Protecting your WhatsApp account (and not losing it with your phone)
WhatsApp is tied to your number, but it has an extra layer that doesn't depend only on your phone: a two-step verification PIN with a backup email. If you never turned it on, you don't have that layer.
Short version: anyone who gets your number (say, through a fraudulent SIM swap) can try to register WhatsApp on another phone. The two-step verification PIN stops them, but only if you turned it on beforehand. This isn't about migrating WhatsApp yourself when you switch phones — that guide is in "Switching phones."
Why this account is critical
WhatsApp stores personal conversations, work conversations and, for a lot of people, the channel with their bank or with customers if they run a business account. Because it's tied to your phone number, any failure in controlling that number (see your carrier and SIM swapping) carries straight over to WhatsApp.
There's a widespread and mistaken idea: that if someone "only" gets your number, the worst that can happen is they receive your bank's SMS codes. But that same number can also be used to try to register your WhatsApp on another phone, with potential access to your groups, your contacts and, if you use cloud backups that aren't end-to-end encrypted, part of your chat history.
This isn't the migration of WhatsApp when you switch phones yourself, with your own consent and your own number in hand: that step-by-step guide is under switching phones. Here we're talking about the scenario where someone else tries to take over your account without you asking for it.
What WhatsApp asks for from a new phone
When registering your number on a new phone, WhatsApp sends a verification code by SMS or call, separate from the two-step verification PIN. If you have the PIN turned on, besides that code you'll also need to enter your six-digit PIN to complete registration. It's precisely that second piece that stops someone who has only gotten your number, but not your PIN.
WhatsApp is also rolling out passkey sign-in: from Settings > Account > Passkeys you can turn it on and confirm your identity with your fingerprint, face or phone lock, without typing a password. This feature arrived on Android first and later expanded to iOS. Passkeys protect sign-in on the device where you activate them; they don't replace the two-step verification PIN, which is still the piece that matters when someone tries to register your number on a new device.
What recovery paths it offers
The two-step verification PIN supports an optional email. If you set one and forget your PIN, you can request a reset link to that email from "Forgot PIN?" If you didn't set an email, or no longer have access to it, WhatsApp forces a wait: the PIN can only be reset after 7 days from the last time the account successfully connected. If the account goes 30 days without verifying again on any device, WhatsApp deletes it automatically.
That 7-day window isn't arbitrary: it exists precisely so that, if someone steals your number and tries to force the PIN without having the email, they can't do it right away. For you, if you're the one who's legitimately lost access, it means the same thing in reverse: without a backup email, you'll have to wait just as an attacker would. And the 30-day automatic deletion window for inactivity runs in parallel: if it takes you longer than a month to re-verify your number on any device, you don't just temporarily lose the PIN, you can lose the whole account.
What to check today
- Do you have two-step verification turned on?
- Does that PIN have a backup email attached, and do you have access to that inbox right now?
- Do you know what would happen to your WhatsApp if someone got a replacement of your SIM?
- Have you turned on passkeys if your version of WhatsApp already offers them?
- Do you use WhatsApp Business, with a customer-service channel that depends on this same number?
If your phone has already been stolen
The first and fastest step: ask your carrier to block the line (see your carrier). Cutting off service to that SIM also cuts off the most direct way for someone to reactivate WhatsApp with your number on another device. After that, check WhatsApp's official help for the specific stolen-or-lost-device situation.
While you sort that out, warn your closest contacts through another channel (email, another app, a call) that your phone is compromised, especially if you use WhatsApp to handle payments, business or anything sensitive: it's a simple step that cuts off at the root the most common trick used by whoever steals a number, which is pretending to be you to your own contacts before you have time to react.
If you get the number back later, with a replacement SIM, and someone has been using WhatsApp with it in the meantime, registering your number again on your own phone automatically closes the session of any other device where it was active: WhatsApp only allows one "primary" session per number at a time.
Official sources: INCIBE (Spain's national cybersecurity institute): WhatsApp's two-step verification