TL;DR: If you miss a call that reads out a verification code, the code can land in your voicemail. Many voicemail boxes are protected only by a default PIN like 0000 or 1234, so a scammer who knows your number can listen to it and take over your WhatsApp. Turn on WhatsApp two-step verification, and either switch voicemail off or set a strong PIN.
How the voicemail trick works
Security firm Sophos documented this attack after Israel’s national cybersecurity authority warned about it, and Singapore police later issued a similar alert. The steps are simple:
- The scammer starts setting up WhatsApp with your number on their own phone, usually at night when you’re asleep.
- WhatsApp sends you a code by SMS. You don’t see it.
- They ask WhatsApp to call you with the code instead. You don’t pick up, so the automated voice leaves the code as a voicemail.
- They dial into your voicemail. Many carriers let you check voicemail remotely with just a 4-digit PIN, and Sophos notes these are often left on defaults like 0000 or 1234.
- They enter your code, then turn on two-step verification themselves, locking you out of your own account.
The same idea works on any service that offers “call me with the code”, including some bank and app logins. It’s a quieter cousin of the call merging scam: in both, the code is read aloud and someone else is listening.
Is this a risk in India?
Voicemail is far less common in India than in the US or Europe, which is good news. But it isn’t zero: some plans include it, some people switch it on and forget, and the attack needs nothing except your phone number. If you’ve ever set up voicemail, or aren’t sure, treat yourself as exposed until you check.
Check in two minutes
- Call your own number from another phone and let it ring out. If you hear a voicemail greeting, voicemail is on.
- Ask your operator (through its official app or helpline) to switch voicemail off, or to help you set a non-default PIN.
- While you’re there, check that no call forwarding is active, since forwarding to a scammer’s number has the same effect.
Lock WhatsApp properly
- Turn on two-step verification: Settings, Account, Two-step verification, Turn on. WhatsApp’s help page explains it. With a 6-digit PIN set, a stolen code alone isn’t enough.
- Add an email to two-step verification so you can reset the PIN if you forget it.
- Never forward a WhatsApp code, even to a “friend” who says it was sent to you by mistake.
If your WhatsApp was already taken
Re-register WhatsApp on your own phone with your number; the new code logs the scammer out. If they set a two-step PIN, you may have to wait before you can get back in. Warn your contacts right away, because hijacked accounts are used to ask friends for money. Our step-by-step guide: recover a hacked WhatsApp account.
Frequently Asked Questions
Can someone hack WhatsApp through voicemail?
Yes, if voicemail is on and protected by a default or weak PIN. The scammer has WhatsApp call you with the code, you miss it, and they listen to the voicemail.
What are common default voicemail PINs?
Sophos reported that many carriers set simple defaults such as 0000 or 1234, which scammers try first.
How do I check if voicemail is on?
Call your own number from another phone and let it ring out. If you hear a voicemail greeting, it's on.
What is the best protection against this?
Turn on WhatsApp two-step verification and switch off voicemail or set a strong, non-default PIN.
Sources
- Sophos: Attackers use voicemail hack to steal WhatsApp accounts
- Silicon UK: Users warned over WhatsApp account hijack scams (Singapore police)
- WhatsApp Help Center