# Unknown Device in WhatsApp Linked Devices? Remove It > Unknown device in WhatsApp Linked devices in Malaysia? How to log it out, spot the GhostPairing photo link scam, lock the account and warn your contacts. - URL: https://www.awarexone.com/research/whatsapp-linked-device-ghost-pairing - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-09-29 - Topics: WhatsApp, Account security, Malaysia - Related service: Account security: https://www.awarexone.com/services/account-security ## Short answer Someone may be reading and sending your messages from their own screen. Open WhatsApp on your phone, go to Linked devices, tap any device you do not recognise and choose Log out. Then turn on two-step verification and warn your contacts not to open links from you. Never type a linking code into WhatsApp that a website gives you. ## Summary - An unknown entry in WhatsApp Linked devices means someone can read and send your messages from their own screen while your phone keeps working normally. - Open WhatsApp on your phone, go to Linked devices, tap any device you do not recognise and choose Log out to cut it off. - The GhostPairing scam starts with a photo link from a friend and ends on a fake Facebook page that asks you to type a code into WhatsApp. - Never enter your phone number on a website to view something, and never type a linking code into WhatsApp unless you started the link on your own computer. - Afterwards turn on two-step verification, a passkey and app lock, and warn your contacts, because the scammer may already have messaged them from your account. - If money was lost, call your bank or NSRC on 997, and remember that only your own phone can remove a linked device. You opened Linked devices in WhatsApp and found a browser or computer you have never used. Or a friend asked why you sent them a strange photo link. Your WhatsApp still works on your phone, so it is hard to believe anyone else is inside it. Someone probably is, and removing them takes a few taps. Log the unknown device out from your phone, then lock the account. You have not lost the account, so this is a security job rather than a recovery. This guide covers how to remove linked devices, what the GhostPairing photo scam looks like from your side, how to tell a ghost device from a full takeover, and what to do in Malaysia if money went with it. Last checked: 29 September 2026. ## How Do You Remove an Unknown Device From WhatsApp? On your phone, open WhatsApp and go to "Linked devices": on Android tap More options (the three dots), on iPhone open the "Settings" tab. Tap the device you do not recognise, then tap "Log out". WhatsApp's page on [unlinking a device](https://faq.whatsapp.com/834124628020911) gives these steps, and its page [about linked devices](https://faq.whatsapp.com/378279804439436) says an account can have up to four linked devices and that WhatsApp disconnects them after 30 days of inactivity. Do not wait for that timer. Log the device out now, turn on two-step verification, and tell your contacts not to open any link that came from you. Nobody outside WhatsApp, including AwareXone, can remove a linked device for you; only your phone can. ## Why Would a Stranger Have a Linked Device? A linked device is a second screen on the same account: WhatsApp Web, the Windows or Mac app, a tablet or a companion phone. WhatsApp says you need your primary phone to link anything new, and that each linked device connects independently with end-to-end encryption. Encryption protects messages on the way, but a linked device is one of the ends. CERT-In, India's national cyber agency, says in its [advisory on the GhostPairing campaign](https://www.cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2025-0055&pageid=PUBVLNOTES02) that an attacker who links a device gets almost the same access you have on WhatsApp Web: messages that sync to it, new messages in real time, photos, videos and voice notes, and the ability to message your contacts and groups as you. Your phone does not log out, which is why most people only find out when a friend asks about a message they never sent. ## Signs Someone Is Using Your WhatsApp on Another Device One sign alone may have an innocent cause, such as a work computer you forgot. The check in the last column settles it. *Signs of an extra linked device and the first action for each, based on WhatsApp Help Center pages at the time of writing. Labels vary by phone, app version and language.* | What you notice | What it may mean | What to do | | --- | --- | --- | | A browser, computer or tablet in Linked devices that you do not own or remember linking | Someone linked their device to your account | Tap it and choose "Log out" | | A notification about a new linked device that you did not start | A device was just linked, or someone is trying | Tap the notification, review the device and remove it | | A prompt asking whether to link an unrecognised device | WhatsApp flagged a link request it was unsure about | Tap "Don't link" unless you are linking your own computer right now | | Friends ask about a photo link or a request you did not send | Your account is being used to spread a scam | Log out unknown devices, then warn contacts from another channel | | WhatsApp says you have been logged out, or asks for a 6-digit code or a PIN | Someone registered your number on their own phone: a full takeover | Follow the takeover steps further down instead | WhatsApp recommends keeping push notifications on so you can tap a new link notification and remove a device you do not recognise. Its [page on linking with a QR code](https://faq.whatsapp.com/1317564962315842) adds that when it detects an unrecognised device, it asks you to choose "Don't link" or "Link device". ## Step by Step: Check and Log Out Every Linked Device 1. Open WhatsApp on your phone. 2. On Android, tap More options (the three dots), then "Linked devices". On iPhone, open the "Settings" tab, then "Linked devices". 3. Read every entry. Each should be a computer, browser or tablet you use today. 4. Tap any entry you do not recognise, or are unsure about, and tap "Log out". Relinking your own computer later costs one QR scan. 5. Check again in a day or two, then make it a monthly habit. Gen Digital, the security company that named GhostPairing, says in its [research on the campaign](https://www.gendigital.com/blog/insights/research/ghostpairing-whatsapp-attack) that linked devices stay active until someone revokes them; closing a browser tab does not end them. > Note: **A new password does not remove a device.** WhatsApp's page on [recovering a compromised account](https://faq.whatsapp.com/1131652977717250) says changing your password won't remove someone else, because security features protect an account you still have access to. For an unknown linked device, logging it out is the fix. Two-step verification comes after, not instead. ## What the GhostPairing Scam Looks Like From Your Side Gen described GhostPairing in December 2025 after first seeing it in Czechia, and notes that it works in any language. CERT-In rated it high severity on 19 December 2025. We describe it only so you can recognise it. 1. A friend or relative sends a short message along the lines of "Hey, I just found your photo" or "Hi, check this photo", with a link that previews like a Facebook post. Their account has usually been compromised already. 2. The link opens a Facebook-style page that asks you to "verify" before you can see the photo, and asks for your phone number. 3. It then shows a code and tells you to enter it in WhatsApp to see the photo. 4. WhatsApp asks for a code to link a new device. Typing it in approves the scammer's browser as a linked device on your account. No photo appears, and your chats carry on as normal. As far as WhatsApp can tell, you approved the device yourself. One fact stops the scam. WhatsApp's [guide to linking with a phone number](https://faq.whatsapp.com/1324084875126592) says that option starts on the computer you want to link, in WhatsApp Web or WhatsApp for Windows, and that your phone shows the name and location of that device before you confirm. If you are not at your own computer linking it at that moment, any linking code in front of you belongs to someone else. In Malaysia the lure arrives in whatever language the group uses. Illustrative examples, not quotes from real cases: "Eh, ni gambar kau ke?" or "这是你的照片吗？", each with a link. Gen says it spreads through family, school and work groups, because it comes from someone people trust. If the fake page also took a Facebook password, see our guide on [what to do after clicking a phishing link](https://www.awarexone.com/research/clicked-phishing-link-what-to-do). > Warning: **Two rules that beat this scam.** Never enter your phone number on a website to see a photo, video or post. Never type a code into WhatsApp that a website, message or caller gave you. CERT-In says the same: do not click suspicious links even from known contacts, and never enter your phone number on outside sites claiming to be WhatsApp or Facebook. ## Ghost Device or Full Takeover: Which One Do You Have? - Can you open WhatsApp and use your chats normally? Yes: you still own the account. Log out unknown devices and continue below. No: read on. - Did WhatsApp log you out, show "Log back in", or ask for a 6-digit code or a PIN you never set? Then someone registered your number on their phone. That is a takeover. - Is your phone showing "No service" too? Call your mobile carrier from another phone and ask whether your SIM was replaced. For a takeover, WhatsApp says re-registering with the 6-digit code sent to your number logs every device out. Our guide to [getting a hacked WhatsApp account back](https://www.awarexone.com/research/whatsapp-hacked-verification-code-malaysia) covers that, including the 7-day wait if the hijacker set a PIN. ## After You Log It Out: Lock the Account WhatsApp's [account security tips](https://faq.whatsapp.com/1095301557782068) list the layers available once you have access, which you do. - Two-step verification: choose your phone number, a password or an email address as the extra check. WhatsApp is upgrading the old 6-digit PIN to a password, so your screen may show either. Turn it on in the [two-step verification settings](https://faq.whatsapp.com/1920866721452534). - Passkey: links the account to your phone's fingerprint, face or screen lock. - Email address: a way to recover the account without SMS or a phone call. - App lock: biometrics on supported phones, or a password on WhatsApp Web, Windows and Mac, as WhatsApp's [app lock page](https://faq.whatsapp.com/1726618467788240) explains. - Official apps only: WhatsApp says linking through [unofficial apps or websites](https://faq.whatsapp.com/1217634902127718) may lead to a temporary or permanent ban, and names GB WhatsApp and FM WhatsApp as examples. Gen calls two-step verification an extra barrier rather than a complete solution, because GhostPairing gets you to approve the device yourself. The habits that protect you are refusing codes you did not ask for and checking Linked devices. If Instagram, Facebook or Google also sent login alerts, see [what to do when someone logs into your account](https://www.awarexone.com/research/someone-logged-into-my-account). ## Warn Your Contacts, and the Friend Who Sent the Link Gen describes each victim becoming the next sender, so the warning is part of the fix. - Post a short note on Instagram or Facebook Stories, SMS or email: your WhatsApp had an extra device, it is removed, and nobody should open a photo link or send money or codes because of a message from you. - Ask a family member to repeat the warning in the groups you share. - Phone the friend whose link you opened. WhatsApp's [scams page](https://faq.whatsapp.com/2286952358121083) says a suspicious message from a known contact can mean their account is compromised, so ask them to check Linked devices. - Screenshot any message you did not write, with the time, before deleting it. WhatsApp's page on [blocking and reporting](https://faq.whatsapp.com/1142481766359885) also suggests screenshots first. If a contact already paid or passed on a code, our guide to [a hacked account messaging your friends](https://www.awarexone.com/research/hacked-account-messaging-friends) sets out their next steps. ## Mistakes That Leave a Ghost Device Connected - Changing your password or turning on two-step verification without opening Linked devices. The device stays. - Deleting the scam message and moving on. The link disappears; the session does not. - Waiting for the device to drop off. The 30-day disconnect applies to inactive devices, and a device someone uses is not inactive. - Installing a "spy checker" or "WhatsApp cleaner" app. Linked devices in the official app is the check WhatsApp provides, and unofficial apps bring their own risks. - Reporting your own account instead of cleaning it. WhatsApp warns that reporting a compromised account you are trying to recover might get it banned. > Warning: **Fake helpers follow real scams.** WhatsApp's scams page says the app is free and that anyone offering to unban an account for payment is likely after your financial or personal information. MCMC's [statement of 25 September 2026](https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/MEDIA-STATEMENT_MCMC-INVESTIGATING-COMPLAINTS-RELATED-TO-WHATSAPP-ACCOUNTS.pdf) warns about parties offering account recovery for money, personal information or verification codes. Nobody legitimate asks for your password, PIN, backup code or a WhatsApp code, and that includes us. ## If Money or Personal Details Went With It in Malaysia A ghost device can see what you share in chat: bank details, photos of your IC, addresses, one-time codes. Deal with any money first. 1. For an unauthorised transfer, or a contact who paid the scammer, call the bank's 24-hour hotline or the National Scam Response Centre on 997 straight away. The NSRC's [FAQ on the NFCC website](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) gives the same advice: contact the bank or 997 as soon as you notice the transaction. 2. Make a police report at the nearest station within 24 hours, after contacting the bank or 997, as the same FAQ advises. 3. Report the fake page to CyberSecurity Malaysia's [Cyber999 service](https://www.cybersecurity.my/portal-main/services/cyber999-overview) by online form, email, phone or its mobile app. 4. If WhatsApp's official channels do not resolve a follow-on account problem, MCMC's statement says you may lodge a complaint with MCMC, which can refer the case to Meta. 5. Change any password, PIN or banking login you ever sent in a chat. The NSRC also says that it, PDRM, MCMC, BNM and banks will never ask for your username, password, PIN, TAC or OTP. ## When a Case Review Makes Sense Most people fix this alone. It gets harder when the ghost device sat on a business number your customers message, when the scam also reached your Instagram or Facebook, or when you cannot tell whether a takeover followed. SocialSafe by AwareXone, AwareXone's recovery and account security service, looks at what happened before anything is agreed, and sometimes the honest answer is that you already have what you need. You can read how we approach [account security](https://www.awarexone.com/services/account-security), and our [Trust Center](https://www.awarexone.com/trust) lists what we never ask for. WhatsApp makes the final decision on any account it restricts, and some banned accounts do not come back. ## Frequently Asked Questions ### Can someone use my WhatsApp on another device without my phone? They need your phone to approve the link once, which is what GhostPairing tricks you into. After that, WhatsApp says linked devices work without your phone online, though they log out if the phone goes unused for more than 14 days. ### Can WhatsApp tell me who linked a device to my account? WhatsApp says it can't provide information about who accessed your account or the time and location of access. Screenshot your Linked devices list and the scam messages in case you make a police report. ### Can a linked device read my old chats? It can see what syncs to it. CERT-In says an attacker's linked device reads messages that sync to it and receives new ones in real time, so treat recent chats as seen. ### Does WhatsApp Web log out on its own? WhatsApp disconnects a linked device after 30 days of inactivity, and linked devices log out if your phone goes unused for more than 14 days. A session someone actively uses survives both rules, so log it out yourself. ### I typed the code from the photo page. What do I do now? Open Linked devices, log out anything you do not recognise, turn on two-step verification and warn your contacts. If WhatsApp has already logged you out, follow the takeover steps instead. ## Official sources - [WhatsApp Help Center: About linked devices (read 29 September 2026)](https://faq.whatsapp.com/378279804439436) - [WhatsApp Help Center: How to link a device (read 29 September 2026)](https://faq.whatsapp.com/1317564962315842) - [WhatsApp Help Center: How to link a device with phone number (read 29 September 2026)](https://faq.whatsapp.com/1324084875126592) - [WhatsApp Help Center: How to unlink a device (read 29 September 2026)](https://faq.whatsapp.com/834124628020911) - [WhatsApp Help Center: Account security tips (read 29 September 2026)](https://faq.whatsapp.com/1095301557782068) - [WhatsApp Help Center: How to manage two-step verification settings (read 29 September 2026)](https://faq.whatsapp.com/1920866721452534) - [WhatsApp Help Center: How to use app lock (read 29 September 2026)](https://faq.whatsapp.com/1726618467788240) - [WhatsApp Help Center: How to recover a compromised account (read 29 September 2026)](https://faq.whatsapp.com/1131652977717250) - [WhatsApp Help Center: About suspicious messages and scams (read 29 September 2026)](https://faq.whatsapp.com/2286952358121083) - [WhatsApp Help Center: How to block and report someone (read 29 September 2026)](https://faq.whatsapp.com/1142481766359885) - [WhatsApp Help Center: About unofficial apps (read 29 September 2026)](https://faq.whatsapp.com/1217634902127718) - [Gen Digital: GhostPairing Attacks, from phone number to full access in WhatsApp, 15 December 2025 (read 29 September 2026)](https://www.gendigital.com/blog/insights/research/ghostpairing-whatsapp-attack) - [CERT-In: Advisory CIAD-2025-0055, WhatsApp account takeover campaign (GhostPairing), 19 December 2025 (read 29 September 2026)](https://www.cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2025-0055&pageid=PUBVLNOTES02) - [MCMC: Media statement, MCMC investigating complaints related to WhatsApp accounts, 25 September 2026 (read 29 September 2026)](https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/MEDIA-STATEMENT_MCMC-INVESTIGATING-COMPLAINTS-RELATED-TO-WHATSAPP-ACCOUNTS.pdf) - [NFCC: National Scam Response Centre FAQ (read 29 September 2026)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) - [CyberSecurity Malaysia: Cyber999 Cyber Incident Response Center (read 29 September 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.