WhatsApp Tightens Account Security With Stronger Passwords, Multiple Passkeys

WhatsApp has introduced a new set of account security measures, including stronger two-step verification, support for multiple passkeys and additional information about calls from unknown numbers, as the messaging platform moves to strengthen protection against account takeover and scams.

The company said the measures are designed to give users greater control over their accounts while building on the end-to-end encryption that protects personal messages and calls by default.

One of the major changes is an upgrade to WhatsApp’s two-step verification system. The platform said users can now use a full password instead of the previous six-digit PIN, with the password supporting longer combinations of letters, numbers and special characters.

WhatsApp said the stronger password option is intended to make it more difficult for criminals to guess or compromise the additional security layer, particularly in situations where a user’s one-time registration code has been obtained by an attacker.

“Two-step verification is an extra protection layer that helps prevent someone from taking over your account, even if they get a hold of your one-time passcode,” WhatsApp said.

The company added, “Until now, it was a six-digit PIN, but we’ve upgraded it to a full password: longer, alphanumeric, and even with special characters to make it harder to guess.”

The platform is also expanding the use of passkeys, with more than one billion people having already set up the passwordless authentication method on WhatsApp.

A passkey allows users to verify their identity using a fingerprint, facial recognition or the screen-lock credentials on their device, eliminating the need to enter conventional passwords, PINs or verification codes when logging back into an account.

WhatsApp said users who operate both Android and iOS devices can now add multiple passkeys to the same account. The feature can be accessed through Settings > Account > Passkeys.

The latest security update also targets an increasingly common avenue for fraud: calls from unknown numbers. On Android devices, WhatsApp will provide additional information about callers who are not saved in a user’s contacts.

The information can include whether the caller’s number originates from another country and whether the caller shares any WhatsApp groups with the recipient.

“Scammers rely on urgency, now you can take a beat with some more info before answering,” WhatsApp said.

The move comes as messaging platforms increasingly become channels for financial fraud, identity theft, impersonation and social engineering, with criminals often attempting to pressure victims into revealing verification codes or handing over access to their accounts.

WhatsApp has continued to introduce additional safeguards in response. In January, Meta announced its Strict Account Settings feature, a lockdown-style protection designed particularly for people who may face sophisticated cyber attacks, including journalists and public figures. The setting can automatically block attachments and media from unknown senders and silence calls from people users do not know.

In June, WhatsApp also disclosed that it had disrupted spear-phishing attempts linked to spyware firm NSO, after detecting attempts to trick users into clicking malicious links outside WhatsApp. The company said it had taken down associated test accounts and groups.

The latest changes are particularly significant in Nigeria, where mobile messaging and internet services have become deeply embedded in personal communication, business transactions and digital financial activity. The Nigerian Communications Commission’s latest industry statistics show that active GSM data subscriptions stood at more than 157 million in May 2026, underscoring the size of the country’s connected-user base.

For Nigerian users, the security upgrades could provide another layer of defence against account hijacking and impersonation scams, although the effectiveness of such measures will still depend on users enabling the available protections and avoiding the disclosure of verification information.

WhatsApp said its personal messages and calls remain protected by end-to-end encryption by default, meaning they are intended to remain accessible only to the people communicating.

The company said the latest measures form part of its continuing effort to keep users in control of their accounts as threats against digital identities evolve.

“We’ll keep building tools that help you stay in control of your account and boost account security,” WhatsApp said.