Unknown Device in WhatsApp Linked Devices? Remove It

You opened Linked devices in WhatsApp and found a browser or computer you have never used. Or a friend asked why you sent them a strange photo link. Your WhatsApp still works on your phone, so it is hard to believe anyone else is inside it.

Someone probably is, and removing them takes a few taps. Log the unknown device out from your phone, then lock the account. You have not lost the account, so this is a security job rather than a recovery.

This guide covers how to remove linked devices, what the GhostPairing photo scam looks like from your side, how to tell a ghost device from a full takeover, and what to do in Malaysia if money went with it.

Last checked: 29 September 2026.

#How Do You Remove an Unknown Device From WhatsApp?

On your phone, open WhatsApp and go to "Linked devices": on Android tap More options (the three dots), on iPhone open the "Settings" tab. Tap the device you do not recognise, then tap "Log out". WhatsApp's page on unlinking a device gives these steps, and its page about linked devices says an account can have up to four linked devices and that WhatsApp disconnects them after 30 days of inactivity. Do not wait for that timer. Log the device out now, turn on two-step verification, and tell your contacts not to open any link that came from you. Nobody outside WhatsApp, including AwareXone, can remove a linked device for you; only your phone can.

#Why Would a Stranger Have a Linked Device?

A linked device is a second screen on the same account: WhatsApp Web, the Windows or Mac app, a tablet or a companion phone. WhatsApp says you need your primary phone to link anything new, and that each linked device connects independently with end-to-end encryption.

Encryption protects messages on the way, but a linked device is one of the ends. CERT-In, India's national cyber agency, says in its advisory on the GhostPairing campaign that an attacker who links a device gets almost the same access you have on WhatsApp Web: messages that sync to it, new messages in real time, photos, videos and voice notes, and the ability to message your contacts and groups as you. Your phone does not log out, which is why most people only find out when a friend asks about a message they never sent.

#Signs Someone Is Using Your WhatsApp on Another Device

One sign alone may have an innocent cause, such as a work computer you forgot. The check in the last column settles it.

WhatsApp recommends keeping push notifications on so you can tap a new link notification and remove a device you do not recognise. Its page on linking with a QR code adds that when it detects an unrecognised device, it asks you to choose "Don't link" or "Link device".

#Step by Step: Check and Log Out Every Linked Device

1. Open WhatsApp on your phone.
2. On Android, tap More options (the three dots), then "Linked devices". On iPhone, open the "Settings" tab, then "Linked devices".
3. Read every entry. Each should be a computer, browser or tablet you use today.
4. Tap any entry you do not recognise, or are unsure about, and tap "Log out". Relinking your own computer later costs one QR scan.
5. Check again in a day or two, then make it a monthly habit.

Gen Digital, the security company that named GhostPairing, says in its research on the campaign that linked devices stay active until someone revokes them; closing a browser tab does not end them.

#What the GhostPairing Scam Looks Like From Your Side

Gen described GhostPairing in December 2025 after first seeing it in Czechia, and notes that it works in any language. CERT-In rated it high severity on 19 December 2025. We describe it only so you can recognise it.

1. A friend or relative sends a short message along the lines of "Hey, I just found your photo" or "Hi, check this photo", with a link that previews like a Facebook post. Their account has usually been compromised already.
2. The link opens a Facebook-style page that asks you to "verify" before you can see the photo, and asks for your phone number.
3. It then shows a code and tells you to enter it in WhatsApp to see the photo.
4. WhatsApp asks for a code to link a new device. Typing it in approves the scammer's browser as a linked device on your account.

No photo appears, and your chats carry on as normal. As far as WhatsApp can tell, you approved the device yourself.

One fact stops the scam. WhatsApp's guide to linking with a phone number says that option starts on the computer you want to link, in WhatsApp Web or WhatsApp for Windows, and that your phone shows the name and location of that device before you confirm. If you are not at your own computer linking it at that moment, any linking code in front of you belongs to someone else.

In Malaysia the lure arrives in whatever language the group uses. Illustrative examples, not quotes from real cases: "Eh, ni gambar kau ke?" or "这是你的照片吗？", each with a link. Gen says it spreads through family, school and work groups, because it comes from someone people trust. If the fake page also took a Facebook password, see our guide on what to do after clicking a phishing link.

#Ghost Device or Full Takeover: Which One Do You Have?

• Can you open WhatsApp and use your chats normally? Yes: you still own the account. Log out unknown devices and continue below. No: read on.
• Did WhatsApp log you out, show "Log back in", or ask for a 6-digit code or a PIN you never set? Then someone registered your number on their phone. That is a takeover.
• Is your phone showing "No service" too? Call your mobile carrier from another phone and ask whether your SIM was replaced.

For a takeover, WhatsApp says re-registering with the 6-digit code sent to your number logs every device out. Our guide to getting a hacked WhatsApp account back covers that, including the 7-day wait if the hijacker set a PIN.

#After You Log It Out: Lock the Account

WhatsApp's account security tips list the layers available once you have access, which you do.

• Two-step verification: choose your phone number, a password or an email address as the extra check. WhatsApp is upgrading the old 6-digit PIN to a password, so your screen may show either. Turn it on in the two-step verification settings.
• Passkey: links the account to your phone's fingerprint, face or screen lock.
• Email address: a way to recover the account without SMS or a phone call.
• App lock: biometrics on supported phones, or a password on WhatsApp Web, Windows and Mac, as WhatsApp's app lock page explains.
• Official apps only: WhatsApp says linking through unofficial apps or websites may lead to a temporary or permanent ban, and names GB WhatsApp and FM WhatsApp as examples.

Gen calls two-step verification an extra barrier rather than a complete solution, because GhostPairing gets you to approve the device yourself. The habits that protect you are refusing codes you did not ask for and checking Linked devices. If Instagram, Facebook or Google also sent login alerts, see what to do when someone logs into your account.

#Warn Your Contacts, and the Friend Who Sent the Link

Gen describes each victim becoming the next sender, so the warning is part of the fix.

• Post a short note on Instagram or Facebook Stories, SMS or email: your WhatsApp had an extra device, it is removed, and nobody should open a photo link or send money or codes because of a message from you.
• Ask a family member to repeat the warning in the groups you share.
• Phone the friend whose link you opened. WhatsApp's scams page says a suspicious message from a known contact can mean their account is compromised, so ask them to check Linked devices.
• Screenshot any message you did not write, with the time, before deleting it. WhatsApp's page on blocking and reporting also suggests screenshots first.

If a contact already paid or passed on a code, our guide to a hacked account messaging your friends sets out their next steps.

#Mistakes That Leave a Ghost Device Connected

• Changing your password or turning on two-step verification without opening Linked devices. The device stays.
• Deleting the scam message and moving on. The link disappears; the session does not.
• Waiting for the device to drop off. The 30-day disconnect applies to inactive devices, and a device someone uses is not inactive.
• Installing a "spy checker" or "WhatsApp cleaner" app. Linked devices in the official app is the check WhatsApp provides, and unofficial apps bring their own risks.
• Reporting your own account instead of cleaning it. WhatsApp warns that reporting a compromised account you are trying to recover might get it banned.

#If Money or Personal Details Went With It in Malaysia

A ghost device can see what you share in chat: bank details, photos of your IC, addresses, one-time codes. Deal with any money first.

1. For an unauthorised transfer, or a contact who paid the scammer, call the bank's 24-hour hotline or the National Scam Response Centre on 997 straight away. The NSRC's FAQ on the NFCC website gives the same advice: contact the bank or 997 as soon as you notice the transaction.
2. Make a police report at the nearest station within 24 hours, after contacting the bank or 997, as the same FAQ advises.
3. Report the fake page to CyberSecurity Malaysia's Cyber999 service by online form, email, phone or its mobile app.
4. If WhatsApp's official channels do not resolve a follow-on account problem, MCMC's statement says you may lodge a complaint with MCMC, which can refer the case to Meta.
5. Change any password, PIN or banking login you ever sent in a chat.

The NSRC also says that it, PDRM, MCMC, BNM and banks will never ask for your username, password, PIN, TAC or OTP.

#When a Case Review Makes Sense

Most people fix this alone. It gets harder when the ghost device sat on a business number your customers message, when the scam also reached your Instagram or Facebook, or when you cannot tell whether a takeover followed. SocialSafe by AwareXone, AwareXone's recovery and account security service, looks at what happened before anything is agreed, and sometimes the honest answer is that you already have what you need. You can read how we approach account security, and our Trust Center lists what we never ask for. WhatsApp makes the final decision on any account it restricts, and some banned accounts do not come back.

#Frequently Asked Questions