# WhatsApp Finally Gets Serious About Account Takeover — and It's About Time
Three billion people use WhatsApp. That number isn't a bragging point — it's a threat surface. And for years, the primary defense protecting those accounts from takeover has been a six-digit SMS code that anyone with a compromised SIM can intercept before you even know something is wrong.
Meta is now rolling out two meaningful upgrades to WhatsApp account security: support for multiple passkeys on a single account, and a strengthened two-step verification system. Neither feature is flashy. Both matter more than most security announcements this year.
## The Attack That Made This Necessary
WhatsApp account takeover isn't a niche problem. It's a cottage industry.
The playbook is well-worn: attacker ports your number to a new carrier, intercepts the SMS verification code WhatsApp sends during a device transfer, and your entire conversation history — along with the trust your contacts have in "you" — belongs to someone else. What follows is usually fraud. The attacker messages your family impersonating you, asks for urgent money transfers, and moves on before anyone realizes what happened.
SIM swap fraud cost Americans over $68 million in 2021 alone, according to the FBI, and that figure only captures reported incidents. Messaging apps are prime targets because the social trust baked into a conversation thread is extraordinarily valuable to criminals. Your bank has a fraud department. Your aunt doesn't.
Two-step verification — WhatsApp's existing 6-digit PIN that layers on top of phone number verification — helped. But implementation has been inconsistent, and the "forgot PIN" fallback often created its own attack surface.
## What's Actually Changing
The passkey expansion is the more technically significant change. WhatsApp added passkey support in late 2023, but limiting users to a single passkey created a real-world usability problem: if you lost access to that passkey (hardware key lost, device stolen, account reset), you were locked out of your own account recovery path.
Multiple passkey support solves the classic security vs. accessibility tension that has undermined phishing-resistant auth for years. The correct answer to "what if I lose my only passkey?" shouldn't be "fall back to SMS." It should be "register a backup." Now it can be.
Passkeys eliminate the interception problem entirely. There's no code to steal because there's no code. Authentication is a cryptographic handshake between your device and WhatsApp's servers — no phishable string ever crosses the wire. A SIM swap attack becomes irrelevant when account recovery doesn't route through your phone number at all.
The two-step verification improvements are less detailed in what Meta has disclosed publicly, but "stronger" almost certainly means better PIN complexity requirements, more aggressive lockout policies after failed attempts, or tighter controls over the email recovery fallback. That last piece matters: the email address associated with 2SV has historically been the soft underbelly of the system. An attacker who controls your email can often reset the PIN.
## The Population That Actually Gets Protected
Here's the important framing most coverage will miss: this isn't primarily a feature for security-conscious enterprise users who are already using hardware tokens and have a dedicated IT team watching their accounts.
This is for the 3 billion people who are not doing that.
The populations most exposed to WhatsApp account takeover are not corporate executives — they're people in markets where WhatsApp is the primary communication channel: Latin America, West Africa, South and Southeast Asia, the Middle East. These are populations where WhatsApp is effectively the internet's social layer, where financial transactions happen over chat, where family businesses coordinate entirely through group threads.
Passkeys are only as effective as their adoption rate, which is where Meta's platform distribution advantage becomes genuinely important. A security feature that lives inside an app with 3 billion monthly active users can reach people that enterprise security tooling never will. If Meta makes passkeys the default enrollment path — not just an option buried in settings — the impact on real-world account takeover rates could be substantial.
## The Ecosystem Question
This announcement doesn't exist in a vacuum. Apple, Google, and Microsoft have spent the last three years building out the passkey infrastructure through the FIDO2/WebAuthn standard. The platform-level support now exists that wasn't there two years ago — iCloud Keychain, Google Password Manager, and Windows Hello all sync passkeys across devices.
WhatsApp expanding passkey support is partly a product decision and partly acknowledging that the ecosystem is finally ready for this to be a mainstream feature rather than a power-user curiosity. The timing isn't coincidental: passkey usage crossed meaningful adoption thresholds this year across major consumer apps, making "I don't know what a passkey is" a less common response than it was 18 months ago.
The multiple-passkey capability specifically aligns WhatsApp with how Google and Apple have been pushing enterprise passkey guidance: register at least two, keep one as an emergency backup on separate hardware. That's the right model.
---
## HackWire Analysis
WhatsApp account takeover is chronically underreported relative to its actual damage. The incidents that make headlines tend to involve enterprise breaches with regulatory disclosure requirements. Account takeover on consumer messaging apps generates no disclosure obligation, leaves victims embarrassed rather than litigious, and produces fraud losses that are diffuse and hard to aggregate.
That invisibility is exactly why this announcement deserves attention beyond the usual "here's a new feature" coverage.
The move to multiple passkeys is a quiet but important acknowledgment that single-factor passkey setups introduce recovery fragility — a problem the security community identified early in passkey rollout but that vendors were slow to address. Losing your only registered passkey on a high-stakes account like a primary messaging app was a real usability cliff that made security-conscious users hesitant to fully commit. That objection is now weaker.
The piece of this announcement I'm watching most closely is the two-step verification hardening. WhatsApp's current 2SV implementation has a documented weakness: the email fallback for PIN recovery is often the easiest path for an attacker who has already compromised the target's email account. If "stronger" means Meta is tightening or eliminating that fallback in favor of passkey-based recovery, that's a more significant architectural change than the passkey count increase. But Meta hasn't said that yet.
For security teams supporting populations that use WhatsApp for business communication — common in Latin America, the Middle East, and across distributed small businesses — now is the right moment to push passkey enrollment. The infrastructure exists, the app supports multiple keys, and the threat of SMS-based account takeover isn't going away. Waiting for perfect is the wrong call here.
For individuals: register two passkeys. One on your primary device, one on a backup. Do it this week, before you need it.
— HackWire Editorial
---
## Related Coverage