Cloned WhatsApp: how to tell, what to do, and how to protect your business

A friend calls asking about the money transfer "you" requested. Or the app logs itself out and asks for the code again. A cloned WhatsApp is one of the most common scams around — and when the number is the company's sales channel, the damage goes from embarrassment to real losses: a scammer handling your customers under your name. This guide shows how to confirm the cloning, take back the account in minutes, and shield the number so it doesn't happen again.

First, the two types of "cloning"

1. Account theft (the most common). The scammer gets the 6-digit verification code — usually by tricking the victim ("I'm from support, confirm the code you just got") — and registers YOUR number on THEIR device. You get disconnected instantly.

2. A mirrored session. Someone with physical access to your phone scanned the WhatsApp Web QR Code and reads your conversations silently, without disconnecting you.

The signs and the fix are different — which is why diagnosis comes first.

How to tell if your WhatsApp was cloned

Signs of an account theft:

• The app suddenly asks to verify the number and you can't log in anymore
• Contacts are getting messages from you asking for money
• You received a text with a verification code you never requested (an attempt in progress)

Signs of a mirrored session:

• Under Settings → Linked devices, a computer/location you don't recognize shows up
• Messages marked as read that you never opened
• Conversations getting archived or deleted on their own

Check right now: open Linked devices and disconnect anything you don't recognize. It takes 10 seconds.

What to do if your WhatsApp was cloned (step-by-step)

1. Reinstall/open WhatsApp and register your number again. Ask for the code by text or call. When the code arrives and you log in, the scammer's session automatically drops — only one active registration exists per number.
2. If it asks for a PIN you never created, the scammer activated two-step verification on the stolen account. Tap "Forgot PIN": WhatsApp sends a reset to your email, or unlocks it after a wait of up to 7 days. The number comes back — it's yours, tied to your SIM.
3. Warn your contacts through another channel (a call, Instagram, email): "my WhatsApp was cloned, don't send any transfers." Move fast: the first few hours are when the scam pays off.
4. File a police report — important if customers suffered financial loss or money was requested in your name.
5. Turn on two-step verification (below) before anything else.

How to protect yourself: the 5-minute checklist

• Two-step verification: Settings → Account → Two-step verification → create a 6-digit PIN and register a recovery email. With this, a text message code alone isn't enough to register your number on another device. This one protection solves 90% of cases.
• Never share the 6-digit code. Not with "support," not with "the bank," not with anyone claiming to be from WhatsApp. Nobody legitimate ever asks for this code. Ever.
• Review linked devices periodically and disconnect anything you don't use.
• Screen lock on your phone and biometrics on the app (Settings → Privacy → App lock).
• Protect your SIM: ask your carrier to require a password for SIM swaps (this makes SIM-swap fraud harder).

If it's the company's number, the risk is a different level

On a personal number, the scam hits your friends. On the company's number, it hits your customers — people who trust your name and get a fake invoice that looks like "yours." Besides the checklist above, professional operations have two extra layers:

• The official WhatsApp API: the number stops living on a phone and starts living on Meta's infrastructure, accessed through a system with per-user login and permissions. There's no mirrorable QR Code and no SIM to steal — the scam's classic vector simply disappears.
• Multi-agent support with individual accounts: each agent has their own login and access level, with a complete history of who said what. An employee who leaves loses access instantly — with no need to "get the phone back."

As a bonus, the conversation history lives in the CRM, not on the device: even in an incident, the company doesn't lose the memory of its customer relationships.

Frequently Asked Questions

Cloned WhatsApp: can the scammer see my old conversations? In a code theft, no — the history stays encrypted on your device/backup. They start operating your number from that point on, with no access to the past. In a mirrored session via WhatsApp Web, they read whatever comes in while the session is active.

How long does it take to recover a cloned WhatsApp? Without a PIN set by the scammer: minutes (re-register with the code on your SIM). With a PIN and no registered email: up to a 7-day security wait.

Does having the SIM guarantee the account is mine? Yes — the number belongs to whoever has the SIM. That's why re-registration always works, and why protecting the SIM (a password for swaps with your carrier) matters.

Does two-step verification prevent cloning? It prevents the main method (theft by code). With a PIN active, even with the text message code, the scammer can't register the number.

My company got cloned and customers fell for the scam. Now what? Notify every customer immediately through every channel, file a police report, and document everything. After that, migrate support to the official API with individual access — that's the setup where this scam stops being possible.