By Nicolas Avila · October 9, 2026

Cloned WhatsApp: prevention and immediate action

Photo: Avila Ops Tecnologia

To prevent account cloning, enable WhatsApp two-step verification and never share the six-digit SMS code with anyone. If already compromised, reinstall WhatsApp on your device and reactivate the number, disconnecting the scammer; then notify customers through another channel and file a police report. Both parts fit within an hour.

Your business WhatsApp number is your counter. Once cloned, it becomes a counter where strangers serve customers in your name and request Pix payments. The loss is not only transferred money; it is trust taking months to recover.

How do you prevent cloning?

1. Enable two-step verification: Settings, Account, Two-step verification. Create a six-digit PIN and add a recovery email. Without the PIN, the SMS code will not activate the account on another device.
2. Set one team rule: never share verification codes. No bank, delivery platform, marketplace, or “WhatsApp support” requests this code by phone or message.
3. Lock the SIM with a SIM PIN in phone settings. If the device is stolen, the SIM will not work in another.
4. Use WhatsApp Business with an email and PIN registered, keeping the app updated.
5. If WhatsApp is your main sales channel, consider the WhatsApp Business API. The number links to the company’s Meta account rather than a SIM in a device, and multiple people can handle service without sharing a phone.

What should you do as soon as you discover cloning?

The most common sign is a customer or friend saying “you” asked for money. Another is the app asking to verify the number again. Then, in order:

1. Reactivate the number on your device. Open WhatsApp, enter the number, receive the SMS, and enter the code. This ends the scammer’s session because the number stays active on one device. If they enabled two-step verification with an unknown PIN, WhatsApp asks you to wait seven days; follow the next steps and keep trying.
2. Notify contacts through another channel: Instagram, email, calls, store-door notice. Keep it short: “my WhatsApp was cloned; do not send Pix for requests from this number until further notice.” Anyone who transferred should contact their bank immediately.
3. File a police report, in person or online. It supports bank transfer disputes, insurance if applicable, and proof you did not request the money.
4. Email WhatsApp support reporting the compromise, including the number in international format, and request temporary account deactivation.
5. After recovery: enable two-step verification, change the registered email’s passwords, and check linked devices under Settings, Linked devices.

How do you reduce customer losses?

As a rule, businesses are not required to reimburse money customers sent to scammers, but your relationship is at stake. Call everyone who transferred, advise a bank dispute using the police report, and consider reimbursing small amounts. It costs less than losing customers.

Post a notice for several days on Instagram and Google Business Profile: “we are operating normally at number X; we do not request Pix by message without confirmation.” Permanently clarify how you collect payment: a fixed Pix key under your CNPJ, store payment links, or boletos bearing the company name.

What to do now

Open your business WhatsApp and enable two-step verification before closing this article. If your number lives on one phone with one person and is how the company sells, a conversation about exposure is worthwhile: avilaops.com/contato or contact us on WhatsApp: wa.me/5517997811471.

Frequently asked questions

My WhatsApp was cloned. How do I recover it?

Reinstall the app on your device and activate the number with the SMS code. The scammer’s session ends. If they set a PIN, WhatsApp releases it after seven days; notify contacts through another channel meanwhile.

Who pays for Pix transfers to the scammer?

Generally, the person transferring bears the loss, and the bank may refund through Pix’s special refund mechanism (MED) if disputed quickly and money remains in the scammer’s account. That is why the police report and bank call must happen the same day.

Does WhatsApp two-step verification solve everything?

It prevents SMS-code cloning, the most common type. It does not solve an unlocked stolen device or a leaked email password. Screen locks and strong email passwords complete protection.