams](https://faq.whatsapp.com/2286952358121083) says anyone offering to unban an account for payment is likely after your money or information. - They offer to "track" the scammer or hack the receiving account. NSRC adds that the NSRC, PDRM, MCMC, BNM and banks will only contact you if you already reported to them, and will never ask for a password, PIN, TAC or OTP. Our article on [fake hackers offering account recovery](https://www.awarexone.com/research/fake-hackers-offering-account-recovery-scam) lists more of their patterns. ## Lock the Business Number Down Afterwards WhatsApp Business's security guidance is short. Turn on two-step verification in "Settings", "Account", "Two-step verification", which asks for a PIN whenever the number is registered on a new device. Review linked devices regularly, change the PIN as soon as someone leaves the team, and keep the app updated. - Give the team access through Meta Business Suite instead of passing the phone around. The same guidance says this lets you assign roles without sharing login credentials or the number. - Add an email address. WhatsApp's [account security tips](https://faq.whatsapp.com/1095301557782068) say it lets you recover the account without SMS or a call. - Keep the business SIM registered to the company or owner, in a phone held by one named person. - Put one fixed rule on invoices and your profile: bank details are never changed by chat. - Tell staff that no customer, supplier or WhatsApp employee ever needs a code from the business phone. If you run Instagram, Facebook or TikTok for the same business, our [business account protection checklist](https://www.awarexone.com/research/protect-business-social-accounts-checklist) applies the same thinking across them. ## Mistakes That Make the Damage Worse - Reporting your own number to WhatsApp before you recover it. That risks a ban on the account you are trying to keep. - Waiting to post a warning until you have the account back. Customers keep paying while you wait. - Switching to a new number to escape the problem. The old account, and the trust in it, stay with whoever holds it. - Installing unofficial WhatsApp apps or "recovery tools". - Messaging the scammer to argue or threaten. It wastes the time you need for customers. > Note: **WhatsApp decides, and money is a separate track.** Only WhatsApp controls registration on its service. Customers' money is handled by their banks, NSRC and the police, and some of it may not be returned. Nobody can promise either outcome. ## When a Case Review Makes Sense The steps above are often enough to take the number back. Outside help is worth considering when the business SIM is registered to someone you cannot reach, when the same people also took your Facebook Page or Instagram, or when copycat numbers keep appearing. SocialSafe by AwareXone reviews the case first and tells you which official routes are still open, including when you can do it yourself. It is best effort, uses only the platforms' own recovery and report processes, never asks for the SMS code, PIN or passwords, and WhatsApp makes the final decision. Some accounts do not come back. Our [business and creator recovery](https://www.awarexone.com/services/business-creator-recovery) page explains the review, and the [Trust Center](https://www.awarexone.com/trust) sets out what we will not ask for. ## Frequently Asked Questions ### Can the hacker see my old customer chats on WhatsApp Business? WhatsApp says someone who re-registers your account on a new device cannot read past conversations, because messages are end-to-end encrypted and stored on your device. A linked device that was already connected is different, so log out any you do not recognise. ### Is my business responsible if customers paid the scammer? That depends on the facts and on what was agreed with the customer, and it is a legal question. Point customers to their bank and 997 first, keep records, and get legal advice before committing to anything. ### Can WhatsApp tell me who hacked my business account? No. WhatsApp says it cannot provide information about who accessed your account or the time and location. Give the police the bank accounts and numbers the scammer used instead. ### Should I get a new WhatsApp Business number after a hack? Recover the original first. Customers recognise that number, and leaving it with the scammer lets the misuse continue. ### Can AwareXone take my WhatsApp Business number back for me? No one outside WhatsApp can register your number, and recovery needs your own SIM. We can review the case and help you use the official steps, and we never ask for your code or PIN. ## Official sources - [WhatsApp Help Center: How to recover a compromised account (read 5 October 2026)](https://faq.whatsapp.com/1131652977717250) - [WhatsApp Business: Protecting your business on WhatsApp, security best practices (read 5 October 2026)](https://whatsappbusiness.com/resources/resource-library/protecting-your-business-on-whatsapp-security-best-practices/) - [WhatsApp Help Center: What to do if someone is pretending to be you on WhatsApp (read 5 October 2026)](https://faq.whatsapp.com/1739028180144800) - [WhatsApp Help Center: How to check devices linked to your account (read 5 October 2026)](https://faq.whatsapp.com/1428782138011916) - [WhatsApp Help Center: About suspicious messages and scams (read 5 October 2026)](https://faq.whatsapp.com/2286952358121083) - [WhatsApp Help Center: Account security tips (read 5 October 2026)](https://faq.whatsapp.com/1095301557782068) - [NFCC: National Scam Response Centre (NSRC) FAQs (read 5 October 2026)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) - [CyberSecurity Malaysia: Cyber999 Cyber Incident Response Center (read 5 October 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.