WhatsApp Hacked in Malaysia? How to Get It Back

A friend messaged asking you to forward a code that landed on your phone "by mistake". You sent it. Minutes later WhatsApp logged you out, and now your contacts are getting messages from your number asking to borrow money.

In most cases you can take the account back yourself. Log back in with your own phone number and the 6-digit code WhatsApp sends to your SIM. That single step removes the other person. Then warn your contacts and turn on the security settings the hijacker was counting on you not having.

This guide covers the recovery steps, what to do when WhatsApp asks for a PIN you never set, what happens if you cannot receive the code, and where to report in Malaysia.

Last checked: 29 September 2026.

#How Do You Get a Hacked WhatsApp Account Back?

Open WhatsApp on the phone with your SIM, tap "Log back in", then "Continue", enter your number and type the 6-digit code you receive by SMS or phone call. WhatsApp's page on recovering a compromised account says that re-registering with that code logs out every device using your account, and that this is the only way to remove someone who has taken it over. If you are asked for a two-step verification PIN you do not know, WhatsApp says to wait 7 days and try again. You need a working SIM with the same number. If money was lost, call the National Scam Response Centre on 997. WhatsApp makes the final decision, and nobody outside WhatsApp, including AwareXone, can restore an account for you.

#How a WhatsApp Takeover Actually Happens

WhatsApp does not use a password to prove you own an account. It uses your phone number and a 6-digit registration code. Whoever types that code into a phone becomes the owner of the account on that phone, so the attacker's whole job is to get the code from you.

The Malaysian Communications and Multimedia Commission described the tricks in a media statement on WhatsApp account takeovers. It dates from January 2021, but the same patterns still circulate:

• The scammer uses a friend's or relative's WhatsApp that was already hijacked and asks you to pass on the 6-digit code you just received.
• The scammer pretends to be WhatsApp staff and asks for the code.
• The scammer makes several failed verification attempts so that WhatsApp calls your number with the code. They then contact you pretending to be someone else to get it, or, if the call went to voicemail, try to guess or ask for your voicemail PIN to hear the recording.

The first trick spreads account by account: once your WhatsApp is taken, your contacts get the same request from you. An illustrative version in Bahasa Melayu reads: "Sorry, tersalah hantar kod ke nombor awak. Boleh forward kod 6 digit tu?" Whatever the language, a request for your code is the attack.

#What You See, What It Means, What to Do

Match what is on your screen to the row below. Exact wording can vary by phone, app version and language.

WhatsApp's page on a code you did not request explains the first row: it sends you a notification when someone tries to register your number, and a person who does not have the SMS code cannot use your number on WhatsApp. If you see the second row, WhatsApp's page on the new device message gives the same log back in steps.

#Step 1: Log Back In With Your Own Number

1. Open WhatsApp. If it shows a logged out screen, tap "Log back in", then "Continue".
2. If prompted, enter your full international phone number (for a Malaysian number, the country code is +60) and tap "Next", then "Ok".
3. Enter the 6-digit code you receive by SMS or phone call. Type it yourself. Do not send it to anyone.
4. If WhatsApp asks for a two-step verification PIN and you know it, enter it. If you do not, see the next section.

WhatsApp says that once you re-register, every device logged into your account is logged out. If the SMS does not arrive, its page on the "You have been logged out" screen says to wait for the timer, which can take up to 10 minutes, then use "Call me" for an automated voice call. It also warns not to guess the code, or you will be locked out for a period of time.

#Step 2: If WhatsApp Asks for a PIN You Never Set

This is the most common reason people think the account is lost for good. It usually is not. WhatsApp's recovery page says a hijacker may turn on two-step verification to stop the real owner from logging in, and that the owner needs to wait 7 days and then try again.

The same page adds that, whether you know the PIN or not, anyone using your account is logged out once you enter the 6-digit SMS code. So verify your number now, even if the PIN screen stops you. The hijacker loses the account at that point, and you come back after the wait. Keep the SIM active and in your phone during those days.

WhatsApp is gradually replacing the 6-digit two-step PIN with a password, so your screen may say password instead of PIN. The advice is the same.

#Step 3: If You Cannot Receive the Code

Recovery depends on the SIM. WhatsApp states plainly that it is not possible to recover an account without a SIM card with the same phone number as your account.

• Phone lost or stolen: WhatsApp's page on lost or stolen devices says to call your mobile provider, ask them to block the SIM, request a new SIM with the same number, insert it and re-register. The old phone is then logged out.
• Sudden "No service": call your carrier from another phone and ask whether a replacement SIM was issued on your number. Whoever holds a working SIM with your number can receive WhatsApp's codes.
• Number no longer yours: WhatsApp says that if the carrier cannot give you back the original number, that account cannot be recovered.
• Moved to a new number earlier: WhatsApp says to use the change number feature while you still have access, or you could permanently lose the account.

WhatsApp also says it cannot deactivate your account for you, because it has no way to verify that you own the number. Getting your SIM back is the route. If WhatsApp has simply logged you out without a takeover, our guide to the "no longer registered on this phone" message walks through the other causes.

#Step 4: Warn Your Contacts Straight Away

WhatsApp's recovery page tells you to notify family and friends, because the person using your account could impersonate you in chats and groups. PDRM's scam alerts warn of scammers posing as friends, family or colleagues to borrow money in a hurry.

• Post on Facebook or Instagram Stories, or send an SMS or email, saying your WhatsApp was taken and nobody should send money or codes.
• Ask a family member to post the same warning in the WhatsApp groups you share, especially family, school parents and work groups.
• Tell them to call you on a normal voice call before acting on any message from your number.
• If a contact already forwarded a code, send them this guide. Their account is probably next.

#Step 5: Lock the Account After You Are Back In

WhatsApp's account security tips list the layers available once you hold the account again:

• Two-step verification: WhatsApp's page on registration and two-step verification says you can choose your phone number, a password or an email address as the extra check. It may make you wait a little after re-registering before you can turn it on.
• Email: adding a verified email gives you another way to recover the account without SMS or a call.
• Passkey: links the account to your phone's fingerprint, face or screen lock.
• Linked devices: open "Linked devices" from the menu, tap any computer or tablet you do not recognise and log it out. WhatsApp's page on linked devices says linking through unofficial apps or websites can get the account banned.
• Voicemail: MCMC advises never giving out your voicemail password or PIN and making it hard to guess, because WhatsApp's voice call codes can land there.

Then do the same on your other accounts with our walkthrough of two-factor authentication on Instagram, Facebook and TikTok.

#Mistakes That Make Recovery Harder

• Reporting your own account before recovering it. WhatsApp warns it might ban the reported account, and you could lose access and data. Recover first.
• Guessing codes or requesting them over and over. That triggers timed lockouts.
• Letting the SIM lapse or swapping numbers during the 7 day wait.
• Giving the new code to anyone who says they can help, including someone claiming to be WhatsApp. MCMC lists people posing as WhatsApp staff and even authorities among the parties to refuse.
• Paying someone who offers to unban or recover the account. WhatsApp's page on suspicious messages and scams says the app is free and that anyone offering to unban an account for payment is likely after your money or information.

If you received a genuine ban notice rather than a takeover, that is a separate process. Our guide to a banned WhatsApp account in Malaysia covers the review request.

#If Money Was Lost or a Code Was Shared

A takeover often ends with someone transferring money to the scammer. If that was you, or your contact, act on the money first.

1. Call your bank or the National Scam Response Centre on 997 immediately. Bank Negara Malaysia's National Fraud Portal statement tells scam victims to contact their financial institution or the NSRC at 997 straight away.
2. Make a police report at the nearest station. MCMC's statement says victims of a WhatsApp takeover can report it to the police or to MCMC through the complaint channels listed in that statement.
3. Report the incident to CyberSecurity Malaysia's Cyber999 service, the national point of contact for computer security incidents.
4. Keep evidence: screenshots of the scam messages, the phone number that asked for your code, bank transfer receipts and the times everything happened.

#When Expert Recovery Help Makes Sense

Most people get their WhatsApp back with the steps above and never need anyone else. A second opinion helps when the takeover spread to your Instagram, Facebook or business accounts, when a business number used for customer orders is involved, or when the SIM situation with your carrier is unclear. SocialSafe by AwareXone, our recovery service, reviews what happened and tells you honestly which official routes are still open. AwareXone is a Malaysian company with no link to WhatsApp or Meta, and we work only through the official steps described here. Our recovery hub explains the case review, and our Trust Center sets out what we will never ask for. That includes your WhatsApp code: keep it to yourself, even from us.

#Frequently Asked Questions