# WhatsApp Hacked in Malaysia? How to Get It Back > WhatsApp hacked in Malaysia? Log back in with the 6-digit code sent to your SIM, wait 7 days if a PIN blocks you, warn contacts and never share the code. - URL: https://www.awarexone.com/research/whatsapp-hacked-verification-code-malaysia - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-09-29 - Topics: WhatsApp, Account recovery, Malaysia - Related service: WhatsApp account recovery: https://www.awarexone.com/social-media-recovery/whatsapp-account-recovery ## Short answer Open WhatsApp on the phone with your SIM, tap Log back in and enter the 6-digit code sent to your number. That logs every other device out. If it asks for a PIN you never set, wait 7 days and try again. Warn your contacts through another channel, and never share a WhatsApp code with anyone. ## Summary - When WhatsApp is hacked, it usually means someone registered your phone number on their own device, most often after tricking you into sharing the 6-digit code. - Open WhatsApp on your phone, tap Log back in and enter the code sent to your own SIM, which logs every other device out. - If WhatsApp asks for a two-step verification PIN you never set, the hijacker probably set it, and WhatsApp says to wait 7 days and try again. - Warn family and friends from another channel straight away, because the person holding your account may ask them for money or for their own codes. - Never share a WhatsApp code with anyone, do not pay anyone offering to unban or recover the account, and call NSRC on 997 if money was lost. - WhatsApp makes the final decision, it cannot recover an account without a SIM that has your number, and some accounts do not come back. A friend messaged asking you to forward a code that landed on your phone "by mistake". You sent it. Minutes later WhatsApp logged you out, and now your contacts are getting messages from your number asking to borrow money. In most cases you can take the account back yourself. Log back in with your own phone number and the 6-digit code WhatsApp sends to your SIM. That single step removes the other person. Then warn your contacts and turn on the security settings the hijacker was counting on you not having. This guide covers the recovery steps, what to do when WhatsApp asks for a PIN you never set, what happens if you cannot receive the code, and where to report in Malaysia. Last checked: 29 September 2026. ## How Do You Get a Hacked WhatsApp Account Back? Open WhatsApp on the phone with your SIM, tap "Log back in", then "Continue", enter your number and type the 6-digit code you receive by SMS or phone call. WhatsApp's page on [recovering a compromised account](https://faq.whatsapp.com/1131652977717250) says that re-registering with that code logs out every device using your account, and that this is the only way to remove someone who has taken it over. If you are asked for a two-step verification PIN you do not know, WhatsApp says to wait 7 days and try again. You need a working SIM with the same number. If money was lost, call the National Scam Response Centre on 997. WhatsApp makes the final decision, and nobody outside WhatsApp, including AwareXone, can restore an account for you. ## How a WhatsApp Takeover Actually Happens WhatsApp does not use a password to prove you own an account. It uses your phone number and a 6-digit registration code. Whoever types that code into a phone becomes the owner of the account on that phone, so the attacker's whole job is to get the code from you. The Malaysian Communications and Multimedia Commission described the tricks in a [media statement on WhatsApp account takeovers](https://www.mcmc.gov.my/skmmgovmy/media/General/pdf/KENYATAAN_MEDIA_SCAMMER_WHATSAPP.pdf). It dates from January 2021, but the same patterns still circulate: - The scammer uses a friend's or relative's WhatsApp that was already hijacked and asks you to pass on the 6-digit code you just received. - The scammer pretends to be WhatsApp staff and asks for the code. - The scammer makes several failed verification attempts so that WhatsApp calls your number with the code. They then contact you pretending to be someone else to get it, or, if the call went to voicemail, try to guess or ask for your voicemail PIN to hear the recording. The first trick spreads account by account: once your WhatsApp is taken, your contacts get the same request from you. An illustrative version in Bahasa Melayu reads: "Sorry, tersalah hantar kod ke nombor awak. Boleh forward kod 6 digit tu?" Whatever the language, a request for your code is the attack. ## What You See, What It Means, What to Do Match what is on your screen to the row below. Exact wording can vary by phone, app version and language. *Common signs of a WhatsApp takeover and the first action for each, at the time of writing.* | What you see | What it likely means | What to do now | | --- | --- | --- | | A notification about a code you did not request | Someone typed your number into WhatsApp, by mistake or as a takeover attempt | Do nothing with the code. Without it they cannot finish | | "Your phone number was registered with WhatsApp on a new device" | Someone completed registration with your number elsewhere | Tap "Log back in", then "Continue", and verify with your code | | "You have been logged out" | A phone or number change, long inactivity, or a registration on another device | Log back in with your number; if you did not change phones, treat it as a takeover | | A request for a two-step verification PIN you never created | The hijacker probably turned on two-step verification to keep you out | Wait 7 days, then try again with the SMS code | | Friends say you are asking them for money or codes | Someone is using your account to scam your contacts | Warn them from another channel and start recovery now | | "No service" on your phone at the same time | Your SIM may have been replaced or deactivated | Call your mobile carrier from another phone | WhatsApp's page on a [code you did not request](https://faq.whatsapp.com/479314433984258) explains the first row: it sends you a notification when someone tries to register your number, and a person who does not have the SMS code cannot use your number on WhatsApp. If you see the second row, WhatsApp's page on the [new device message](https://faq.whatsapp.com/1234181997583400) gives the same log back in steps. ## Step 1: Log Back In With Your Own Number 1. Open WhatsApp. If it shows a logged out screen, tap "Log back in", then "Continue". 2. If prompted, enter your full international phone number (for a Malaysian number, the country code is +60) and tap "Next", then "Ok". 3. Enter the 6-digit code you receive by SMS or phone call. Type it yourself. Do not send it to anyone. 4. If WhatsApp asks for a two-step verification PIN and you know it, enter it. If you do not, see the next section. WhatsApp says that once you re-register, every device logged into your account is logged out. If the SMS does not arrive, its page on [the "You have been logged out" screen](https://faq.whatsapp.com/120604060995491) says to wait for the timer, which can take up to 10 minutes, then use "Call me" for an automated voice call. It also warns not to guess the code, or you will be locked out for a period of time. > Warning: **Two things that do not work.** WhatsApp says reinstalling the app will not recover a compromised account, and changing your password will not remove someone else. Security settings protect an account you still hold. Only logging back in with the code sent to your number removes the other person. ## Step 2: If WhatsApp Asks for a PIN You Never Set This is the most common reason people think the account is lost for good. It usually is not. WhatsApp's recovery page says a hijacker may turn on two-step verification to stop the real owner from logging in, and that the owner needs to wait 7 days and then try again. The same page adds that, whether you know the PIN or not, anyone using your account is logged out once you enter the 6-digit SMS code. So verify your number now, even if the PIN screen stops you. The hijacker loses the account at that point, and you come back after the wait. Keep the SIM active and in your phone during those days. WhatsApp is gradually replacing the 6-digit two-step PIN with a password, so your screen may say password instead of PIN. The advice is the same. ## Step 3: If You Cannot Receive the Code Recovery depends on the SIM. WhatsApp states plainly that it is not possible to recover an account without a SIM card with the same phone number as your account. - Phone lost or stolen: WhatsApp's page on [lost or stolen devices](https://faq.whatsapp.com/1007324800132703) says to call your mobile provider, ask them to block the SIM, request a new SIM with the same number, insert it and re-register. The old phone is then logged out. - Sudden "No service": call your carrier from another phone and ask whether a replacement SIM was issued on your number. Whoever holds a working SIM with your number can receive WhatsApp's codes. - Number no longer yours: WhatsApp says that if the carrier cannot give you back the original number, that account cannot be recovered. - Moved to a new number earlier: WhatsApp says to use the change number feature while you still have access, or you could permanently lose the account. WhatsApp also says it cannot deactivate your account for you, because it has no way to verify that you own the number. Getting your SIM back is the route. If WhatsApp has simply logged you out without a takeover, our guide to [the "no longer registered on this phone" message](https://www.awarexone.com/research/whatsapp-no-longer-registered-this-phone) walks through the other causes. ## Step 4: Warn Your Contacts Straight Away WhatsApp's recovery page tells you to notify family and friends, because the person using your account could impersonate you in chats and groups. PDRM's [scam alerts](https://www.rmp.gov.my/laman-utama/peringatan) warn of scammers posing as friends, family or colleagues to borrow money in a hurry. - Post on Facebook or Instagram Stories, or send an SMS or email, saying your WhatsApp was taken and nobody should send money or codes. - Ask a family member to post the same warning in the WhatsApp groups you share, especially family, school parents and work groups. - Tell them to call you on a normal voice call before acting on any message from your number. - If a contact already forwarded a code, send them this guide. Their account is probably next. ## Step 5: Lock the Account After You Are Back In WhatsApp's [account security tips](https://faq.whatsapp.com/1095301557782068) list the layers available once you hold the account again: - Two-step verification: WhatsApp's page on [registration and two-step verification](https://faq.whatsapp.com/506595211487528) says you can choose your phone number, a password or an email address as the extra check. It may make you wait a little after re-registering before you can turn it on. - Email: adding a verified email gives you another way to recover the account without SMS or a call. - Passkey: links the account to your phone's fingerprint, face or screen lock. - Linked devices: open "Linked devices" from the menu, tap any computer or tablet you do not recognise and log it out. WhatsApp's page on [linked devices](https://faq.whatsapp.com/378279804439436) says linking through unofficial apps or websites can get the account banned. - Voicemail: MCMC advises never giving out your voicemail password or PIN and making it hard to guess, because WhatsApp's voice call codes can land there. Then do the same on your other accounts with our walkthrough of [two-factor authentication on Instagram, Facebook and TikTok](https://www.awarexone.com/research/two-factor-authentication-instagram-facebook-tiktok). ## Mistakes That Make Recovery Harder - Reporting your own account before recovering it. WhatsApp warns it might ban the reported account, and you could lose access and data. Recover first. - Guessing codes or requesting them over and over. That triggers timed lockouts. - Letting the SIM lapse or swapping numbers during the 7 day wait. - Giving the new code to anyone who says they can help, including someone claiming to be WhatsApp. MCMC lists people posing as WhatsApp staff and even authorities among the parties to refuse. - Paying someone who offers to unban or recover the account. WhatsApp's page on [suspicious messages and scams](https://faq.whatsapp.com/2286952358121083) says the app is free and that anyone offering to unban an account for payment is likely after your money or information. If you received a genuine ban notice rather than a takeover, that is a separate process. Our guide to [a banned WhatsApp account in Malaysia](https://www.awarexone.com/research/whatsapp-account-banned-malaysia) covers the review request. ## If Money Was Lost or a Code Was Shared A takeover often ends with someone transferring money to the scammer. If that was you, or your contact, act on the money first. 1. Call your bank or the National Scam Response Centre on 997 immediately. Bank Negara Malaysia's [National Fraud Portal statement](https://www.bnm.gov.my/-/nfp-launch) tells scam victims to contact their financial institution or the NSRC at 997 straight away. 2. Make a police report at the nearest station. MCMC's statement says victims of a WhatsApp takeover can report it to the police or to MCMC through the complaint channels listed in that statement. 3. Report the incident to CyberSecurity Malaysia's [Cyber999 service](https://www.cybersecurity.my/portal-main/services/cyber999-overview), the national point of contact for computer security incidents. 4. Keep evidence: screenshots of the scam messages, the phone number that asked for your code, bank transfer receipts and the times everything happened. > Note: **WhatsApp decides, and the SIM is the key.** Only WhatsApp controls registration on its service. Logging back in with your code removes the other person, though a PIN they set can mean a 7 day wait first. An account without its original SIM number cannot be recovered, and nobody can promise otherwise. ## When Expert Recovery Help Makes Sense Most people get their WhatsApp back with the steps above and never need anyone else. A second opinion helps when the takeover spread to your Instagram, Facebook or business accounts, when a business number used for customer orders is involved, or when the SIM situation with your carrier is unclear. SocialSafe by AwareXone, our recovery service, reviews what happened and tells you honestly which official routes are still open. AwareXone is a Malaysian company with no link to WhatsApp or Meta, and we work only through the official steps described here. Our [recovery hub](https://www.awarexone.com/all-types-of-social-media-problem-solutions) explains the case review, and our [Trust Center](https://www.awarexone.com/trust) sets out what we will never ask for. That includes your WhatsApp code: keep it to yourself, even from us. ## Frequently Asked Questions ### Can the hacker read my old WhatsApp chats? WhatsApp says messages are end-to-end encrypted and stored on your device, so someone who registers your account on a new device cannot read your past conversations. They can still message your contacts while they hold the account, which is why warning people matters. ### Why did I get a WhatsApp verification code I did not ask for? Someone entered your number to register WhatsApp. WhatsApp says this is often a typing mistake but can be a takeover attempt. Ignore the code and never forward it. ### Can WhatsApp tell me who hacked my account? No. WhatsApp says it cannot provide information about who accessed your account or the time and location. Keep your own screenshots for a police report. ### Will I lose my chats after recovering my WhatsApp? It depends on your phone and backups. WhatsApp says that if you created a backup with a Google Account or iCloud, you might be able to restore your chat history. ### Should I report my hacked WhatsApp account to WhatsApp? Recover it first. WhatsApp warns that reporting the account you are trying to recover could get it banned for breaking its terms, and you could lose access to the account and its data. ### Can AwareXone recover my WhatsApp for me? No one outside WhatsApp can register your number for you, and recovery needs your own SIM. We can review the case and help you use the official steps properly, and we never ask for your code. ## Official sources - [WhatsApp Help Center: How to recover a compromised account (read 29 September 2026)](https://faq.whatsapp.com/1131652977717250) - [WhatsApp Help Center: Received verification code without requesting it (read 29 September 2026)](https://faq.whatsapp.com/479314433984258) - [WhatsApp Help Center: Seeing "Your phone number was registered with WhatsApp on a new device" (read 29 September 2026)](https://faq.whatsapp.com/1234181997583400) - [WhatsApp Help Center: Seeing "You have been logged out" (read 29 September 2026)](https://faq.whatsapp.com/120604060995491) - [WhatsApp Help Center: How to recover a WhatsApp account from a lost or stolen device (read 29 September 2026)](https://faq.whatsapp.com/1007324800132703) - [WhatsApp Help Center: About registration and two-step verification (read 29 September 2026)](https://faq.whatsapp.com/506595211487528) - [WhatsApp Help Center: Account security tips (read 29 September 2026)](https://faq.whatsapp.com/1095301557782068) - [WhatsApp Help Center: About linked devices (read 29 September 2026)](https://faq.whatsapp.com/378279804439436) - [WhatsApp Help Center: About suspicious messages and scams (read 29 September 2026)](https://faq.whatsapp.com/2286952358121083) - [MCMC: Kenyataan Media, Waspada Penipuan Melalui Akaun WhatsApp, 21 January 2021 (read 29 September 2026)](https://www.mcmc.gov.my/skmmgovmy/media/General/pdf/KENYATAAN_MEDIA_SCAMMER_WHATSAPP.pdf) - [PDRM: Scam Alert (read 29 September 2026)](https://www.rmp.gov.my/laman-utama/peringatan) - [Bank Negara Malaysia: National Fraud Portal to solidify coordinated efforts in curbing financial scams (read 29 September 2026)](https://www.bnm.gov.my/-/nfp-launch) - [CyberSecurity Malaysia: Cyber999 Cyber Incident Response Center (read 29 September 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.