keeping your whatsapp account safe

I had not realised whatsapp was being hacked (other than this!), but yesterday I got a message from someone asking me what they should do about it. I read up as much as I could, and responded, but it’s probably worth adding to this blog also.

So here’s what you should do:

Unless you are actually expecting an OTP for something, ignore and delete all messages with OTPs in them.
If someone you know sends you a message saying “Oops, I sent the OTP to you by mistake, can you forward it to me?”
- do not forward the OTP
- delete that message also
- contact that person using normal phone or SMS (not whatsapp) and inform him/her that their whatsapp has been hacked
- if you have any mutual friends or acquaintances, warn all of them also that so-and-so has been hacked, and to ignore any requests for OTP, or money, or whatever, from them
In general, avoid clicking any links you get from whatsapp (but this is true for anything you are not expecting)

OK that’s simple enough. But you could go further, and setup “Two-step verification” in whatsapp. Here’s how:

Open whatsapp, click the “three dots” then “Settings”
Click “Account”, then “Two-step verification”
Click the green “Turn on” button, and type in a 6-digit PIN
Type it again to confirm, then click “Save”.
(Optional) If you think you might not be able to remember your PIN in future, add an email.

WARNING: You will need this PIN if you ever have to re-register your phone with whatsapp. For example, if you change your phone, and you don’t remember this PIN, you can’t use whatsapp. (I think whatsapp occasionally asks you to type it in, just to make sure you remember it!)

PS: Just to be clear, this PIN is different from the OTP that you get when you register a new phone. The OTP is generated by whatsapp and sent to you by SMS, while this PIN is something you pick and remember.