WhatsApp hijack: one message, and the account is gone
A friend's WhatsApp was hijacked. Now a message from their picture and name is asking you to forward an OTP. Don't.
One night, my cousin Ayesha messaged me on WhatsApp:
"Aapi, an OTP came to your number by mistake. Please forward it — I can't log in."
The picture was Ayesha's. The name was Ayesha's. The way she typed was hers.
Instead of forwarding the OTP, I sent a voice note: "Did you really ask me for this?"
No reply. Ten minutes later, Ayesha posted on Instagram: "My WhatsApp has been hijacked — don't trust any messages from me right now."
How it works
The scammer first hijacks one person's WhatsApp (often using exactly this technique). Then they message everyone in that person's contact list. When a message comes from a friend, your guard is down.
The scammer needs only your OTP — that's it. Once they have it, your account is theirs, and the same message goes out to your contacts.
One rule: never forward an OTP
Your OTP is yours. It is generated for you alone. Don't share it with anyone — your mother, your father, your sister, your best friend, or "the bank." No one.
If someone is asking for it, do not send it.
Turn on Two-Step Verification today
Two-Step Verification is an extra PIN that WhatsApp asks for before logging in. Even if a scammer has your OTP, they still cannot get in without this PIN.
How to enable it:
- Open WhatsApp
- Settings → Account → Two-step verification
- Turn On
- Set a 6-digit PIN you'll remember
- Add your email address as backup
It takes two minutes. It puts a lock on your account that the scammer cannot pick.
Has this happened to you or someone in your family?
Share your story anonymously. We'll publish only the lesson — never your name. It could save someone else's parents.