How to Secure WhatsApp from Scams and Unknown Links

Securing WhatsApp therefore requires more than turning on one setting. You need account protections, sensible privacy choices, a reliable way to verify unusual requests, and a response plan for the moment something goes wrong. No setup can make every message trustworthy. The goal is to make account theft harder, expose suspicious behaviour earlier, and reduce the damage a scam can cause.

This guide applies to both Android and iPhone. WhatsApp changes labels and menu locations over time, so use the closest matching option in your current app. Update WhatsApp and your phone before starting, then work through the checks below without rushing.

Understand What WhatsApp Security Can and Cannot Do

WhatsApp uses end-to-end encryption for personal messages and calls. This helps prevent outsiders from reading the content while it moves between participants. It does not prove that the person at the other end is honest. A scammer can still lie, impersonate someone, send a harmful link, persuade you to share a code, or convince you to install another app.

That distinction matters. A padlock does not make every request inside a chat safe. Treat the message content, the sender's identity, and any requested action as separate questions.

Meta's current scam guidance recommends a simple habit: pause, question, and verify. When a message creates urgency, stop before acting. Ask whether the request makes sense. Confirm it through a different channel that you already trust. Calling a saved number is stronger evidence than replying to the same chat that may have been compromised.

Start With a Five-Minute Account Check

Open WhatsApp settings and review the security and privacy options available in your version. The exact path can differ by phone and release, but the following checks are worth making.

Update WhatsApp and the phone

Install WhatsApp updates from Google Play or Apple's App Store. Also install supported Android or iOS security updates. Updates do not eliminate social engineering, but they reduce exposure to known software flaws and ensure that newer safeguards are available.

Avoid downloading a WhatsApp installer from a link in a message. On Android, keep Google Play Protect enabled. Google says it checks apps from Google Play and other sources, can warn about harmful apps, and may block some unverified apps that request sensitive permissions commonly abused in financial fraud.

Turn on two-step verification

Two-step verification adds a PIN that WhatsApp can request when your number is registered again. Choose a PIN that is not your birthday, phone number, address, or a code reused elsewhere. If WhatsApp lets you add a recovery email, use an email account that you control and protect that account with its own strong sign-in method.

Never share the PIN with a caller, message sender, support agent, friend, or family member. A real person may be contacting you from a stolen account, so familiarity is not enough.

Use a passkey if it is offered

A passkey can reduce dependence on passwords or one-time codes by using your device's secure unlock method. Availability and exact behaviour can vary by device and region. If your app offers it, make sure the phone itself has a strong screen lock and that only your fingerprint or face is enrolled.

For a wider explanation, read how to use passkeys safely instead of passwords. A passkey helps with authentication, but it cannot stop you from voluntarily sending money or sharing information with an impostor.

Review linked devices

Look at the Linked Devices list and identify every browser, computer, tablet, or secondary device. Remove anything you do not recognise. If a device label is vague, consider when you last used WhatsApp Web or a desktop app and sign out if you remain unsure. You can link it again later from a trusted device.

Device linking deserves special attention. Meta's March 2026 anti-scam update describes scams in which a person is asked to share a linking code or scan a QR code. The action can attach the scammer's device to the victim's account. Never scan a WhatsApp QR code or enter a linking code unless you personally began the process on a device in front of you.

Tighten Privacy Without Cutting Off Real Contacts

WhatsApp's Privacy Checkup, where available, brings several controls together. Review who can see your profile photo, About information, status, last seen information, and online presence. Choose the smallest audience that still suits how you use the app.

Also review who can add you to groups. Restricting group additions can reduce surprise invitations, although it cannot prevent every unwanted contact. Meta's WhatsApp anti-scam guidance explains that WhatsApp may show a safety overview when an unknown person adds you to a group and can silence notifications until you decide whether to stay.

If Silence Unknown Callers is available, consider enabling it. Legitimate callers can still appear in your call list, while unexpected ringing becomes less disruptive. This is useful, but it is not a verdict on a caller. A saved contact can be compromised, and an unknown number can occasionally be genuine.

Set a screen lock for WhatsApp if your version offers one, and keep the phone's own lock active. This protects against someone who briefly has physical access to an unlocked device. Do not allow browsers or computers you do not control to remember your WhatsApp session.

Android users can review app access in the Privacy Dashboard. iPhone users can manage access to contacts, photos, camera, microphone, and location under Privacy & Security, as described in Apple's privacy controls. WhatsApp needs some permissions for features you choose to use, but unrelated apps should not receive sensitive access without a clear reason.

Check an Unknown Link Before You Touch It

A suspicious link often arrives with a story designed to hurry you. It may claim that a delivery failed, a bill is overdue, a prize expires soon, a bank account needs verification, or a job requires a small deposit. Another version pretends to be a relative who urgently needs money.

Do not use the message's urgency as evidence. Use this sequence instead:

1. Read the full message without opening the link or attachment.
2. Ask whether you expected the message and whether the request matches the sender's normal behaviour.
3. Inspect the visible domain carefully. Misspellings, extra words, unusual characters, and unrelated domains are warning signs.
4. Remember that a normal-looking address is not proof of safety. A legitimate site can be copied, and a compromised site can host harmful content.
5. Verify the request through a separate route. Use the official app, type the organisation's known address yourself, or call a number from an official statement or card.
6. If the sender is a person you know, call the saved number or ask a question only that person should answer.

WhatsApp can warn about some suspicious links, but no automated warning can catch every threat. Meta has explained that link checks can examine the structure of a web address without reading the message content, so a missing warning should never be treated as approval.

Do not install an Android APK, configuration profile, remote-support tool, screen-sharing app, or security certificate because a chat tells you to do so. A supposed refund, reward, account fix, or identity check should not require an unknown person to control your screen.

If you often receive payment messages, use the more detailed checks in how to protect yourself from online payment scams. The safest route is usually to leave the chat and open the bank, merchant, courier, or government service through its official app or a saved bookmark.

Protect Codes, Screens, and Payment Details

A WhatsApp registration code proves control of your phone number during account setup. It is not a customer-support code. Never forward it, type it into a form reached from a chat, or read it aloud to someone who called you.

Apply the same rule to banking one-time passwords, card PINs, UPI PINs, recovery codes, and device-linking codes. A genuine payment recipient does not need your UPI PIN to send you money. For India-specific payment safety, see how to protect UPI payments from scams.

Screen sharing can reveal more than the current app. Incoming notification previews may expose a code, balance, email, or private conversation. Meta's guidance for protecting older adults notes that WhatsApp warns before screen sharing with an unknown contact. Treat that warning seriously, but do not assume sharing with a known contact is automatically safe. Confirm the person first.

Be especially cautious with requests involving investments, paid tasks, gift cards, account unfreezing, parcel fees, refunds, or advance payments. Scammers may allow a small successful transaction first to build confidence. Judge the entire arrangement, not one early result.

Handle Unknown Groups, Attachments, and Media Safely

An unexpected group can contain a convincing logo, copied messages, and many apparent participants. Some participants may be controlled by the same operation. Do not treat group size, praise from other members, or screenshots of earnings as independent proof.

Review the safety information shown by WhatsApp, then leave, block, or report the group if it is unrelated to you. You do not need to reply to discover why you were added. A reply confirms that your number is active and creates another opening for persuasion.

Limit automatic media downloads if they clutter your phone or make it harder to notice what arrived. Before opening a document, consider whether the file type and context make sense. A PDF invoice from a known business is different from an executable app package sent by a stranger. Even familiar senders deserve verification when the message is out of character.

If you installed something after following a WhatsApp message, review it immediately. Android users can run Play Protect and examine sensitive permissions. Google's restricted settings guidance explains why Android limits certain powerful access for apps installed from less trusted sources. iPhone users should check for unfamiliar apps, device-management entries, calendar subscriptions, and permissions.

For a broader phone check, use how to check if your phone is hacked and how to find and remove spyware apps. Warning signs are not proof by themselves, so focus on verifiable changes such as a new app, unknown device session, altered permission, or unauthorised transaction.

What to Do If You Clicked a Suspicious Link

Clicking a link does not always mean the phone or account is compromised. What happened after the click matters. Stay calm and work from the facts.

If the page opened but you entered nothing, downloaded nothing, and approved no permission, close it. Clear the browser download list, check for unexpected files, update the browser and phone, and watch for unusual sign-in or payment alerts. Do not return to the page to investigate.

If you entered a password, change that password from a trusted device and sign out other sessions. Change any other account that reused the same password. If you shared a WhatsApp registration or linking code, review Linked Devices, remove unknown sessions, and secure the account immediately.

If an app was installed, disconnect it from sensitive access before removing it. Review accessibility access, notification access, device administration, screen sharing, VPN settings, and app permissions. Menu names vary, so use the phone maker's official support page for your model if needed.

If bank, card, or UPI details were exposed, contact the financial institution through its official number immediately. Freeze or restrict the affected payment method if the provider advises it. Do not wait for WhatsApp support or a police report before alerting the bank.

Recover a Targeted or Taken-Over Account

If messages are being sent from your account without permission, tell close contacts through another channel not to trust recent requests. Re-register your number in the official WhatsApp app and follow the recovery prompts shown there. If a two-step verification PIN blocks you, use only the recovery route offered inside the official app or Help Center.

Check your mobile service too. A sudden loss of calls and texts can indicate a SIM problem, although ordinary network faults are more common. Contact the mobile provider through its verified channel if service disappeared unexpectedly.

After access is restored, review linked devices, privacy settings, recovery email, phone permissions, and recent financial activity. Do not assume recovery removes every risk. A scammer may have copied contact details or conversation context and could approach your contacts from a different number.

Block, Report, and Preserve Useful Evidence

Use WhatsApp's block and report controls for suspicious contacts or groups. Reporting can send relevant recent information to WhatsApp for review according to the app's current process. Blocking stops direct messages from that account, but a scammer may return from another number.

Before deleting the chat, preserve useful evidence such as the phone number, profile name, time, link, payment reference, and screenshots of the request. Do not keep opening a harmful link to collect more evidence. Record only what is already visible and store it away from public social posts that could expose your own data.

In India, the National Cyber Crime Reporting Portal accepts cybercrime complaints and provides a facility for reporting suspicious WhatsApp numbers and web addresses. Its official portal directs victims of financial cyber fraud to call 1930 for immediate reporting. People outside India should use their bank's fraud channel and the official cybercrime or law-enforcement route for their country.

Fast reporting can help, but no service can promise recovery of money or an account. Ignore anyone who asks for an additional fee to recover stolen funds, especially if they contact you after a public complaint.

Create a Family Verification Plan

Many scams succeed because the request appears to come from someone loved or trusted. Agree on a simple family rule before an emergency happens. Any unusual request for money, a code, or a new phone number must be verified by a call to a saved number or another known person.

A family phrase can add another check, but do not treat it as a permanent secret if it has been shared widely. The stronger habit is independent confirmation. Help older relatives review linked devices and privacy settings, and show them that declining an urgent request is not rude.

For children and teenagers, focus on actions rather than frightening examples. They should know not to share codes, personal documents, live location, or payment details with an online contact. Make it easy for them to ask for help without fear of punishment.

A Monthly WhatsApp Safety Routine

Security works better as a short routine than as a one-time cleanup. Once a month, or after travel, phone repair, or device replacement, check the following:

• WhatsApp and the phone are updated from official stores.
• Two-step verification remains enabled and the recovery email is yours.
• Every linked device is recognised and still needed.
• Privacy and group controls match how you currently use the app.
• The phone has a strong screen lock and no unknown fingerprints or faces.
• Sensitive permissions belong only to apps that need them.
• No unfamiliar remote-access, screen-sharing, or device-management tool is present.
• Important contacts know how you will verify emergency money requests.

Also review encrypted chat-backup options if you use backups. A backup can help after device loss, but its password or recovery key needs careful storage. If you lose the only recovery secret, the provider may not be able to restore the backup. Follow the instructions shown in your current WhatsApp version rather than relying on an old screenshot.

The most durable defence is a repeatable decision: stop, verify outside the chat, and act only through an official route. Settings make that decision easier, but your willingness to pause is what prevents a convincing message from becoming an expensive mistake.