It usually arrives from a friend's account: 'Hey, I accidentally sent you my 6-digit code — can you forward it?' The friend is real; their account is already stolen. And if you forward that code, yours is next.

What the code actually is

That 6-digit number is WhatsApp's registration code. Whoever has it can register your number on their phone — taking over your account, your chats, and your contact list. The 'sent by mistake' story exists only to get you to hand it over.

Why it spreads so fast

Once an account is taken over, the attacker messages that person's whole contact list with the same trick. Because it comes from someone you trust, the success rate is high. That's social engineering, not hacking.

What to do right now

Never share a code you didn't request — no legitimate service needs you to read one back to another person. Turn on two-step verification (Settings → Account → Two-step verification) so a stolen code alone isn't enough. If a contact sends you this message, call them: they probably don't know they've been compromised.

If your account was already taken

Re-register your number on your own phone with a fresh code — this kicks the attacker off. Then immediately set the two-step PIN. Warn your contacts that any money requests from you in the last hours were not you.

Losing an account is stressful, especially when the attacker changes the email so the normal 'forgot password' no longer reaches you. Work through these steps in order — most people recover within a few days.

Step 1 — Try the login help flow

On the login screen, tap 'Forgot password', then 'Need more help?'. Instagram can send a recovery link to the email or phone originally on the account, even if the attacker added a new one.

Step 2 — Use the 'My account was hacked' path

If the credentials were changed, choose the hacked-account option. Instagram will ask you to verify your identity — often with a video selfie if the account has photos of you. This is the strongest route when the email was changed.

Step 3 — Check your email for the 'email changed' notice

When an attacker changes your email, Instagram emails the ORIGINAL address with a 'revert this change' link that's valid for a short window. Search your inbox (and spam) for it — one tap can undo the takeover.

Step 4 — Lock it down after recovery

Once you're back in: change the password, remove unknown devices (Settings → Security → Login activity), turn on two-factor with an authenticator app (not SMS), and review connected apps.

How to avoid a repeat

The takeover almost always started with a phishing link or a reused password. Use a unique password and an authenticator app, and never log in through a link someone sent you — open the app directly.

Two-factor authentication (2FA) adds a second step beyond your password — so a stolen password alone won't unlock your account. It's the highest-impact thing you can do for security. But not all 2FA is equal.

The ranking, worst to best

SMS codes: better than nothing, but vulnerable to SIM swapping. Authenticator apps (codes that refresh every 30 seconds): much stronger, free, and work offline. Physical security keys: the strongest, phishing-resistant, ideal for your most important accounts.

Why SMS is the weak link

If an attacker convinces your mobile carrier to move your number to their SIM (a 'SIM swap'), they receive your SMS codes. Authenticator apps live on your device and aren't tied to your phone number, so a SIM swap doesn't help the attacker.

How to set up an authenticator app

Install a reputable authenticator. In each account's security settings, choose 'Authenticator app', scan the QR code, and enter the 6-digit code to confirm. Save the backup codes somewhere safe — they let you back in if you lose your phone.

Don't lock yourself out

Back up your authenticator (most offer encrypted cloud backup) or keep printed backup codes. Add 2FA to your email first — it's the master key that can reset everything else.

The most costly WhatsApp scams don't hack anything — they impersonate someone you love and manufacture urgency. Recognize the script and it loses all its power.

The script

A message from an unknown number: 'Hi Mom, this is my new number — my phone broke.' Then, once you reply, an urgent request: a bill they can't pay, a transfer that's 'stuck', a code they need. The urgency is deliberate — it stops you from checking.

The one question that ends it

Call the person on their known number, or ask something only the real person would know. Scammers can't pass this. Never act on a money request from a 'new number' without verifying through a separate channel.

Red flags in one glance

A new or foreign number claiming to be family; urgency ('right now', 'before 5pm'); a request to pay a third party or share a code; resistance to a phone call. Any one of these should stop you.

Protecting older relatives

These scams target parents and grandparents hardest. Share this script with them, agree on a family 'safe word' for emergencies, and tell them it's always okay to hang up and call you back.

Every parent wants their child safe online. The instinct to secretly monitor everything is understandable — but it tends to break trust and teaches kids to hide rather than to come to you. There's a better, evidence-based approach.

Start with the account settings

The highest-impact step is making accounts private and limiting who can message your child. On every platform: set the account to private, restrict DMs to friends, turn off location sharing, and disable 'suggest my account to others'. We have per-platform guides linked below.

Build the habit of talking

Kids who know they can tell a parent about a creepy message — without losing their phone — actually report problems. Agree early that they can always come to you, that you won't overreact, and that the goal is their safety, not punishment.

Know the real warning signs

Rather than reading every message, watch for changes: a new 'friend' they're secretive about, switching screens when you walk by, a sudden mood shift after being online, new gifts or money you can't explain. These matter more than any single chat.

Age-aware expectations

Younger children: shared devices in common spaces, strong defaults, no private accounts. Teens: more autonomy, but clear agreements about strangers, sharing images, and reporting. Monitoring that fits a 9-year-old will backfire with a 15-year-old.

When to step in

If you see signs of grooming, bullying, or contact from an adult stranger, act: document it, report it to the platform, and contact your local authorities or a child-protection helpline. Protective action is different from routine surveillance.

Lectures bounce off teenagers. A short, respectful conversation that treats them as capable is far more effective — and it's what makes them tell you when a stranger crosses a line.

Open without accusation

Start from curiosity, not suspicion: 'Has anyone online ever messaged you that felt weird?' Most teens have a story. Listening without punishing is what keeps the channel open.

Name the real tactics

Explain how online predators actually operate: they're patient, flattering, and pretend to be a peer; they move the chat to a private app; they ask for secrecy and, eventually, images. Naming the playbook makes it recognizable.

Agree on clear lines

No meeting online-only contacts in person without you knowing. No sharing images — once sent, they're gone. Anything that asks for secrecy from you is itself the warning sign. Keep the rules few and firm.

Make reporting safe

The deal: if something feels wrong, they tell you and they won't lose their phone for it. That single promise does more for safety than any monitoring app, because it turns you into their first call instead of their last.

Most account takeovers start with a link, not a hack. You click, a page that looks exactly like Instagram or your bank asks you to log in, and your password goes straight to the attacker. Here's how to catch it.

Check the real address

Before typing anything, look at the domain — the part right before the first single slash. 'instagram.com.login-verify.co' is NOT Instagram; the real domain is 'login-verify.co'. Attackers hide the fake domain behind familiar words.

Watch for urgency and fear

'Your account will be deleted in 24 hours', 'suspicious login detected, verify now'. Urgency is engineered to stop you checking. Real providers don't threaten instant deletion over a link.

The habit that beats phishing entirely

Never log in through a link someone sent you. If a message says there's a problem with your account, open the app or type the address yourself. This single rule defeats almost every phishing attempt, no matter how convincing the page looks.

If you already entered your password

Change it immediately on the real site, enable 2FA, and check login activity for unknown sessions. If you reused that password elsewhere, change it there too.

SIM swapping is how attackers defeat SMS-based security. They don't touch your phone — they convince your carrier to move your number to a SIM they control. Suddenly your calls, texts, and verification codes are theirs.

How the attack works

Using personal details gathered from leaks and social media, the attacker calls your carrier posing as you and reports a 'lost phone', requesting the number be moved to a new SIM. If the carrier's checks are weak, it works in minutes.

The warning sign

Your phone suddenly loses all signal and shows 'No SIM' or 'SOS only' for no reason. If that happens unexpectedly, treat it as urgent — call your carrier from another phone immediately.

How to block it

Add a port-out PIN or 'number lock' with your carrier (most offer this free). Move important accounts off SMS 2FA to an authenticator app. Keep your birth date and other verification details off public profiles.

If it happens to you

Call your carrier to reclaim the number, then rush to secure your email and financial accounts — those are the real targets. Change passwords and check for unauthorized access.

Snapchat's Snap Map shows a user's real-time location to everyone on their friend list, down to the street. For a teen whose friend list includes people they've never met, that's a real risk worth a two-minute fix.

Turn on Ghost Mode

Open the Map, tap the settings gear, and enable 'Ghost Mode' — this hides location from everyone. It's the single most important Snapchat setting for safety, and it's off by default.

Understand disappearing messages

Messages vanishing doesn't mean they're gone — recipients can screenshot or record them. Make sure younger users know nothing sent is ever truly temporary.

Tighten who can contact them

In settings, set 'Contact Me' and 'See My Location' to 'My Friends' only, and review the friend list together for anyone unknown.

The conversation that matters

Settings help, but a teen who understands why location sharing with strangers is risky will make better choices on every app, not just this one.

The biggest password mistake isn't a weak password — it's the same password everywhere. When one site is breached, attackers try that email-and-password combo on every other service. A password manager removes the problem entirely.

Why reuse is so dangerous

Billions of leaked credentials are freely traded. 'Credential stuffing' tools try them automatically across banks, email, and social media. If your password is unique per site, a single breach stays contained.

What a password manager does

It generates a long, random password for every account and remembers them, so you only memorize one strong master password. Logging in becomes a tap, and every account gets a password no human could guess.

Choosing and starting one

Pick a reputable manager (built into your browser or phone is a fine start). Import saved passwords, then change the reused ones for important accounts first: email, banking, and your main social accounts.

Pair it with 2FA

A password manager plus two-factor authentication on key accounts is the practical gold standard for most people — strong, and low-effort once set up.

Online grooming is deliberate and patient, and it leaves signs. You don't need to read every message to catch it — you need to know the pattern and watch behavior.

The grooming pattern

It typically starts with flattery and shared interests, moves quickly to a private app, builds secrecy ('this is just between us'), and escalates toward images or meeting. Gifts, game credits, or money may appear. Each step is designed to isolate the child from adults.

Behavioral warning signs

A child who becomes secretive about a new online 'friend'; switches screens when you approach; is upset or withdrawn after being online; receives gifts or money you can't explain; or has new accounts you didn't know about. Patterns matter more than any single clue.

What to do if you're worried

Stay calm and don't confront the child angrily — they need to feel safe telling you the truth. Preserve evidence (screenshots, usernames), stop the contact, and report it to the platform and to your local police or a child-protection hotline.

Prevention that works

Private accounts, restricted messaging, and an ongoing, judgment-free conversation are the strongest prevention. A child who knows they can come to you is far safer than one who's only being watched.

Public Wi-Fi is less dangerous than it was a decade ago — but 'less' isn't 'not'. Here's a clear-eyed look at the real risks and what's worth doing.

What's already protected

Almost every serious site and app now uses encryption (HTTPS). On those, someone on the same network can't read your messages, passwords, or banking details — the content is scrambled.

What's still exposed

Which sites you visit can sometimes be seen, and any old app or site without encryption is readable. 'Evil twin' networks — fake hotspots named like the café's — can trick your device into connecting to an attacker.

The simple protections

Avoid logging into sensitive accounts on unknown networks when you can. Use your phone's hotspot for anything important. A reputable VPN encrypts everything and is worth it if you use public Wi-Fi often.

For families

Teach kids not to join random open networks and to be suspicious of a hotspot that asks them to 'log in' with a social account — that's a common data grab.

Impersonation is simple and effective: someone copies your name and photos, then messages your friends asking for money or codes. You often find out only when a friend asks why you're acting strangely.

How to spot a clone

A duplicate of your profile with a slightly different username; a brand-new account with few posts but your photos; friends reporting odd messages 'from you'. Scammers rely on speed before anyone notices.

Reduce the raw material

Impersonators need your photos and friend list. Setting your profile to private and limiting who can see your friends/followers makes cloning far harder.

How to report fast

Every major platform has an 'impersonation' report option — use it, and ask a few friends to report the fake too; multiple reports speed removal. Post a quick warning on your real account so contacts don't fall for it.

If a friend is cloned

Tell them through a separate channel, report the fake, and never send money or codes to a 'new account' of someone you know without verifying by call.