WhatsApp Accounts Are Being Hijacked Across Pakistan — How to Protect Your Business

Pakistan’s national cyber emergency team has issued a nationwide warning: WhatsApp accounts are being hijacked at a sharply rising rate, and business accounts are among the main targets. The good news is that these attacks do not break WhatsApp itself — they trick people. And a trick can be stopped, once you know how it works.

This guide explains what is actually happening, how the hijackers operate, and the exact steps that protect your account — whether you use WhatsApp for family chats or to run your business.

What is happening right now

Pakistan’s National Cyber Emergency Response Team (National CERT) has warned of a sharp increase in WhatsApp account hijackings across the country, describing the attacks as active, widespread, and high in severity. People of all ages and regions are being targeted.

Separately, the National Cyber Crime Investigation Agency (NCCIA) has warned that WhatsApp Business accounts in particular are being hacked on a large scale. Its Karachi zone reported recovering 39 social media accounts belonging to citizens within 15 days, and blocking 95 accounts involved in causing financial losses to people — across WhatsApp, Instagram, and other platforms.

Even officials are not spared: a PTA official’s WhatsApp account was recently hacked, and two suspects were arrested near Islamabad’s Red Zone within four hours of the incident. The message is simple — if it can happen to them, it can happen to anyone. But it can also be prevented.

How WhatsApp hijacking actually works

This is the most important part to understand: the attackers are generally not breaking into WhatsApp’s software. They use social engineering — tricks that persuade the account owner to hand over access. That is why almost every successful hijacking needs one mistake from the victim, such as sharing a code or scanning a QR code.

Here are the tricks being used right now:

1. The verification code trick

You receive a message from someone pretending to be a friend, a colleague, or even WhatsApp support, asking you to share a code that was just sent to your phone. That code is actually your WhatsApp login code. The moment you share it, the attacker can register your number on their own phone — and you get locked out.

2. Call-forwarding manipulation

Attackers persuade victims to dial a code or change a setting that forwards their calls. The verification call or SMS meant for you then reaches the attacker instead.

3. Phishing links

A message promises a prize, a job, a parcel update, or an urgent security warning, with a link. The link opens a fake page designed to steal your details or install something harmful.

4. Malicious QR codes

You are asked to scan a QR code — for a prize, a survey, or “verification”. That code actually links your WhatsApp account to the attacker’s device through the Linked Devices feature. From then on, they can read and send messages as you.

5. Fake official files on WhatsApp Web

In a separate high-risk advisory, National CERT warned of targeted attacks through WhatsApp Web, desktop apps, and email — especially against government officials and people handling sensitive information. Attackers impersonate officials or departments and send files disguised as official documents. Opening them can give attackers remote access to a Windows computer, steal passwords, and hijack the active WhatsApp Web session.

What happens after an account is stolen

A hijacked account is valuable because your contacts trust you. Attackers typically:

• Impersonate you and ask your contacts for money, urgently.
• Read private conversations and collect personal or business information.
• Spread harmful links or content to your contacts, which can damage your reputation.
• For business accounts, expose customer conversations and business data, and use your business name to scam your customers.

The damage can include identity theft, financial fraud, data exposure, and serious reputational harm — which is exactly why business accounts are such attractive targets.

The solution: how to protect your account

Work through this checklist once, and your account becomes very hard to steal:

1. Turn on two-step verification (do this first)

This is the single most effective protection. Open WhatsApp, go to Settings, then Account, then Two-step verification, and turn it on. Choose a six-digit PIN you will remember, and add a recovery email address. From then on, even if someone gets your login code, they still cannot take over your account without your PIN.

2. Never share a code or PIN with anyone

WhatsApp will never ask you for your verification code or your two-step PIN — not by message, call, or email. Anyone asking for a code, for any reason, is trying to steal your account. No exceptions, even if the message appears to come from a friend: their account may already be stolen.

3. Check your linked devices regularly

Open Settings, then Linked Devices, and look at every device connected to your account. If you see a device you do not recognise, remove it immediately. Do this check once a week — it takes less than a minute.

4. Never scan a QR code from a stranger

Only scan a WhatsApp QR code when you are linking your own computer yourself, on a device you trust. A QR code sent in a random message is one of the fastest ways to lose your account.

5. Treat unexpected files and links as guilty until proven innocent

Do not open an unexpected link, document, or file — even if it appears to come from someone you know, because a stolen account sends messages that look genuine. If a message feels unusual, verify it through a second channel first: call the person on their real number and ask.

6. Be careful with WhatsApp Web and desktop

Avoid using WhatsApp Web or desktop on shared computers, and be extra careful on office Windows PCs if you handle sensitive information. Always log out when you finish, and end any session you do not recognise straight away.

7. Keep everything updated

Keep WhatsApp and your phone’s software updated. Updates close security gaps that attackers rely on.

8. Double-check urgent money requests

If any contact suddenly asks for money urgently, stop and verify through a separate channel before sending anything — even if the message sounds exactly like them.

Extra protection for business accounts

• Use a separate phone number for your business account, not your personal number.
• Limit account access to as few trusted people as possible, and make sure every one of them has two-step verification turned on.
• Train your team on the tricks above — one careless click by one employee can compromise the whole business account.
• Keep a secure backup of important business chats, so a hijacking never means losing your business records.

If your account is already stolen, do this

• Take it back: delete WhatsApp, reinstall it, and verify your phone number again. This logs the attacker out.
• If you face a lockout: when attackers turn on two-step verification themselves, you may face a waiting period of up to seven days before you can re-verify. If you had set a recovery email, use it to reset the PIN faster.
• Warn your contacts immediately, from another number or channel, that your account was stolen and that any money requests from it are fake.
• Check linked devices and remove anything unfamiliar.
• Report it: report the incident to the NCCIA and through WhatsApp’s in-app reporting, and keep the suspicious messages as evidence. Do not reopen suspicious files while doing this.

Common questions

Is WhatsApp itself hacked? No. The app is not being broken into — attackers trick users into giving away access. That is why awareness and two-step verification stop most attacks.

Does two-step verification guarantee safety? Nothing is absolute, but it is the strongest single defence. Combined with never sharing codes and checking linked devices, it blocks the attacks described above.

Are business accounts more at risk than personal ones? The tricks are the same, but the damage is bigger: attackers gain your customers’ trust and your business data. That is why the NCCIA warning singles out business accounts.

I already shared a code — what now? Act fast: turn on two-step verification immediately, check linked devices and remove anything unknown, warn your contacts, and watch for unusual activity.

Sources

National CERT’s nationwide advisory on the surge in WhatsApp hijackings; NCCIA’s warning on large-scale hacking of WhatsApp Business accounts; and National CERT’s high-risk advisory on WhatsApp Web and desktop attacks. Read more: NCCIA warns of widespread hacking of WhatsApp Business accounts, Pakistan warns users of rising WhatsApp account hijacking attacks, National CERT warns officials of WhatsApp Web malware attack.