The 6-digit code is WhatsApp’s proof that you control a phone number. You will meet it when you install WhatsApp, switch phones, or re-register, and you may occasionally receive one you never asked for. That last case confuses and worries people the most, and it is also where the scams live.
This guide explains exactly what the code does, every reason one shows up, what to do when it refuses to arrive, and the one rule that keeps your account safe: the code is a key, and you never give your key to anyone.
What the 6-digit code actually is
When you register a number, WhatsApp sends a one-time 6-digit code to that number by SMS (or reads it out via the "Call me" option). Typing it into the app proves you control the number, and WhatsApp activates the account on that device.
That is the entire security model of WhatsApp registration: whoever types the current code controls the account. There is no username or password behind it, which is exactly why the code must never be shared, and why the optional two-step PIN exists as a second lock.
Got a code you never requested?
A code arriving out of nowhere means someone entered your phone number into WhatsApp’s registration screen. Common causes, from harmless to hostile:
- A typo: someone mistyped their own number and yours received the code. Nothing happens; without the code they can do nothing.
- A recycled-number mixup: the previous owner of your number (or someone with an old contact entry) tried to register it.
- A takeover attempt: someone specifically wants your account and is about to contact you with a story about why you should forward them the code.
As long as the code stays with you, nothing can happen to your account. You do not need to reply, click anything, or tell WhatsApp. Delete the SMS and move on. Only if codes keep arriving repeatedly should you treat it as targeting and make sure two-step verification is on.
The "friend in trouble" scam
The most common WhatsApp account theft works like this: an attacker who already controls a friend’s account (or spoofs their identity) messages you: "Sorry, I accidentally sent my code to your number, can you forward it?" At the same moment, a real WhatsApp code arrives on your phone, because the attacker just entered your number into a registration screen.
The code is for your account, not theirs. Forward it and you have handed over your WhatsApp: the attacker registers your number on their device, you get logged out, and the same message goes out to your contacts next.
WhatsApp will never message or call you asking for the code, and no legitimate person ever needs a code that arrived on your phone. There are no exceptions.
When the code never arrives
- 1
Check the number you typed
The single most common cause: a wrong digit or wrong country code. The code went somewhere, just not to you.
- 2
Wait out the timer
WhatsApp enforces a countdown before you can retry. Requesting again and again does not speed anything up; it extends the lockout.
- 3
Check signal and SMS delivery
The code comes as a regular SMS. Airplane mode, no coverage, a full SMS inbox, or an aggressive spam filter on the phone or carrier side will eat it.
- 4
Use the call option
Once the SMS timer expires, choose "Call me". An automated call reads the 6 digits out loud. This also rescues landlines and numbers whose carriers mishandle application SMS.
- 5
Avoid third-party SMS apps and blockers
SMS-blocking or spam-filter apps sometimes silently quarantine WhatsApp’s messages. Disable them for the retry.
The 6-digit code vs your two-step verification PIN
WhatsApp has two different 6-digit secrets, and mixing them up causes real lockouts:
- The verification code arrives by SMS or call each time a number is registered. WhatsApp generates it; you never choose it.
- The two-step verification PIN is a code you choose once in Settings, Account, Two-step verification. After any successful SMS verification, WhatsApp additionally asks for this PIN before the account opens.
Turn the PIN on. It is the only thing that stops someone who briefly controls your SMS (a SIM swap, a shared inbox, a stolen phone) from walking straight into your account. Add a recovery email so a forgotten PIN does not lock you out; without it, resetting the PIN takes a multi-day wait.
If someone already took over your account
- 1
Re-register immediately
Install WhatsApp on your phone, enter your number, and complete SMS verification. Registering the number on your device logs the attacker out everywhere: only one device owns a number at a time.
- 2
Expect the PIN screen
If the attacker enabled two-step verification to lock you out, you can still re-register with SMS but must wait out WhatsApp’s reset period (up to 7 days) unless a recovery email was set. This is why setting your own PIN first matters.
- 3
Warn your contacts
The attacker most likely messaged your contacts asking for codes or money. A quick heads-up breaks the chain.
- 4
Review linked devices
After recovery, check Settings, Linked Devices, and log out anything you do not recognize.
Related: WhatsApp QR codes and linked devices