Never share your WhatsApp code
This includes the 6-digit code WhatsApp sends you, even with a friend, a "colleague", or someone claiming to be from WhatsApp or your bank.
Why the code matters
The code is the key to your account, but the lock is on WhatsApp's computers, not on your phone. WhatsApp sends the code to your phone to check one thing: that the person registering this number is the one holding the phone.
How the takeover works
Attackers do not "hack" your phone. They get you to hand over the key.
They trigger the code. The attacker starts to register your number on their own phone. WhatsApp sends a real 6-digit code to your phone.
They contact you. Straight after, they message you as a friend ("I sent my code to you by mistake, please send it back"), as customer support ("there is a problem with your account"), or as your bank.
You send the code. Because it feels urgent or you trust the person, you reply with it. They type it into their phone.
Your account is taken over. WhatsApp accepts the code and signs the attacker in. You are logged out. Your chats, contacts, photos and identity are now in their hands.
A newer trick: GhostPairing
Researchers named this attack GhostPairing. It tricks you into linking the attacker's device to your account yourself, so they never need to ask for your 6-digit code.
It usually starts with a message from a contact, often someone whose account was already taken over, such as "Look at this photo of you!" The link opens a page that looks like Facebook or WhatsApp Web and asks for your phone number. Your phone then shows a real WhatsApp prompt to link a new device. Some versions ask you to type a code shown on the web page into WhatsApp. Others ask you to scan a QR code.
If you do, the attacker's browser becomes a linked device on your account. They can read your messages as they arrive, and you may notice nothing until you check your linked devices.
How to protect yourself
Never tell anyone a code
No matter who they say they are. WhatsApp will never ask you for your verification code.
Check your linked devices often
Open Settings > Linked devices. If you see a device you do not recognise, tap it and choose Log out.
Turn on two-step verification
Open Settings > Account > Two-step verification and set a 6-digit PIN. Even if someone gets your code, they still need the PIN.
Link a device only when you started it
Only link WhatsApp Web or the desktop app when you chose to, and you are sitting at that computer. If a web page you reached from a link asks for a code or a QR scan, stop.
Found an unknown device? Log it out, turn on two-step verification, and tell your trainer privately.
Remember: your 6-digit code is the master key. Never share it, not with friends, not with "support", not with anyone.