🔐 🚨 WhatsApp Just Got More Secure: What the New Security Features Mean for Users

One of the most significant changes is the expansion of passkeys.

WhatsApp says more than one billion people have already set up a passkey.

A passkey allows users to authenticate using:

Fingerprint

Face ID

Device screen lock

rather than relying on a verification code or manually entering a password.

WhatsApp now allows users to add more than one passkey to an account, which is particularly useful for people who use both Android and iOS devices.

Why this matters

Traditional authentication often looks like:

SMS/OTP → User → Account

Passkey authentication shifts the model toward:

Trusted device → Biometric/device authentication → Account

This can reduce exposure to phishing and social-engineering attacks targeting verification codes.

Another new feature is designed to address social engineering.

When an unknown person calls you, WhatsApp will provide additional context on Android, including information such as:

🌍 Whether the number is from another country

👥 Whether you have groups in common

This gives the user more information before answering the call.

This may seem like a small change.

It isn't.

Scammers frequently use:

Urgency + authority + fear

to make victims act before thinking.

Additional context introduces a small but important security pause:

STOP → LOOK → THINK → ANSWER

WhatsApp also has a more restrictive security option called Strict Account Settings.

This is designed particularly for users who may face elevated risks or sophisticated attacks.

When enabled, it applies more restrictive privacy and security controls, including measures such as:

Blocking attachments and media from unknown senders

Silencing calls from unknown people

Restricting certain settings

WhatsApp describes this as a lockdown-style security feature for users facing higher-risk scenarios.

Who might consider it?

For example:

📰 Journalists

👨‍💼 Public figures

The important point isn't any single feature.

It's the security architecture.

Modern WhatsApp attacks may target:

Layer 1 — Identity

“I'm your friend.”

Layer 2 — Urgency

“Do this immediately.”

Layer 3 — Authentication

“Send me the OTP.”

Layer 4 — Device

“Install this application.”

Layer 5 — Recovery

“Your account has been compromised. Click this link.”

Layer 6 — Trust

“I'm calling from WhatsApp support.”

The attacker doesn't necessarily need to break encryption.

They need to convince the user to give them the keys.

Even with stronger security controls, users remain the most important security layer.

Never share:

❌ WhatsApp registration codes

❌ Two-step verification passwords

❌ Passkeys

❌ Device authentication information

❌ Recovery information

with another person.

A legitimate contact saying:

“I accidentally sent my WhatsApp code to you.”

should immediately raise suspicion.

The safest response is:

Do not share the code.

Attackers may send:

“Your account will be suspended.”

“Verify your WhatsApp now.”

“Your account has been reported.”

“Click here to recover your account.”

These messages are designed to create panic.

Before clicking:

STOP.

Ask:

Who sent it?

Why am I receiving it?

Does the link actually belong to the expected service?

Is there another way to verify this information?

Account security doesn't stop with the smartphone.

Regularly check:

WhatsApp → Linked Devices

Look for computers or browsers you don't recognise.

If you see an unknown device:

Log it out.

This is particularly important after:

Losing your phone

Recovering a compromised account

Using WhatsApp Web on a public/shared computer

Clicking suspicious links

Installing questionable applications

End-to-end encrypted backups provide another layer of protection for stored chat backups.

WhatsApp's security guidance notes that encrypted backups can be protected using a password or a 64-digit encryption key.

If you enable encrypted backups:

Protect the backup password/key carefully.

If you lose the recovery information, you may not be able to restore the protected backup.

Avoid installing:

❌ Modified WhatsApp versions

❌ Cracked applications

❌ Unknown APKs

❌ “WhatsApp tracking” applications

❌ Fake security applications

A secure WhatsApp account running on a compromised device is still at risk.

WhatsApp is also developing Scam Alert, an optional feature that uses on-device machine learning to identify patterns associated with potential scam messages.

The technical design is particularly interesting because the message classification is intended to happen on the device, rather than automatically sending message contents to WhatsApp for classification.

The feature is being tested through a limited rollout/Beta process, so users should not assume it is universally available yet.

This represents an important direction:

Security controls are increasingly moving closer to the user's device.

Don't wait for an attack.

Open WhatsApp and review your security settings.

✅ CHECKLIST

☑ Enable stronger two-step verification

☑ Create a unique password

☑ Set up a passkey

☑ Add additional passkeys if appropriate for your devices

☑ Review Linked Devices

☑ Enable App Lock

☑ Review Privacy settings

☑ Review group permissions

☑ Secure your backup

☑ Keep WhatsApp updated

☑ Use an official app-store version

☑ Never share OTPs

☑ Never share your two-step verification password

☑ Treat unexpected links as suspicious

☑ Report and block suspicious accounts

☑ Consider Strict Account Settings if you're at elevated risk

If you believe someone has taken over your WhatsApp account:

1️⃣ Re-register your phone number

2️⃣ Secure your email account

3️⃣ Enable two-step verification

4️⃣ Review Linked Devices

5️⃣ Remove unknown devices

6️⃣ Check for suspicious messages sent from your account

7️⃣ Warn your contacts

8️⃣ Check your device for malicious applications

9️⃣ Review your other accounts for password reuse

🔟 Continue monitoring

Remember:

Recovering the account is not the end of the incident.

It is the beginning of the security review.

WhatsApp's latest features demonstrate an important shift in cybersecurity.

Security is no longer just:

“Build a strong wall.”

It is becoming:

“Build multiple layers so the attacker has more opportunities to be stopped.”

A scammer might bypass one layer.

But if they encounter:

Strong password

↓

Passkey

↓

Two-step verification

↓

Device lock

↓

Linked-device monitoring

↓

User awareness

the probability of successful account takeover becomes much lower.

Use strong two-step verification and passkeys.

👀 VERIFY

Don't trust unexpected calls, messages or links.

🎛️ CONTROL

Review devices, privacy settings and connected access.

Cyber Awareness | Threat Intelligence | Digital Safety