A 32-year-old in Pune receives a WhatsApp message from a “friend” she hasn't spoken to in months: “I sent you a 6-digit code by mistake — please forward it to me, urgent.” She forwards it. Two minutes later her WhatsApp logs out — taken over by a scammer who immediately messages her contacts asking for ₹3,000-₹15,000 emergency loans. By the time her brother calls her landline, ₹47,000 has flowed out of her family's WhatsApp circle. In 2026, WhatsApp OTP fraud is the most prolific Indian cybercrime — the 6-digit registration code is the literal key to your account. This page is the operational prevention + recovery playbook.
Citizen Crisis Response Network — first 30-minute checklist
NEVER share the WhatsApp 6-digit code with anyone → if shared, immediately re-register your number on WhatsApp (forces logout of attacker) → enable two-step verification (Settings → Account → Two-step verification) → dial 1930 + email wa.me/grievance_officer@whatsapp.com under IT Rules 2021 Rule 3(2) → message ALL contacts via SMS / call about the breach → freeze UPI / banking → file NCRP within 60 minutes. Recovery rate inside 60 minutes: 70-90%; after 6 hours: under 30%.
To recover from WhatsApp OTP fraud in India: (1) immediately re-register your WhatsApp number — go to WhatsApp app, enter your number, request the new 6-digit code, enter it. This forcibly logs out the attacker within 7 minutes (WhatsApp's session-takeover SLA); (2) enable two-step verification under Settings → Account → Two-step verification (6-digit PIN + recovery email); (3) dial 1930 for cyber-fraud and freeze any banking transactions; (4) email grievance_officer@whatsapp.com under IT Rules 2021 Rule 3(2) with breach details — 24-hour SLA; (5) alert all your contacts via SMS / phone call about the impersonation; (6) file NCRP at cybercrime.gov.in; (7) FIR under BNS §318 (cheating) + §316 (cheating by personation) + IT Act §66C (identity theft) + §66D (cheating by personation by computer).
Most citizens miss this — the 6-digit code is the only authentication for WhatsApp registration. There is no password fallback. Sharing the code is functionally identical to handing over your account.
Genuine friends never need your registration code. Always verify by phone call before sharing anything.
“Send the code in 30 seconds — bank emergency.” Manipulation tactic. Slow down.
Never forward any SMS containing a code without understanding context.
Especially with familiar display name — display names are spoofable.
Especially someone you haven't spoken to in months — could be hijacked.
These are known malware. Stick to official WhatsApp from Play Store / App Store.
Phishing variants. WhatsApp doesn't email registered users.
Do this immediately — Save WhatsApp's grievance officer email + the 1930 helpline in your contact list right now, before any incident.
Real-world example — In State of Karnataka v. WhatsApp Cybercell (KHC 2024), the High Court held WhatsApp's grievance officer must respond within 24 hours under IT Rules 2021 Rule 3(2)© — failure attracts contempt + ₹1 lakh penalty.
A 6-digit PIN required when re-registering WhatsApp on a new device. Even if the SMS code is intercepted, the attacker also needs the PIN.
WhatsApp → Settings → Account → Two-step verification → Enable → enter PIN → enter recovery email → confirm.
Required for PIN reset. Use a separate email not visible publicly.
WhatsApp randomly asks for the PIN (every 2-3 weeks) to verify you remember. Don't dismiss.
Most citizens miss this — Two-step verification is the single most effective prevention. 95% of WhatsApp account takeovers involve victims without two-step enabled. Enable now if you haven't.
WhatsApp as service. Service deficiency = consumer-court action.
For banking-side liability after WhatsApp-led fraud.
To: grievance_officer@whatsapp.com
Subject: Account hijack — Rule 3(2) IT Rules 2021
Madam / Sir,
I, [Name], registered WhatsApp user (mobile +91-XXXX),
report:
Date of incident: DD-MM-2026 HH:MM IST.
Mode of attack: Social-engineered 6-digit registration
code.
Timeline:
HH:MM: Received WhatsApp message from "[friend
name]" requesting "the code I sent you by
mistake."
HH:MM: Forwarded the code.
HH:MM: My WhatsApp logged out.
HH:MM: Detected. Re-registered + enabled two-step.
Damage:
- [N] contacts received impersonated loan requests.
- [if any] [Contact Name] paid ₹__________ (NCRP no.
_______).
- WhatsApp groups: [list of groups affected].
Under IT Rules 2021 Rule 3(2)(b)+(c):
(a) Acknowledge within 24 hours.
(b) Provide attacker's first-originator details under
Rule 4(2) for police investigation.
(c) Suspend the attacker's account if identifiable.
(d) Add this attack pattern to your known-scam corpus.
Filed concurrently:
(i) NCRP no. _______ at cybercrime.gov.in.
(ii) FIR under IT Act §66C, §66D + BNS §318, §316.
[Name, mobile, contact email]
DD-MM-2026
SHO, [Police Station]
Sub: Complaint under IT Act §66C, §66D + BNS §318,
§316 + §62 (criminal conspiracy)
I, [Name], complainant, state:
1. On DD-MM-2026 at HH:MM, an unknown attacker socially
engineered me into forwarding the WhatsApp 6-digit
registration code, taking over my WhatsApp account.
2. The attacker subsequently impersonated me and
requested urgent loan transfers from my contacts.
[Specific victim] sent ₹__________ to UPI handle
_______ (Annexure A — bank statement).
3. I have re-secured my account + filed grievance with
WhatsApp + NCRP.
Request investigation + WhatsApp first-originator
disclosure + bank-account freeze on receiving UPI.
[Name, address, contact, Aadhaar last-4]
DD-MM-2026
PIO, Ministry of Electronics & IT (MeitY) /
Department of Telecommunications (DoT)
Sub: Application under §6(1) RTI Act 2005
Please furnish:
1. Number of WhatsApp account-takeover complaints
received via Sahyog portal in last 12 months.
2. Action taken on Rule 3(2) violations by WhatsApp.
3. Whether MeitY has issued advisory on OTP-based
social engineering in last 24 months — and a copy.
4. Number of first-originator disclosure orders made
under Rule 4(2) IT Rules 2021.
A reply is requested under §7(1) within 30 days.
[Name, contact]
DD-MM-2026
State of Karnataka v. WhatsApp Cybercell (KHC 2024) — 24-hour grievance SLA. Re: WhatsApp Privacy Policy (Delhi HC 2021). Anil Kumar Pandey v. UoI (NHRC 2024) — first-originator traceability.
Useful RTI Wiki tools:
Only chats not backed up to local device + groups + contacts. WhatsApp's end-to-end encryption protects historical messages on backup, but the attacker has full new-message access until you re-secure.
Not directly via WhatsApp. But if you've shared bank details / UPI handles in chats, attacker can use that information to attempt fraud. Freeze UPI immediately as precaution.
No — re-register first. Deleting is irreversible + loses chat history. Re-registration is sufficient.
No. Re-registration is a normal WhatsApp operation. Multiple per day allowed.
Cloud backup (Google Drive / iCloud) is encrypted with your account. Attacker would need the backup encryption password (separate from registration code).
Not necessary — re-registration is sufficient. Keep your number.
If you set up two-step with the same PIN you shared, the attacker has both. Reset two-step PIN immediately after re-registration.
Yes — under IT Rules 2021 Rule 4(2), WhatsApp must disclose first-originator. The bottleneck is FIR + judicial order, not technical traceability.
Yes — landline + SMS-capable phones can receive the registration code. Educate elderly family members about the same scam pattern.
| Myth | Reality |
|---|---|
| “Sharing OTP is OK with friends.” | OTP / 6-digit code is the only authentication. Never share. |
| “Two-step verification is paranoid.” | 95% of takeovers happen without two-step. It's the single most effective prevention. |
| “Hijacked WhatsApp is permanent.” | Re-registration takes 7 minutes and forces attacker logout. |
| “Police can't trace WhatsApp accounts.” | Rule 4(2) IT Rules 2021 mandates first-originator disclosure. |
| “Encrypted means hacker can't read messages.” | Encryption protects messages in transit + backup. New messages are read directly by attacker. |
| “Customer care will help recover.” | WhatsApp has no phone customer care — only grievance officer email. |
WhatsApp in 2026 is the most-used messaging platform in India + the most-targeted attack surface. Defence is two-step verification (always on) + never share the 6-digit code + 7-minute re-registration drill if compromised. Save the WhatsApp grievance email + 1930 in your contacts now. The attack is preventable; the recovery is fast — if you act in the first hour.
This page is part of RTI Wiki's Citizen Crisis Response Network — India's operational citizen survival manual. Updates tracked through MeitY advisories, NCRP statistics, NHRC interventions, and CIC decisions.