WhatsApp Business Hacks in Pakistan: Locked Out and Ignored

The accounts belong to tailors, pharmacies, spare-parts dealers, tuition centres and online clothing brands. The phone number on the shopfront is the business. When it is taken, the business stops — and what happens next is where the real failure lies.

The Same Story, Told Too Many Times

Speak to Pakistani business owners who have lost a WhatsApp Business account and the sequence barely varies.

First come the verification codes. Not one — four, six, a dozen, arriving over hours or days. Nobody requested them. Most owners describe doing exactly what the message appears to instruct: nothing. The SMS says do not share this code with anyone, so they shared it with nobody and carried on working.

Then the account goes. The phone logs itself out. Customers begin receiving messages the owner never wrote — often a request for money, sent to people who trust that number.

Then comes the part that turns an incident into a catastrophe. The owner tries to get the account back and cannot. Re-registration is refused, or accepted and then frozen. A waiting period appears with no explanation. Appeals return a template. Days become weeks. Orders stop. Customers assume the business is gone, or worse, that it defrauded them.

This article is an editorial. The accounts above were described to us by affected businesses and we present them as testimony, not as a technical finding. But the testimony is consistent enough to be worth taking seriously — and consistent enough to identify precisely where the system failed each of them.

Those Codes Were the Alarm. Nobody Could Hear It.

Here is the single most important fact in this entire article, and it is the one almost every victim learned too late.

An unrequested WhatsApp verification code means somebody is attempting to register your phone number on their device at that moment. It is not spam, not a bug, and not background noise. It is the sound of a break-in in progress.

Ignoring it feels correct. The message tells you not to share the code; it does not tell you that an attack is underway or that there is something urgent you should do. So owners ignored it — and ignoring it is precisely what left the door open.

This is a genuine failure, and it is Meta's. A security warning that does not provoke the one action that would stop the attack is not a security warning. It is a disclaimer. A message reading "Someone is trying to register your number on a new device. If this is not you, turn on two-step verification now", with a button that does it, would have prevented a large share of these takeovers. That message does not exist. The choice not to write it was made in a product meeting, not by a hacker.

How the Code Reached the Attacker Anyway

Owners are adamant they never shared the code, and there is no reason to doubt them. The code does not need to be shared. There are four well-documented routes by which it reaches somebody else.

1. A fraudulently re-issued SIM. Someone obtains a replacement SIM for your number using forged or stolen identity documents. From that moment the SMS goes to them and never reaches you. This is a failure of identity verification at the point of SIM issuance — a telecom and regulatory failure, not a WhatsApp one.
2. Voicemail interception. If the SMS goes unanswered, WhatsApp offers to read the code out in a phone call. If that call goes to a voicemail box still protected by a default PIN, an attacker who dials in can simply listen to it.
3. A linked device. A few seconds with an unlocked phone is enough to link another device, and that session persists silently afterwards. Shared counters, repair shops and family phones are all realistic exposure.
4. Malware with notification access. An app granted permission to read notifications can read an incoming code without ever opening the message.

Notice what all four have in common: a two-step verification PIN would have stopped every one of them. That PIN is never transmitted by SMS, so intercepting SMS does not reveal it. An attacker holding your code and lacking your PIN gets nowhere.

We say this plainly because the alternative framing — that nothing could have been done — is the most dangerous conclusion a reader could take from these events. Something could have been done. It takes under a minute. The failure was that nobody told these owners to do it at the moment it mattered.

The Rule That Punishes the Victim

Prevention is one argument. What follows a takeover is a different and, in our view, less defensible one.

When an attacker takes an account, the first thing they typically do is set their own two-step verification PIN. WhatsApp then enforces a waiting period — commonly seven days — before that number can be registered again by anyone who does not know the PIN.

The intention is sound: it stops an attacker bouncing a victim straight back out. But consider who it actually lands on. The attacker already has the account and does not need to re-register. The person facing the locked door, counting the days, is the rightful owner — and for a business, every one of those days has a price.

Add the ban problem and it compounds. An attacker who blasts messages from a stolen account can get that number flagged for policy violation. The business then faces two separate clocks — the re-registration hold and the ban appeal — for conduct that was not theirs, with no mechanism to say so to a person.

The Support Vacuum

A business with a hijacked bank account can walk into a branch. A business with a hijacked WhatsApp account has a form.

There is no meaningful escalation path for a small merchant in Pakistan. There is no number to call, no office to visit, no case officer, and no paid support tier priced for a shop with four employees. The in-app review request produces an automated acknowledgement and, frequently, an automated refusal. The appeal cannot be supplemented with the evidence the owner actually holds — a CNIC, a business registration, years of message history, customers willing to vouch.

Meta has built a product that functions as critical commercial infrastructure for millions of small businesses in this country, and has staffed its failure path at the level of a free consumer app. That gap is not a technical limitation. It is a decision about what this market is worth.

What It Actually Costs

The losses rarely stop at the account.

• Order flow stops. For businesses that take every order through WhatsApp, this is equivalent to the shutter being locked.
• Customers are defrauded in your name. The most common follow-on is a message to the contact list asking for an urgent transfer. Victims blame the business, and it is the business's reputation that absorbs the damage.
• The customer list is exposed. Chat history, prices, supplier contacts and payment arrangements all sit in the attacker's hands.
• Recovery costs money. Replacement SIMs, lost staff hours, new numbers printed on signage and packaging, and discounts offered to retain customers who were targeted.

Our full recovery guide covers the incident-response steps in detail, and our guide to SIM-swap and OTP fraud covers the attack mechanics.

What Meta and the Operators Should Change

None of the following is technically difficult. All of it is a choice.

1. Rewrite the warning. Say plainly that someone is attempting to register the number, and put a one-tap control to enable two-step verification inside the alert itself.
2. Let users lock registration. Offer an explicit setting that refuses any new device registration outright until disabled from an existing session.
3. Make the seven-day hold work for the owner. Verified ownership — a matching identity document, a long account history, a recovery contact — should shorten it, not be ignored by it.
4. Separate victim from offender. An account reported stolen before a bulk-messaging ban should not be treated as a spammer first and a victim second.
5. Provide a real escalation path for business accounts. A documented route, a response commitment, and a human who can read evidence.
6. Operators and the regulator must close the SIM gap. Fraudulent re-issuance is the root cause in a significant share of these cases, and that sits squarely with the mobile operators and the PTA, not with Meta.

Ten Minutes That Would Have Prevented This

Until any of the above changes, protection is on you. Do these today, on every number your business uses.

1. Turn on two-step verification. Settings → Account → Two-step verification. Choose a PIN you do not use anywhere else and add a recovery email address. This is the single control that defeats the entire attack.
2. Set a voicemail PIN, or disable voicemail. Removes the call-back interception route.
3. Audit linked devices now, and monthly. Settings → Linked devices. Log out anything you do not recognise.
4. Lock your SIM with a PIN in your phone's settings, so a stolen handset does not yield a working SIM.
5. Check which SIMs are registered to your CNIC with your operator, and dispute any you did not authorise.
6. Review notification-access permissions and revoke them for anything that has no business reading your messages.
7. Tell your customers how you will never contact them. State publicly that you will never request money transfers over chat. This single sentence prevents most downstream fraud.
8. Keep a second channel. A landline, a second number, a Facebook page or an email list. If WhatsApp is your only route to customers, a takeover takes your whole business with it.

For the broader principle behind most of this — never trusting a device or session simply because it was trusted before — see our explainer on zero trust for small businesses.

If You Are Locked Out Right Now

1. Tell customers immediately through any other channel that the account is compromised and that no payment request from it is genuine. Do this before anything else; it limits the damage that cannot be undone.
2. Confirm the SIM is still yours. If it has gone dead, go to the operator with your CNIC at once — a fraudulent re-issue is both the likely cause and a reportable offence.
3. Re-register the number in WhatsApp and record exactly what it tells you, including any waiting period.
4. Submit the in-app review request and keep every reference number and screenshot.
5. File with the FIA cybercrime unit in parallel, not afterwards. A reference number is useful evidence and the delay helps nobody.
6. Report the SIM fraud to your operator and, if unresolved, to the PTA. Confirm the current procedure for each, as these change.
7. Warn anyone who was messaged and help them report any transfer immediately — speed matters most in the first hours.

Key Takeaways

• Unrequested verification codes are an attack in progress, not a nuisance.
• Two-step verification defeats this attack even when the attacker has your SMS code.
• The code can reach an attacker through SIM re-issue, voicemail, linked devices or malware — without you sharing anything.
• The seven-day hold and automated bans land on victims, and that is a design choice Meta can change.
• Fraudulent SIM re-issuance is a telecom and regulatory failure that sits with operators and the PTA.
• Never let a single platform be the only route between you and your customers.

Are you a Pakistani business that lost a WhatsApp account this way? We are continuing to document these cases. Tell our editors what happened — including how long recovery took and what response, if any, you received.

Written by the WritePures newsroom. Spotted something that needs updating? Tell our editors.