Key takeaway

Only scan or approve a WhatsApp linking code when you opened the official app and started the process yourself.

A QR code can be harmless, but a WhatsApp linking flow grants access to an account when it is approved in the wrong context. Scammers use fake support messages, delivery claims and urgent account warnings to make a victim act before thinking.

Never install a remote-access app because a stranger says it is needed to fix WhatsApp. Never share a six-digit registration code, and do not approve a device that you did not intentionally set up. A person who controls a linked session may be able to read and send messages while the scam continues.

Check the account from inside WhatsApp. Review linked devices, remove anything unfamiliar and enable two-step verification. If you are locked out, use the official recovery path and warn contacts that recent messages may not be from you.

Businesses should create a simple rule: staff do not approve account links or share verification codes in response to unsolicited calls. A real help process can be verified through a known internal channel rather than a number supplied by the caller.

Safety note

Use official channels to verify this information. Never share a password, OTP, PIN or full card details with someone who contacts you unexpectedly.

Step-by-step

Stop and ask who initiated the linking request and why it is needed.

Open WhatsApp directly and inspect Linked devices, not a link supplied in a message.

Log out unfamiliar sessions and turn on two-step verification.

Recover the account through official support and alert contacts if messages were sent.

Frequently asked questions

Can a QR code install malware by itself?

A QR code usually opens a link or begins an action; the risk depends on what you are directed to approve, download or share.

What if I already approved the link?

Open Linked devices, remove the unknown session, secure the account and contact official support if access has changed.

Should I pay someone to recover my account?

Be wary of unofficial recovery agents. Use the platform’s official recovery process.

Found an error, outdated step or safety concern? Contact the desk.