Recovering a Hacked WhatsApp or Social Account After a Scam
TL;DR: If a scammer has taken over your WhatsApp or social account, the priority order is: use the platform's official account-recovery flow, warn your contacts through another channel that the account is compromised, and re-secure with two-factor authentication once you're back in.
👉 See if your data's already leaked — free 30-second check →
A hijacked WhatsApp or social account is often just the first step — scammers frequently use a compromised account to message your contacts asking for money, since a message from a familiar name is far more convincing than one from a stranger.
Recovering WhatsApp
- Reinstall WhatsApp on your phone and enter your number — this triggers a new SMS verification code, which will kick out whoever is logged in on the scammer's device in most cases.
- If they've enabled two-step verification with their own PIN, you'll be locked out. WhatsApp allows you to request account deactivation via a form (search "WhatsApp account hacked" in the app's Help Center) — after 7 days of inactivity on the compromised session, WhatsApp deletes the account, letting you re-register from scratch.
- Once back in, immediately set your own two-step verification PIN under Settings → Account → Two-step verification.
Recovering Instagram or Facebook
- Use the "Forgot password" flow first — if the scammer hasn't changed your linked email or phone number yet, you can often regain access immediately.
- If they've changed your recovery email or phone, use the platform's dedicated "hacked account" reporting form, which asks for ID verification to prove ownership.
- Check Instagram's "Account Center" or Facebook's security settings for any new devices or login locations once you're back in, and log them all out.
Warn your contacts immediately
Don't wait until you've regained access. Message close contacts through another channel — SMS, a phone call, a different app — letting them know your account may be sending fraudulent messages, especially anything asking for money or OTPs. This single step prevents most of the downstream damage, since the scammer's real goal is usually reaching your network, not just your account.
Re-securing after you're back in
- Turn on two-factor authentication everywhere it's available — see how 2FA actually protects your accounts.
- Review your WhatsApp Privacy settings for who can see your number, status, and last seen — our WhatsApp privacy settings guide covers the full checklist.
- Check whether your email or phone number appears in old data breaches that could have made this hack easier in the first place — that's what a Scan My Shadow report is for.
If this hack was part of a larger scam involving money or documents, don't treat it in isolation — go back to the complete India recovery guide for the rest of the sequence.
Frequently Asked Questions
How do I get WhatsApp back if the scammer set a new PIN?
Reinstall the app and re-verify with your number to trigger deactivation of the old session, then use WhatsApp's official 'account hacked' request form. After roughly 7 days of the compromised session being inactive, you can register the number fresh.
What should I message my contacts if my account is hacked?
Reach them through a different channel (SMS or phone call) and tell them your account may be compromised — specifically warn them not to send money or share OTPs if 'you' ask.
Can I recover Instagram if the scammer changed my email and phone?
Yes, through Instagram's dedicated hacked-account reporting form, which typically requires you to verify your identity through other means like a video selfie or supporting ID.
Why do scammers target WhatsApp specifically?
A message from a real contact's account is far more trusted than one from a stranger, which makes it an effective way to reach the victim's network with a fake urgent-money-request scam.
How do I stop this from happening again?
Enable two-step verification on WhatsApp and two-factor authentication on all social accounts, and avoid sharing OTPs with anyone, including people claiming to be from the platform itself.
Curious what's already out there about you? Scan My Shadow checks your phone number and email across 1,500+ sources and sends you a clear report — no guesswork, just facts. Start your scan.
- Results within about 5 minutes
- Clear, plain-English report
- Delivered straight to your inbox
- No login or passwords required
- Scan data deleted after report is generated