WhatsApp Beefing Up Security With Strong Passwords and MFA

Meta messaging platform, WhatsApp, has introduced a new set of account security measures with stronger two-step verification, support for multiple passkeys and additional information about calls from unknown numbers.

This is aimed at strengthening protection against account takeover and scams.

The company said the measures were designed to give users greater control over their accounts while building on the end-to-end encryption that protects personal messages and calls by default.

One of the major changes is an upgrade to WhatsApp’s two-step verification system, through which users can now use a full password instead of the previous six-digit PIN, with the password supporting longer combinations of letters, numbers and special characters.

WhatsApp said the stronger password option is intended to make it more difficult for criminals to guess or compromise the additional security layer, particularly in situations where a user’s one-time registration code has been obtained by an attacker.

“Two-step verification is an extra protection layer that helps prevent someone from taking over your account, even if they get a hold of your one-time passcode.

“Until now, it was a six-digit PIN, but we’ve upgraded it to a full password: longer, alphanumeric, and even with special characters to make it harder to guess,” WhatsApp said.

The platform is also expanding the use of passkeys, with more than one billion people having already set up the passwordless authentication method on WhatsApp.

A passkey allows users to verify their identity using a fingerprint, facial recognition or the screen-lock credentials on their device, eliminating the need to enter conventional passwords, PINs or verification codes when logging back into an account.

The social media firm said users who operate both Android and iOS devices can now add multiple passkeys to the same account. The feature can be accessed through Settings > Account > Passkeys.

The latest security update also targets an increasingly common avenue for fraud: calls from unknown numbers.

On Android devices, WhatsApp will provide additional information about callers who are not saved in a user’s contacts.

The information can include whether the caller originates from another country and whether the caller shares any WhatsApp groups with the recipient.

“Scammers rely on urgency, now you can take a beat with some more info before answering,” The platform said.

The move comes as messaging platforms increasingly become platforms for financial fraud, identity theft, impersonation and social engineering, with criminals often attempting to pressure victims into revealing verification codes or handing over access to their accounts.

WhatsApp has continued to introduce additional safeguards in response. In January, Meta announced its Strict Account Settings feature, a lockdown-style protection designed particularly for people who may face sophisticated cyber attacks, including journalists and public figures. The setting can automatically block attachments and media from unknown senders and silence calls from people users do not know.

WhatsApp in June this year disclosed that it had disrupted spear-phishing attempts linked to spyware firm NSO, after detecting attempts to trick users into clicking malicious links outside WhatsApp. The company said it had taken down associated test accounts and groups.

The latest changes are particularly significant in Nigeria, where mobile messaging and internet services have become deeply embedded in personal communication, business transactions and digital financial activity.