WhatsApp privacy and security settings

Ten minutes in WhatsApp's settings closes the doors that most account takeovers and nuisance contacts come through.

On Android, open WhatsApp and tap the three dots, then Settings. On iPhone, tap Settings at the bottom right. The names below are the same on both unless noted.

1. Turn on two-step verification (most important)

Settings › Account › Two-step verification › Turn on. Choose a six-digit PIN and add an email address for recovery. From then on, registering your number on a new phone needs this PIN as well as the SMS code. A fraudster who tricks you out of the SMS code still cannot take the account. Never share this PIN; WhatsApp will ask for it now and then inside the app only, to help you remember it.

2. Check linked devices

Linked devices (Android: three dots › Linked devices; iPhone: Settings › Linked devices). This lists every computer and browser logged in to your WhatsApp. Tap any you do not recognise and choose Log out. Check this whenever something seems odd.

3. Decide who can add you to groups

Settings › Privacy › Groups. Change "Everyone" to My contacts, or "My contacts except..." for stricter control. This stops strangers adding you to investment, job and betting groups. See task scams.

4. Hide your profile photo, About and Last seen from strangers

Settings › Privacy, then set Last seen and online, Profile photo, About and Status to My contacts. Fraudsters copy profile photos to impersonate people to their relatives ("Hi, this is my new number").

5. Silence unknown callers

Settings › Privacy › Calls › Silence unknown callers. Calls from numbers not in your contacts will not ring; they still appear in the Calls tab. This blunts fake-police and sextortion video calls.

6. Protect your account from the lock screen

Settings › Privacy › App lock (Android) or Screen lock (iPhone) to require fingerprint or face to open WhatsApp. In your phone's own notification settings, hide message content on the lock screen so that codes cannot be read from a locked phone.

7. Turn on security notifications and add a passkey

Settings › Account › Security notifications: you are told when a contact's security code changes, which happens when they reinstall or change phone. Settings › Account › Passkeys lets you log in again with your fingerprint or face instead of an SMS code.

8. Encrypt your backup

Settings › Chats › Chat backup › End-to-end encrypted backup. Chats are encrypted in transit, but the backup in Google Drive or iCloud is not unless you switch this on. Keep the password or key safe: without it the backup cannot be restored.

9. Stop automatic downloads and saving

Settings › Storage and data › Media auto-download: untick Documents at least, so that files such as fake .apk "invitations" are not fetched by themselves. See APK file scams. Settings › Chats › Media visibility (Android) or Save to Photos (iPhone) controls whether received pictures land in your gallery.

10. Advanced options

Settings › Privacy › Advanced: "Protect IP address in calls" routes calls through WhatsApp's servers so that the other side cannot see your IP address, and "Disable link previews" stops previews being fetched. Settings › Privacy › Default message timer makes new chats disappear after a set time. Settings › Privacy › Privacy checkup walks through the main choices in one place.

If your WhatsApp is taken over

1. Reinstall WhatsApp and register your number again with the SMS code. This logs the other person out.
2. If it asks for a two-step PIN you did not set, the fraudster set one; you may have to wait seven days to get in without it. Meanwhile, tell your contacts by phone or SMS not to trust messages from your WhatsApp.
3. Once in, turn on two-step verification and log out all linked devices.