WhatsApp Security Settings: 8 Things to Turn On Right Now

Ever got a strange message from an unknown number and wondered whether your account was still safe? The right WhatsApp security settings can cut your risk dramatically, and it only takes about ten minutes. In 2026 scammers are better organized and even use AI, but the defenses are there. You just have to switch them on. Here are eight settings to check right now, with the menu paths to find them and the reasons they matter.

Why your WhatsApp account is a target

Your account holds private chats, photos, contacts and work groups. For a scammer, that’s a goldmine. With your profile, they can ask your friends for money while pretending to be you.

Three tricks are especially common:

• The 6-digit SMS code. The scammer enters your number on another phone. WhatsApp sends you a code. If you hand it over, the account moves to them.
• “I sent you a code by mistake.” Someone (often a contact who has already been hacked) asks you to forward the code you just received. That code is the key to your account.
• Trading scam groups. You get added to a group where fake experts show off easy profits. Then they push you to invest on bogus platforms.

Golden rule: never share your verification code with anyone. Not even a friend or a family member.

1. Turn on two-step verification with a PIN

This is your most important defense. It adds a six-digit PIN that is required every time someone tries to register your number on a new phone. Even if a scammer gets hold of the SMS code, they stop dead without the PIN.

Where to find it: Settings > Account > Two-step verification.

• Choose a PIN that isn’t a birthday or an obvious sequence.
• Add a recovery email address. You’ll need it if you forget the PIN.
• Never tell anyone your PIN, not even someone claiming to be from support.

2. Use passkeys to sign in

A passkey lets you confirm your login with your fingerprint, face or phone screen lock. There’s nothing to remember and no code for anyone to steal. It works because it’s tied to your device.

Where to find it: Settings > Account > Passkeys. If you want to understand how this works in more depth, read our guide to what passkeys are.

Set it up on the phone you use every day, and always keep a strong screen lock.

3. Check your linked devices

With WhatsApp Web, Desktop and other companion devices, your account can be open in several places at once. If someone scanned a QR code while you weren’t paying attention, they can read your messages without you noticing.

Where to find it: Settings > Linked devices.

1. Look through the list of active sessions.
2. If you spot one you don’t recognize, select it.
3. Tap Log out.

Do this check once a month. If you find suspicious sessions you can’t explain, there may be a bigger problem. Here’s how to tell if your phone is being spied on.

4. Decide who can add you to groups

By default, many people can add you to a group without asking. That’s how you end up in trading scam groups, fake investment communities and spam lists.

Where to find it: Settings > Privacy > Groups.

• My contacts: only people in your address book can add you.
• My contacts except…: exclude specific people.

Pick one of these two options. If a stranger invites you to a group, don’t reply and don’t tap anything. Leave the group, report it and, if needed, block whoever added you.

Remember: no group makes you rich without risk. If someone promises guaranteed returns, it’s a scam.

5. Silence calls from unknown numbers

Calls from numbers you don’t know are often used to pressure you, extract information or record your voice. With AI today, a few seconds of audio can be enough to imitate someone. To learn more, read our guide to AI scams.

Where to find it: Settings > Privacy > Calls, then turn on the option to silence unknown callers.

The calls don’t vanish. They still show up in your call list, but your phone won’t ring. If it’s important, the person will text you.

6. Make your last seen, profile photo and about info private

The more you show, the easier it is to build a believable scam around you. Your photo, name, online times and status help a bad actor impersonate you or reach your family.

Where to find it: Settings > Privacy. Check these items:

• Last seen and online
• Profile photo
• About
• Status
• Read receipts, if you want extra privacy

A balanced choice is My contacts. People who know you see what they need to, while strangers don’t.

7. Protect your IP address during calls

When you make a call, WhatsApp can connect the devices directly. In some cases the other person could trace your IP address, the identifier of your internet connection, and with it your approximate location.

Where to find it: Settings > Privacy > Advanced, then turn on Protect IP address in calls.

Call quality may dip slightly, because the connection is routed through the app’s servers. In exchange, your location stays more private. It’s worth it, especially if you get calls from strangers.

8. Encrypted backups, disappearing messages and app lock

These three features protect your conversations, and each covers a different risk.

End-to-end encrypted backup. Your chats are normally encrypted, but your backup may not be. Turn on encryption and nobody can read the copy without your password or key. Where to find it: Settings > Chats > Chat backup > End-to-end encrypted backup. Keep your password somewhere safe: if you lose it, you won’t be able to recover the backup.

Disappearing messages. After the time you choose, messages vanish from the chat. They’re handy for sensitive details, addresses or documents. Where to find it: open the chat, tap the contact’s name and choose Disappearing messages. You can also set a default timer under Settings > Privacy. Keep in mind that the recipient can always take a screenshot.

App lock and chat lock. This asks for your fingerprint or face to open WhatsApp. If someone grabs your unlocked phone, they can’t read your chats. Where to find it: Settings > Privacy > App lock (or screen lock, depending on your phone). For your most sensitive conversations, you can also lock individual chats from the contact’s profile.

What to do if your WhatsApp account has been hacked

If you can’t log in any more, or your contacts are getting messages you didn’t write, act right away.

1. Reinstall WhatsApp and register your number again. You’ll get a new SMS code. Enter it and the other person will be logged out.
2. Enter your PIN if you had one set. If the scammer set their own PIN, you may have to wait out a cooling-off period before trying again. Don’t keep hammering away with repeated attempts.
3. Warn your contacts through another channel, such as a phone call, a text or social media. Tell them not to send money or codes.
4. Turn on two-step verification straight away and check your linked devices.
5. Contact WhatsApp support from the login screen if you can’t recover the account.
6. Change the passwords for your email and other important accounts if you think the problem goes beyond WhatsApp.
7. Report it. In the US, report it to the FTC at reportfraud.ftc.gov. In the UK, report it to Action Fraud (actionfraud.police.uk). In both countries, also contact your local police, especially if you lost money or your identity was stolen. Keep screenshots, phone numbers and messages.

Frequently asked questions

If I turn on a PIN, can I still be hacked?

The risk drops a lot, but it doesn’t disappear. If you share your PIN or code, or if someone infects your phone, you’re still exposed. That’s why the other settings matter too.

I gave my code to an acquaintance by mistake. What do I do?

First, set up a PIN if you can still get into your account. Then check your linked devices. If you’ve already been locked out, follow the steps in the section on a hacked account. Warn your contacts as soon as possible.

Are WhatsApp chats really private?

Messages are encrypted in transit, but your privacy also depends on you: backups, screenshots, an unlocked phone and unknown groups can all expose you. That’s why the settings in this article matter.

The bottom line

You don’t need to be an expert to protect WhatsApp. Turn on a PIN and passkeys, check your linked devices, limit who can add you to groups and make your personal info private. Then add an encrypted backup, disappearing messages and app lock. And remember: your 6-digit code is yours alone. Spend ten minutes on these settings today. Tomorrow you may be glad you did.