WhatsApp Passkeys Now Protect Over 1 Billion Users Against Account Takeover Attacks

WhatsApp has announced that over one billion people now use passkeys to secure their accounts, enhancing phishing-resistant authentication across one of the world’s largest messaging platforms.

This update, revealed on August 25, introduces support for multiple passkeys, stronger two-step verification credentials, and additional context for calls from unknown numbers.

These changes target common account takeover methods, including social engineering attacks that exploit one-time passwords, theft of SMS verification codes, number reassignment abuse, and scam calls that pressure victims into revealing their credentials.

WhatsApp Passkeys Protect Users

A passkey allows users to log back into WhatsApp using a device-bound authentication method, such as a fingerprint, Face ID, or screen lock code.

This approach eliminates the need for users to enter a verification code or PIN manually; instead, the login process relies on an authentication mechanism linked to the device and protected by the user’s local unlock method.

This method reduces the effectiveness of credentials harvested from phishing sites or obtained through scammers impersonating WhatsApp support, friends, family members, or business contacts.

Even if an attacker tricks a victim into sharing an SMS code, they may still encounter an additional authentication barrier if a passkey protects the account.

WhatsApp describes passkeys as the fastest and most secure way to confirm account ownership. Users can set up this feature by navigating to Settings > Account > Passkeys.

Additionally, the platform now supports multiple passkeys for the same account, allowing users who switch between Android and iOS devices to register authentication methods on both platforms.

The platform is also replacing its current six-digit two-step verification PIN with a more robust password option. Users will be able to create longer alphanumeric passwords that include special characters, enhancing resistance to guessing, brute-force attacks, and weak PIN reuse.

Two-step verification will continue to serve as a separate security layer designed to block unauthorized account registration, even if an attacker obtains a one-time login code.

The password upgrade is particularly significant for users who tend to use predictable numeric PINs, such as “123456.” While a password alone does not eliminate the risks of device compromise or social engineering, longer, more complex credentials can increase the effort required for an attacker to take over an account.

Furthermore, WhatsApp is introducing caller-context indicators for Android users who receive calls from numbers not saved in their contacts. The interface will display whether an unknown caller is located in another country and if the recipient shares any WhatsApp groups with that number.

This added context can help users identify suspicious calls before answering. Fraud campaigns often exploit urgency, unfamiliar international numbers, and apparent community connections to establish trust. By providing additional metadata during the call stage, WhatsApp aims to give users a moment to assess the caller’s legitimacy.

These new features reinforce a layered-defense model: passkeys enhance login verification, stronger passwords improve two-step verification, and caller context helps reduce exposure to social engineering before a conversation begins.

Researchers discovered a 160 MB operational archive containing 1,395 files generated over about 4 days of activity, from July 1 to July 4, 2026.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC