The Fake WhatsApp Verification Code Request
Attackers try to take over WhatsApp accounts by tricking the owner into sharing their own SMS verification code. This walkthrough is a fictional, illustrative example built for training.
The scenario
The victim receives an SMS from WhatsApp itself containing a real 6-digit verification code, along with the standard warning: 'Don't share this code with anyone.' This part is genuine, triggered because someone has just tried to register the victim's phone number on WhatsApp from another device.
Minutes later, a message arrives on WhatsApp from what looks like a known contact, or someone posing as an HR or IT staff member, saying something like: 'Hi, sorry to bother you, I sent you a verification code by mistake, can you forward it to me? I need it urgently for a work account.'
The tone is casual and low-pressure, often addressing the victim by name and referencing a plausible shared context such as a company WhatsApp broadcast group or a colleague's supposed new phone setup, which lowers the victim's guard compared to an obviously suspicious message.
If the victim replies with the code, the attacker completes registration of the victim's phone number on their own device, instantly logging the victim out of WhatsApp and gaining full access to the account, including contacts and any linked groups, which is then used to scam the victim's friends, family, or coworkers.
Red flags to spot
Someone asks you to forward a WhatsApp verification code
This code exists solely to confirm you are registering your own number on your own device. There is never a legitimate reason for another person to need the code you received.
You receive an unexpected WhatsApp verification SMS you did not request
This means someone else has already entered your phone number into WhatsApp on their device and is attempting to complete the takeover using your code.
The request comes with a plausible but unverifiable excuse
Stories like 'sent to you by mistake' or 'I need it for a company account' are designed to sound reasonable enough that you do not stop to question why a verification code, which is tied to your number specifically, would ever be needed by someone else.
Urgency layered with familiarity
Attackers often compromise one contact's account first, then use it to message that person's real contacts, which makes the request feel like it is coming from someone you trust.
Request happens over chat rather than a verified in-person or phone conversation
A genuine, unusual request like this warrants a direct phone call to confirm identity, not a reply within the same chat thread where the request originated.
The lesson
Never share a WhatsApp verification code with anyone for any reason, even someone claiming to be a coworker, HR, or IT support. If you receive a verification SMS you did not request, someone is attempting to take over your account, so ignore any request to share it and consider enabling two-step verification (a separate PIN) in WhatsApp settings for extra protection. If a contact asks you for a code, assume their account may be compromised and verify with them through a separate channel, such as a phone call, before doing anything.
These are illustrative examples built for training purposes only, not real messages sent by Claro or any actual organization.
Frequently asked questions
No, the SMS with the code comes genuinely from WhatsApp. The scam is entirely in the follow-up message asking you to share that real code with someone else.
Related pages
Malicious QR Code (Quishing)
A QR code stuck over a parking meter or printed on a fake payment notice leads to a lookalike page that harvests login or card details.
Learn moreThe QRIS 'Refund' Payment Scam
A seller or 'support agent' sends you a QRIS code and tells you to scan it to receive a refund or claim money, but scanning a QRIS code always sends money out, never in.
Learn moreFake Bank Customer Service on Social Media
You complain about your bank on X or Instagram, and a lookalike 'customer service' account replies offering to help, then asks for your card number, PIN, or OTP to 'resolve' the issue.
Learn moreRun these patterns as real simulations
Claro turns each of these lures into a localized, trackable phishing simulation your team can learn from safely.
Request a demo