WhatsApp Adds Security Measures to Help Prevent Accounts From Being Hacked

WhatsApp, the world’s most widely used messaging app, has rolled out a fortified two‑step verification system and now permits users to register multiple passkeys, directly confronting the surge of account hijacking attempts that have plagued mobile communications.

Stronger Two‑Step Verification

The updated two‑step verification adds a mandatory PIN that must be entered after the standard SMS code, creating a second barrier that attackers cannot bypass with just a compromised phone number. WhatsApp’s “stronger two‑step verification” also stores the PIN locally on the device, reducing exposure to server‑side breaches. This design forces any adversary to obtain both the user’s SIM and the device itself, a significantly higher hurdle.

From a technical standpoint, the PIN is hashed with a salt unique to each installation, meaning even if the hashed data were exfiltrated, reversing it would be computationally infeasible. The approach mirrors best practices in credential hardening, where layered secrets diminish the attack surface without imposing excessive friction on legitimate users.

Support for Multiple Passkeys

WhatsApp now allows a single account to link more than one passkey, aligning with emerging standards that treat passkeys as first‑class authentication objects rather than single‑use tokens. Passkeys, derived from public‑key cryptography, eliminate reliance on passwords and are resistant to phishing because the private key never leaves the device.

By enabling multiple passkeys, users can register a primary device and a backup (e.g., a tablet or secondary phone) without sacrificing security. This redundancy mitigates the “single point of failure” problem that historically forced users to revert to weaker recovery methods like email or SMS codes.

Broader Implications for the Messaging Ecosystem

The introduction of these measures signals a shift among mass‑market messaging platforms toward privacy‑by‑design authentication. Competitors that continue to rely solely on SMS‑based verification risk losing users who are increasingly aware of SIM‑swap attacks. WhatsApp’s move also pressures regulatory bodies to consider stricter authentication standards for communication services.

From a threat‑model perspective, the combination of a device‑bound PIN and multi‑passkey support raises the cost of compromise for both opportunistic hackers and state‑level actors. While no system can guarantee absolute safety, raising the effort required to hijack an account can deter many low‑skill attacks that constitute the bulk of reported incidents.

What This Actually Means For You

1. Enable the new two‑step verification to add a device‑specific PIN, drastically reducing the chance of unauthorized access.
2. Register at least one passkey on a secondary device to ensure account recovery without falling back to insecure SMS or email links.
3. Review existing recovery contacts; remove outdated email addresses or phone numbers that could be exploited.
4. Stay informed about WhatsApp’s future security updates, as the platform is likely to iterate on authentication mechanisms.
5. Consider the broader security posture of your digital identity; stronger messaging authentication should be complemented by robust passwords elsewhere.

Immediate Action Steps

Open WhatsApp Settings → Account → Two‑step verification, then follow the prompts to create a six‑digit PIN and optionally add an email address for PIN recovery. After the PIN is set, navigate to Settings → Account → Security and tap “Add Passkey” to link a biometric‑protected key on your primary device, then repeat on any backup device.

Confirm the changes by logging out and back in on each device; the app will request the new PIN and validate the passkey, confirming that the protections are active. Finally, audit the list of linked devices in Settings → Account → Security to remove any that you no longer use.

Frequently Asked Questions

How does WhatsApp’s two‑step verification differ from the old SMS code?

The new system adds a locally stored PIN that must be entered after the SMS code, creating a second secret that attackers cannot obtain through SIM‑swap alone.

Can I use a passkey on an Android device that doesn’t support biometrics?

Yes; WhatsApp’s passkey implementation works with any device that can store a cryptographic key, though biometric protection adds an extra layer of convenience and security.

What happens if I lose access to all devices with registered passkeys?

You can recover your account using the email address you supplied during two‑step verification setup, but you should avoid relying on email recovery as a primary method.

What Do You Think?

Does the added friction of a PIN and multiple passkeys outweigh the convenience of instant messaging for you, or is the trade‑off a necessary evolution in protecting personal communications?