WhatsApp is one of the world’s most widely used messaging apps, connecting billions of people every day. Because it’s so widely used, cybercriminals also often target WhatsApp users. Account takeovers, phishing attempts, and unwanted contact are constant threats. Meta knows that adequate security matters, and last month it began rolling out changes that make it harder for unauthorized people to access chats and give WhatsApp users more context before they answer a call. These updates focus on three main security areas. Stronger two-step verification, better information about calls from unknown numbers (on Android), and more flexible passkey use.
Key Takeaways
- WhatsApp is replacing its multi-digit two-step verification PIN with a stronger full password to better resist guessing and brute-force attacks.
- On Android, WhatsApp now shows useful extra details—such as the caller’s country and any shared groups.
- Users can add multiple passkeys to the same account (including separate ones for Android and iOS), making secure biometric logins more practical across devices.
- WhatsApp users should enable the new features promptly, treat unexpected contacts with caution, keep apps updated, and use reliable antivirus software.
Why Is WhatsApp Replacing the Multi-Digit PIN with a Password?
WhatsApp is rolling out a multi-digit PIN-to-password swap to improve security. For years, enabling two-step verification on WhatsApp meant creating a multi-digit PIN. Even if someone intercepted the one-time code sent by SMS, the fraudsters would still need the PIN to register a number on a new device. However, over the years, Meta realized that a numeric PIN is relatively easy to guess or brute-force compared with a proper password. This is why WhatsApp is now replacing the PIN with a full password that can include letters, numbers, and special characters. Even though it may feel like a small change, it significantly raises the bar for account takeovers, as complex passwords resist automated attacks and casual guessing far better than a short numeric code.
Will There Be Extra Information on Calls and Messages from Unknown Numbers?
Yes, they are gradually rolling out to all WhatsApp users. On Android, WhatsApp now shows useful details when someone not in a person’s contact list tries to call that same individual (such as the caller’s country and any shared groups). A similar warning also appears on both Android and iOS before a WhatsApp user opens a chat with an unknown number, showing the same kind of context. These signals don’t prove a call is legitimate or malicious, but they give users extra information before they decide to answer a call or accept a message. Scammers often use phone calls to pressure people into sharing codes, installing apps, or transferring money. Extra context can help users spot red flags earlier—especially when the call originates from an unexpected country or comes from someone with no shared connections.
How Are Passkeys Becoming More Useful Across Devices?
Passkeys have always offered a convenient alternative to passwords and SMS codes. Instead of typing a password or a PIN, WhatsApp users can confirm their identity with the biometrics or screen lock already set up on a smart device (fingerprint, Face ID, PIN, etc.). WhatsApp stated that more than one billion users have already created a passkey for their accounts. This isn’t a secret, as the update makes passkeys much more practical for people who switch between platforms. Users can now add multiple passkeys to the same account, including separate ones for Android and iOS devices. Managing them is easy: users can go to Settings > Account > Passkeys in the app. Passkeys resist phishing because there is no shared secret for an attacker to steal and reuse on another site.
Do These Security Updates Matter for Everyday Users?
They do! Account security on messaging apps isn’t just about privacy—it protects other sensitive information, such as conversations, photos, and business communications. SIM-swapping and social-engineering attacks remain common ways criminals try to hijack WhatsApp numbers, and a stronger two-step verification password directly addresses the weakness of short numeric PINs. The better call context feature helps users avoid social-engineering calls. Multiple passkeys also make secure login less cumbersome without sacrificing protection.
While any new security additions to the messaging app are welcome, they don’t make the app bulletproof. New features are only as effective as the steps people take, such as enabling two-step verification and updating to the new password system as soon as it becomes available. People should always treat unexpected calls or messages with skepticism and keep all apps up to date.
Last but not least is the importance of having strong antivirus software installed on all devices – even if a sneaky malicious link or a call makes it through the filters, a reliable antivirus software solution would deal with it immediately and alert the user about the danger.
