WhatsApp is strengthening the security of its platform with a series of new features aimed at making account protection more robust and easier for users to manage. The latest measures include stronger two-step verification, support for multiple passkeys and additional information about calls from unknown numbers.

The changes come at a time when online fraud, phishing, social engineering and account takeover attempts are becoming increasingly sophisticated. Rather than relying only on users to identify suspicious activity themselves, the new features are designed to provide additional warnings and security layers at important points where accounts can be targeted.

WhatsApp already uses end-to-end encryption for personal messages and calls. However, protecting the account itself is a separate security challenge. Criminals may attempt to obtain verification codes, persuade users to transfer their accounts to another device or manipulate them into responding to suspicious calls and messages.

The latest updates are intended to make such attacks more difficult.

Stronger Two-Step Verification

One of the most significant changes involves WhatsApp’s two-step verification system.

Previously, users could protect their accounts with a six-digit PIN in addition to the one-time verification code used during account registration or transfer. The additional PIN was designed to provide another barrier against unauthorised account takeovers.

Under the new system, users can create a stronger password instead of relying solely on a six-digit numerical PIN. The password can be longer and can contain a combination of letters, numbers and special characters.

This change is important because a stronger password can be considerably harder for an attacker to guess than a short numerical PIN. It also gives users greater flexibility in creating an additional authentication layer for their WhatsApp accounts.

Two-step verification remains particularly important because obtaining a one-time verification code does not necessarily mean an attacker should be able to take complete control of an account. The additional password acts as another layer of protection.

Users should still avoid sharing verification codes or authentication details with anyone, even if the request appears to come from a friend, company or other trusted source.

More Information About Unknown Callers

WhatsApp is also adding more context to calls from people who are not saved in a user’s contacts.

On Android devices, users will be able to see additional information about an unknown caller, including whether the caller’s number is registered in another country and whether the caller shares any WhatsApp groups with them.

The purpose is to give users more information before they decide whether to answer.

Unknown calls are frequently used as part of social-engineering attempts. A scammer may call unexpectedly and attempt to create a sense of urgency, eventually asking the victim to reveal personal information, transfer money or share an authentication code.

Providing additional context does not automatically identify every fraudulent caller, but it can give users a reason to pause before responding.

For example, an unexpected call from an international number combined with no common groups may encourage a user to reconsider whether answering is necessary.

Multiple Passkeys Can Now Be Added

WhatsApp is also expanding its support for passkeys.

Passkeys provide an alternative to traditional passwords and authentication codes. Instead of manually entering credentials, users can authenticate through security mechanisms already available on their device, such as a fingerprint, Face ID or the device’s screen-lock credentials.

The technology is designed to reduce dependence on passwords and one-time codes, which can be targeted through phishing and other forms of social engineering.

The latest update allows users to add more than one passkey to their WhatsApp account. This can be particularly useful for people who regularly use multiple devices or operate across different mobile platforms.

For example, someone who uses both an Android smartphone and an iPhone can have more than one passkey associated with the account, making account access more convenient without abandoning stronger authentication.

WhatsApp says more than one billion people have already set up a passkey, highlighting the growing adoption of passwordless authentication.

Users can access the passkey option through Settings > Account > Passkeys.

Why These Security Updates Matter

The latest changes reflect a broader shift in how technology companies are approaching online security.

Cybercriminals increasingly rely on psychological manipulation rather than attempting to break encryption directly. Phishing messages, fake support requests, fraudulent verification processes and deceptive device-linking requests can trick people into giving attackers access voluntarily.

This means security cannot depend entirely on technical protections operating in the background. Users also need clear warnings and additional context at the moment when a potentially dangerous action is taking place.

WhatsApp has previously introduced warnings designed to prevent scammers from tricking users into linking their accounts to unauthorised devices. Such attacks can involve convincing a person to provide a device-linking code or scan a QR code under false pretences.

The new security measures build on that broader approach by strengthening authentication and giving users more information before they interact with unfamiliar callers.

Passkeys Offer Protection Against Phishing

A major advantage of passkeys is that they are designed to reduce exposure to traditional phishing attacks.

Passwords can be copied or entered into fraudulent websites. One-time codes can also be manipulated through social engineering. Passkeys work differently because authentication is tied to the user’s device and its built-in security mechanism.

An attacker attempting to remotely access an account would generally face a much greater challenge if the required authentication credential is protected by the user’s device.

For users, this means that enabling a passkey can provide both stronger security and a simpler login experience.

However, no single security feature can eliminate every risk. Users should continue to protect their phones, use device screen locks, avoid suspicious links and never disclose authentication codes or passwords to other people.

WhatsApp’s Wider Push Against Scams

The latest account-security changes are part of a wider effort to address the increasing threat posed by scams and account compromise.

Messaging platforms have become attractive targets because users frequently exchange personal information, financial details, photographs, documents and links through them. A compromised account can also be used to impersonate the victim and target their friends, relatives or colleagues.

Scammers may exploit trust by sending messages that appear to come from someone the victim already knows. In some cases, the attacker may first compromise one account and then use it to target additional people.

This makes account security important not only for protecting an individual user but also for limiting the spread of fraudulent activity through their contacts.

What WhatsApp Users Should Do

Users can take several practical steps to improve the security of their accounts alongside the new features.

First, two-step verification should be enabled and protected with a strong, difficult-to-guess password. Users should also consider setting up a passkey where the feature is available.

Second, unexpected calls from unknown numbers should be treated cautiously, particularly when the caller immediately asks for money, personal information or an authentication code.

Third, users should never share WhatsApp verification codes with another person. A legitimate contact or support representative should not require users to disclose such codes.

Users should also be cautious when asked to scan a QR code or enter a linking code to connect another device. If the request is unexpected, it may be an attempt to gain access to the account.

Security Becomes a Bigger Priority for Messaging Platforms

As messaging services become increasingly central to everyday communication, protecting accounts has become just as important as protecting the messages themselves.

WhatsApp’s latest measures focus on several stages of the account-security process: preventing unauthorised takeovers, strengthening authentication, making account recovery and login more secure, and giving users additional information when they receive calls from unfamiliar people.

The broader message for users is straightforward: stronger security tools are most effective when they are enabled and used carefully.

With stronger two-step verification, multiple passkeys and additional caller information now being introduced, WhatsApp is giving users more ways to keep control of their accounts while making common avenues of attack more difficult for scammers to exploit.