WhatsApp Just Made Account Takeovers Much Harder
On 25 August 2026, WhatsApp rolled out its biggest account-security update in a while: longer, stronger passwords for two-step verification, support for multiple passkeys per account, and new caller-context warnings on Android. Here’s the short version.
Six-digit PINs are out, real passwords are in
The old two-step verification PIN was just six digits, easy to guess or reuse. WhatsApp now lets users set a longer alphanumeric password with special characters instead. It won’t stop someone tricking you into handing over a one-time code, but it adds a second wall an attacker still has to get through even if they do.
One account, multiple passkeys
Users who switch between an Android phone and an iPhone, or between work and personal devices, can now register more than one passkey to the same account (Settings > Account > Passkeys). Passkeys use device-based biometrics or a screen lock instead of a typed password, and because there’s no shared secret to steal, they’re inherently more phishing-resistant. Meta says over 1 billion people have already set one up.
Android will flag unfamiliar callers
On Android, incoming calls from numbers outside your contacts will now show extra context, like whether the number appears to be from another country or shares any groups with you. It won’t prove a caller is a scammer, but it gives people a beat to pause before trusting an “urgent” call from a stranger.
What to actually do
- Set a real password – move off the six-digit PIN and use a long, unique password (a password manager helps).
- Add a passkey on every device you use – reduces reliance on codes that can be phished or SIM-swapped.
- Never share a verification code – no legitimate support agent, friend, or organisation needs it from you.
- Review linked devices regularly and don’t approve QR/device-linking requests you didn’t initiate yourself.
None of these controls work as a standalone fix, stronger passwords, passkeys, and caller context each cover a different part of the attack surface. Used together, they make the common WhatsApp takeover playbook a lot harder to pull off.
