How to Protect Your WhatsApp from Hackers and Scammers – 8 Key Settings and Best Practices

With an estimated 3 billion monthly users​ exchanging messages, calls, and files daily, WhatsApp has become a popular target for cybercriminals and fraudsters looking to exploit unsuspecting victims.

The service is built with end-to-end encryption, meaning messages and calls are secured so only you and the recipient can read or hear them​. But cybercrooks have tricks in their toolbox to hijack accounts, sneak spyware onto phones, or trick users with scams​.

The good news is that WhatsApp offers a wide range of privacy, safety, and security features to protect you from attacks. Combined with some healthy caution, these features significantly reduce the chances of account hijacking, data theft, or privacy violations.

In this post, we walk through 8 key settings and best practices in WhatsApp (for the standard consumer app) that you should use to protect your security and privacy.

1. Multi-factor authentication

One of the most important safeguards for any online service, especially your preferred messaging app, is multi-factor authentication (abbreviated MFA or 2FA, for two-factor authentication). 2FA adds a second layer of authentication to your WhatsApp account – a 6-digit PIN code that only you know.

2FA helps prevent account hijacking. In a scam commonly found on WhatsApp, a criminal poses as a friend or as WhatsApp support staff and asks for the code sent to your phone. If you share it, they can take over your WhatsApp​

Anytime you (or anyone) tries to register your WhatsApp on a new device, they must enter this PIN in addition to the SMS code. Even if a hacker somehow gets your text verification code, they can’t access your account without this PIN.

2. Adjust your privacy settings (last seen, profile photo, etc.)

WhatsApp lets you control who can see your personal details and activity, such as your Last Seen time, Online status, Profile Photo, About info, and Status updates. Review these settings to protect your privacy.

By default, you may be sharing more than you realize with people who have your number. For example, if set to “Everyone,” anyone with your phone number (even scammers or strangers from group chats) could see when you were last online, or view your profile picture and status. Restrict these to your contacts (or nobody) to help prevent stalking, social engineering, or impersonation attempts.

WhatsApp itself cautions users to “be mindful of what you share,” since anything you send or display could be forwarded or seen by others​. Simply put, not everyone needs to know when you’re online or see your photo – especially not strangers.

3. Control who can add you to group chats

Ever found yourself suddenly added to a random WhatsApp group full of strangers or spam? This can happen if your WhatsApp number circulates, but thankfully you can control who can add you to group chats.

WhatsApp’s Group privacy setting lets you decide if anyone can add you, or only your contacts (or a subset of contacts). This is vital protection against spam groups and scam invites.

Scammers have been known to mass-add numbers to groups to advertise fake offers or phishing links. In one case, political operatives even used software to auto-add thousands of people to WhatsApp groups to spread misinformation. You don’t want just anyone dragging you into a group without permission.

4. Turn on security notifications for encryption changes

WhatsApp’s strong encryption ensures only you and your chat partner can read messages, but how do you know that encryption is intact? That’s where Security Notifications come in.

This setting isn’t enabled by default, but it’s a good idea to turn it on. When enabled, WhatsApp will notify you if a contact’s security code changes (which happens if they reinstall WhatsApp, change their phone, or add a new linked device). In normal cases, a code change is due to the contact switching devices – but if you weren’t aware of any change, it could be a clue that someone else is intercepting or accessing that chat.

5. Lock your WhatsApp with biometrics

Do you ever leave your phone unattended? Enabling WhatsApp’s built-in app lock can protect your chats from prying eyes in case someone gets physical access to your device.

This feature uses your phone’s biometric security – like fingerprint unlock or face ID – to require authentication each time you open the app (or after a set idle interval).

Even if your phone itself is unlocked or someone knows your PIN, they still can’t open WhatsApp without your finger or face. It’s an extra shield, especially useful if you often hand your phone to others or worry about snooping.

6. Use disappearing messages & view-once media for sensitive chats

Not all messages need to live forever on your device (or the recipient’s). Disappearing Messages is a WhatsApp feature that, when turned on for a chat, causes new messages to auto-delete after a chosen period.

There’s also the View Once option for photos and videos – these self-destruct immediately after the person opens them, leaving no trace in the chat. Using these features can keep your conversations light and private, especially for sensitive information or personal content you don’t want lingering.

It’s also a recommended setting in scenarios involving malware or an intruder getting into your WhatsApp – older chats and media could be a gold mine of information. Disappearing messages limit that risk by automatically cleaning up after a set time.

7. Protect your backups with End-to-End Encryption (E2EE)

Don’t overlook the safety of your chat backups. WhatsApp gives the option to back up chats to iCloud (iPhone) or Google Drive (Android). By default, those backups are not end-to-end encrypted, meaning if someone got access to your Google or iCloud account, they could potentially download and read your messages.

If a hacker compromises your cloud account or if authorities subpoena cloud-stored messages, an unencrypted backup is an easy target. In some cases, attackers have specifically targeted WhatsApp backups to gather sensitive data. Enabling backup encryption ensures that even if someone obtains your backup file, it’s gibberish without your password.

To solve this, WhatsApp offers end-to-end encrypted backups, which enables you to secure your cloud backup with a password or an encryption key that only you know​. Once enabled, neither WhatsApp, Google, Apple, nor anyone who might breach those services can read your backup – it’s essentially locked with your own key. (Note: if you forget the password/key, even you can’t recover that backup.)

8. Protect against spyware

While each of the above steps helps secure your WhatsApp account, there is a different (and more dangerous) breed of risk to consider: spyware. Spyware is malicious software that can infect your device, often without you realizing it. Once installed, spyware allows attackers to monitor your phone calls, messages, browsing history, and even your physical location in real time.

In recent years, WhatsApp has patched zero-click vulnerability exploits that could inject spyware onto your device simply by calling you via WhatsApp—even if you don’t answer. Though these vulnerabilities are patched periodically (once discovered), sophisticated threat actors or government-grade spyware vendors keep searching for new ways to infect targets. According to the Citizen Lab, multiple nations are working with privately developed spyware tools that leverage messaging apps, including WhatsApp, to surveil journalists, dissidents, and other high-value targets.

How to protect against spyware:

Always update WhatsApp: Hackers exploit known bugs and vulnerabilities in outdated versions of the app. By regularly updating WhatsApp (and your phone’s operating system) to the latest version, you ensure you have the latest security patches. This also closes off any vulnerability or backdoor an attacker could exploit.

Use official app stores only: Be wary of links or prompts to download WhatsApp from unofficial sources. The most common, and secure, way to get WhatsApp is through Google Play Store (on Android) or the Apple App Store (on iOS). Downloading from random websites or via suspicious APKs can expose you to malware or trojanized apps.

Avoid suspicious calls and links: Even with software patches, vigilance is key. If you see an incoming call from an unknown number and suspect something off (e.g., it disconnects abruptly, the country code is unusual, or it’s repeated late-night attempts), block the number and report it as spam. Likewise, never click on links from unknown senders—spyware can be delivered via malicious URLs.

Limit permissions: Review which permissions WhatsApp has on your phone (e.g., microphone, contacts, camera). By default, WhatsApp needs some permissions to work properly, but you can make sure you’re not giving access to your entire device in ways that aren’t necessary. Periodic permission reviews help you spot if something’s been tampered with.

Stay alert to unusual phone behavior: Spyware often makes your phone act strange—it might overheat quickly, run out of battery much faster, or show spikes in data usage when you’re not actively using it. While these symptoms can also come from normal phone usage or OS bugs, a sudden and persistent change could be a red flag.

Use device security tools: Use a dedicated security solution on all your personal devices to help detect and remove a malware infection. Top-rated security vendors often incorporate advanced scanners that pick up on suspicious app behavior. If you suspect your device is compromised, run a full scan or perform a device factory reset after backing up your personal data (but avoid restoring app backups you can’t verify as clean).

Conclusion

Keeping your WhatsApp secure and private is largely about using the tools already at your fingertips. Each of these features is easy to set up and only takes a few minutes, but together they drastically strengthen the security of your account and the privacy of your chats.

As threats evolve, make it a habit to regularly review your WhatsApp settings. Check if new privacy options are available – WhatsApp frequently adds features to give users even more control over their data.

Beyond settings, always stay vigilant. Be cautious with suspicious links or unsolicited messages asking for personal information. Remember, your account security is in your hands. Enable these protections and stay alert, so you can enjoy WhatsApp with peace of mind, knowing you’ve locked out the bad guys and kept your conversations safe and secure.

Happy chats, and stay safe out there!