Overview
- Early October reporting and security alerts from multiple outlets and Spain’s INCIBE show a rising pattern of account hijackings that use unsolicited calls, SMS or voicemail to deliver verification codes.
- Attackers obtain the single‑use code WhatsApp sends for sign‑in by prompting a call or SMS and then intercepting the code left in voicemail or read aloud, often relying on default or weak voicemail PINs such as 0000 or 1234.
- Users should enable WhatsApp’s two‑step verification, never share verification codes, set a strong PIN or password for the two‑step feature, and regularly review linked devices to close unknown sessions.
- Mobile carriers are being urged to let customers change or disable remote voicemail PINs and to help if a number is compromised, while WhatsApp Support provides a recovery form for accounts already taken over.
- The trend highlights how social engineering and phishing complement technical interception, so combining app settings with cautious behavior lowers risk and reduces chances of fraud and identity abuse.