A friend asked for the code she'd just received. It wasn't her friend.

Ayesha was cooking when her phone buzzed. The message was from Rabia — her cousin, her contact for years, the same photo, the same name.

"بھائی، غلطی سے آپ کو کوڈ چلا گیا ہے، بھیج دیں پلیز۔" "Sorry, a code went to you by mistake — please send it to me."

A moment earlier, a 6-digit code had indeed arrived on Ayesha's phone. It looked like an ordinary mix-up.

She sent it back.

Within a minute, WhatsApp logged her out. Her account was gone.

By evening, twelve of her contacts had received a message from "Ayesha" asking to borrow money urgently. Two of them sent it.

---

Ayesha and Rabia are not real people. This story is put together from scam reports that repeat across Pakistan every week. The pattern is real.

What actually happened here?

Your WhatsApp account belongs to your phone number, not to your phone.

To move that account onto a new phone, WhatsApp texts a verification code to your number. That is the 6-digit number WhatsApp sends when an account is being set up. It is the only lock on the door.

So the scammer does this:

1. He installs WhatsApp on his own phone and types in your number.
2. WhatsApp texts the code to your phone, because it is your number.
3. He messages you, pretending to be someone you trust, and asks for it.
4. You send it. He types it in. Your account is now on his phone.

He never breaks anything. He simply asks you for the key, and people hand it over because a friend appeared to be asking.

Why did the message come from a real friend?

Because your friend lost their account first.

The scam spreads in a chain. Once someone takes over Rabia's WhatsApp, they write to her contacts from her own account. Same photo. Same name. To you, nothing looks wrong. The account genuinely is hers. The person typing is a stranger.

This is why replying in the chat proves nothing. The only safe check is a phone call to the number you already have.

What is the one rule?

Never send your WhatsApp verification code to anyone.

Not to a cousin. Not to a friend. Not to someone claiming to be from WhatsApp support, a mobile shop, or a helpline.

There is no honest situation where another person needs that code. WhatsApp does not send codes by mistake. It sends them only to the number being registered. So if the code reached your phone, someone is trying to register your account.

How do you lock the door properly?

Turn on two-step verification. It takes about a minute and it stops this scam even if you slip.

1. Open WhatsApp and go to Settings.
2. Tap Account, then Two-step verification.
3. Tap Turn on and choose a 6-digit PIN you can remember.
4. Add your email address, so you can reset the PIN if you forget it.

Now, even if a scammer gets the code from your SMS, he still cannot take your account without your PIN. Do this for your parents' phones too, while you are sitting with them.

What if your account is already stolen?

Act quickly. Getting back in is usually simple.

1. Open WhatsApp on your phone and register your number again.
2. Enter the fresh 6-digit code that arrives. This logs the scammer out immediately.
3. Turn on two-step verification straight away, before anything else.
4. Message your contacts from any account you still have, and tell them plainly: my WhatsApp was stolen, do not send money to anyone using my name.
5. Report it to your country's cybercrime authority, and keep screenshots of the messages sent in your name.

The stolen account is only half the damage. The other half is the friend who quietly sends money because they thought it was you. Warning people fast is the part that actually protects them.