On November 7, 2026, a warning attributed to Spain’s Policía Nacional put the number of WhatsApp account-theft or impersonation complaints in Castilla y León at nearly 600 so far that year. The Police also described a marked increase since July. For someone trying to reclaim an account, WhatsApp’s stated route is to register the same phone number again with a six-digit code sent by text or phone call; the service says that signs out other connected devices.
How an account takeover can turn into a payment request
The Police warning described social-engineering attempts, including links sent by a contact whose account had already been compromised, as well as spoofed calls or text messages. Once an account is taken over, the reported scam can move quickly from a familiar-looking message to an urgent request for money, often through Bizum, a Spanish payment service. The message may include an excuse to avoid a phone call.
The Policía Nacional advised checking an unexpected payment request by calling the person or using another channel, rather than relying on the chat carrying the request. Use a number you already know when calling.
If a familiar contact asks for urgent money in a chat, verify the request outside that conversation before sending anything.
How to recover a WhatsApp account
WhatsApp says to register the same phone number again and enter the six-digit code received by SMS or phone call. That step signs the account out on other connected devices. Recovery requires a SIM card with the account’s phone number. WhatsApp’s account-recovery instructions explain the process.
If someone has set a two-step verification PIN you don’t know, WhatsApp says to wait seven days and try again. Entering the six-digit registration code still signs out the other person using the account. The code is the account-recovery step; knowing or changing a PIN alone is not described as a substitute for registering the number again.
A separate voicemail case reported by INCIBE
In a case report published February 25, 2025, Spain’s cybersecurity institute INCIBE described a woman who received missed calls from international numbers and then found a WhatsApp verification code in her voicemail. INCIBE considered remote access to the voicemail a possible explanation in that case and advised changing a default voicemail PIN. INCIBE’s case report describes that single case and its recommended PIN change.
