If your business runs on WhatsApp, and most Nigerian SMEs genuinely do, the account itself is a business asset with real value to protect. When it gets taken over, the damage isn't abstract: the attacker messages your actual customers, in your actual name, with your actual chat history as cover, asking them to pay into a different account "for a faster process." Customers who trust you have no reason to suspect anything until the money's gone.
Here's how these takeovers actually happen, the one setting that stops most of them, and what to do if you're already too late.
How a WhatsApp account actually gets hijacked
The most common route isn't a sophisticated hack. It's social engineering combined with one specific weakness:
Your WhatsApp account can be re-registered on any device using nothing more than your phone number and a one-time 6-digit code sent by SMS. If someone else gets that code, and they only need you to hand it over once, they can move your entire account, including your chat history, onto their own device.
The two most common ways attackers get that code:
- Direct social engineering. A message impersonating WhatsApp support, a delivery service, or even a known contact, asking you to "verify" by sharing a code that was just sent to your phone. WhatsApp will never legitimately ask you for this code. Any message requesting it is the attack itself, not a step toward resolving something.
- SIM swap fraud. An attacker convinces (or bribes) a telecom agent to transfer your phone number to a SIM they control, then requests the WhatsApp verification code, which now arrives on their device instead of yours.
The one setting that stops most of this
Two-Step Verification is a WhatsApp setting, found under Settings → Account → Two-Step Verification, that adds a separate 6-digit PIN required before your number can be re-registered on any device. Without it, your SMS verification code alone is enough for someone to move your account. With it, an attacker who has your SMS code still can't get in without the PIN, which they were never sent.
Most WhatsApp Business accounts that get hijacked in Nigeria weren't hacked in a technical sense. They were handed over, one shared code at a time, to someone who sounded convincing.
This single setting is the most effective thing a business can do to prevent takeover, and it takes under two minutes to set up. If you manage a shared WhatsApp Business account across multiple staff, make sure whoever set it up documented the PIN somewhere the business can retrieve it, not just in one person's head.
Other practical protections worth having in place
- Never share a verification code, from any platform, with anyone who contacts you first. Legitimate verification only happens when you've personally initiated the login or registration.
- Use WhatsApp Business on a device with its own lock screen protection, and be deliberate about who has physical access to it.
- If you use WhatsApp Web or Linked Devices, review the list periodically and remove sessions you don't recognise.
- Watch for unusual SIM behaviour, like your phone suddenly losing network without an obvious cause, which can be an early sign of a SIM swap attempt in progress.
If your account is already hijacked: the first hour matters
- Try to reclaim it immediately. Reinstalling WhatsApp and re-verifying with your phone number logs out whoever is currently using it, but only if they haven't already set a Two-Step Verification PIN of their own.
- If they've set their own PIN, you're locked into a mandatory 7-day wait before WhatsApp allows account recovery without it. This is a deliberate security measure, not a bug, and there's no legitimate way to bypass it faster.
- Secure the accounts connected to your identity right away, particularly your email, since email access is often used to help verify account recovery, and change that password immediately.
- Warn your customers and contacts through a different channel (a phone call, an SMS, a post on your business's other social media) that your WhatsApp has been compromised and any payment or account-change requests from it should be ignored until further notice. This step is the one businesses most often skip, and it's the one that actually protects your customers from being scammed while you're locked out.
- Contact your mobile network provider if you suspect a SIM swap specifically, since that's a separate problem from the WhatsApp account itself and needs its own resolution.
Can I use Two-Step Verification if multiple staff share access to the same WhatsApp Business account?
Yes, and you should. Just make sure the PIN is documented somewhere the business can access it if the person who set it up is unavailable, rather than known only to one individual.
What's the fastest way to tell customers my WhatsApp has been compromised?
Whatever channel isn't WhatsApp: a phone call to your most active recent customers, a post on Instagram or Facebook, or an SMS blast if you have contact numbers on file. Speed matters more than polish here.
Is Two-Step Verification the same as WhatsApp's end-to-end encryption?
No, they're unrelated. Encryption protects the content of your messages in transit. Two-Step Verification protects who is allowed to register your phone number as a WhatsApp account in the first place.
Treating your WhatsApp account like the business asset it is
For a lot of Nigerian businesses, WhatsApp isn't a side channel, it's the primary storefront and the primary support line. Securing it deserves the same attention as securing a bank account, not an afterthought squeezed in after everything else. Awal Global Consults advises businesses on practical digital safety measures like this as part of broader cybersecurity guidance, precisely because these client-facing channels are where real financial damage happens fastest.
Need help with this?
Awal Global Consults advises on practical digital safety measures for Nigerian businesses, including account security reviews for WhatsApp and other client-facing channels.