WhatsApp or Gmail Account Hacked? Follow These Steps to Recover and Secure Your Account

WhatsApp and Gmail have become central to everyday digital life. From personal conversations and work documents to banking alerts and account verification codes, these services can contain highly sensitive information. Losing control of either account can therefore create serious privacy and security risks.

Warning signs can include messages you never sent, unfamiliar devices appearing in your account, unexpected verification codes, security alerts for sign-ins you do not recognise, or sudden difficulty accessing your own account.

If you suspect that someone has gained unauthorised access, acting quickly can limit the damage. However, there is no guaranteed five-minute recovery method. The time required depends on what happened to the account and whether passwords, recovery details or security settings were changed.

Here is what users can do.

WhatsApp Account Compromised? Start by Verifying Your Number

If you have been logged out of WhatsApp and suspect someone else registered your number, try signing back into WhatsApp using your phone number.

WhatsApp may send a verification code to confirm ownership of the number. Enter the code only inside the official WhatsApp application.

Successfully verifying your phone number can help you regain control of the account and remove another user who registered the same WhatsApp number on another phone.

Most importantly, never share a WhatsApp registration code or OTP with anyone. A common account-takeover technique involves criminals convincing victims to reveal their verification codes.

Check WhatsApp Linked Devices

Getting back into your account is only the first step.

Open WhatsApp's settings and review the Linked Devices section. Look carefully for computers, browsers or other devices you do not recognise.

If you find an unfamiliar session, log it out.

This check is particularly important because someone may gain access through a linked device without necessarily taking over the main WhatsApp registration.

You should also review recent conversations for messages you did not send. If suspicious messages were sent from your account, warn your contacts not to respond, send money or click unfamiliar links.

Turn On WhatsApp Two-Step Verification

After regaining control, strengthen the account by enabling two-step verification.

This security feature adds a PIN to the WhatsApp registration process, creating an additional barrier against unauthorised attempts to register your number.

Use a PIN that cannot easily be guessed and avoid sharing it with anyone.

Where available, users can also consider security options such as passkeys. Passkeys can use the security mechanism of a trusted device, including a screen lock or biometric authentication, to make account access more resistant to common password and phishing attacks.

Gmail Compromised? Use Google's Account Recovery Process

A compromised Google Account can be particularly serious because Gmail may be connected to many other online services.

If you cannot sign in because your password or account details have been changed, use Google's official Account Recovery process.

Google may ask for information that helps establish that you are the legitimate account owner. Depending on your account configuration, this could involve a previously used password, a recovery email address, a recovery phone number or other verification methods.

For the best chance of successful recovery, try completing the process from a familiar device, browser and location that you have previously used to access the account.

Avoid unofficial websites claiming they can recover a Gmail account for a fee. Account credentials and verification codes should only be entered through Google's legitimate services.

Still Have Gmail Access? Change Your Password Immediately

If you can still sign into your Google Account but notice suspicious activity, review the account's security settings immediately.

Change the password if you believe it has been exposed. Choose a strong and unique password that you have not used on other websites or apps.

Reusing passwords creates an additional risk. If the same password is compromised through another service, attackers may try it against your email and other accounts.

After changing the password, review devices and active sessions associated with your Google Account.

Remove devices that you do not recognise or no longer use.

Check Whether Recovery Details Were Changed

An attacker who gains control of an email account may attempt to make recovery more difficult by changing important security information.

Review your recovery phone number, recovery email address and other security settings.

If you find unfamiliar information, follow Google's security and recovery procedures to correct it.

Gmail users should also inspect important account settings for unexpected changes. For example, check whether unfamiliar email forwarding, filters or other settings have been created that could expose incoming messages.

Pay Attention to Unexpected Security Alerts

Security notifications can provide an early warning of an attempted account takeover.

If Google reports a new sign-in or unfamiliar device that you do not recognise, review the alert rather than ignoring it.

Likewise, receiving WhatsApp registration codes that you never requested can indicate that someone is attempting to register your number.

Never provide those codes to a caller or person messaging you, even if they claim to work for WhatsApp, Google, a bank, the police or another trusted organisation.

Add Stronger Sign-In Protection

Once your accounts are secure again, review the security features available to you.

For your Google Account, enable two-step verification and consider using passkeys where supported. Passkeys can provide stronger protection against many phishing attempts because authentication is tied to your device and the legitimate service.

For WhatsApp, enable two-step verification and regularly check linked devices.

These measures cannot eliminate every cybersecurity risk, but they can make unauthorised access significantly more difficult.

Protect Financial Accounts After a Serious Takeover

If the compromised phone number or email address is connected to banking, UPI, payment apps or other financial services, pay close attention to those accounts as well.

Check for unfamiliar transactions or security notifications.

Never disclose an OTP, UPI PIN, card PIN, CVV, internet-banking password or recovery code to anyone offering to help recover your WhatsApp or Gmail account.

If your SIM has unexpectedly stopped working at the same time as an account takeover, contact your mobile operator through its official channel. An unexpected loss of mobile service can warrant immediate investigation, particularly when the number is connected to financial accounts.

Quick Action Matters, but Recovery Time Can Vary

A hacked WhatsApp or Gmail account should be treated as a security incident. Start by using the platform's official recovery process, remove unfamiliar devices or sessions, change compromised passwords and strengthen authentication.

WhatsApp users should verify their number, inspect linked devices and activate two-step verification. Google users should use the official Account Recovery process when locked out and conduct a full security review after regaining access.

Most importantly, do not trust people who promise instant account recovery in exchange for money, passwords or verification codes. Using official recovery channels and protecting your OTPs and credentials is the safest way to regain and maintain control of your digital accounts.