Avoid giving away access to your account, and know the first steps if you've already lost it.
The code from your messaging app is the way in
How people hand over their accounts themselves
Accounts get hijacked not by hacking but by your own hands. The classic approach is a request from someone you know: “Vote for my niece in a contest — you enter your number and a code, it's to stop fake votes.” The page looks decent and the request seems genuine — except your friend's account isn't theirs anymore.
There's one sign here: a vote is never a way to sign in to a messaging app. If an outside page asks for your phone number and a code that will be sent to you, it's a sign-in form. The code you enter opens your account on someone else's device: your chats, contacts, and voice messages go with it, and then your own people are asked for money in your name.
The second approach comes in the government's name: an email saying “your account will be deleted in 24 hours, confirm it,” with a link. Login.gov never calls you or asks for codes, and real notices show inside the account itself. The rule is simple: go there through your own route — the app or a bookmark — not through a link in an email.
What protects you in advance: a two-step verification password in your messaging app (Settings → Privacy and Security → Two-Step Verification) — without it, an account given away by a code can't be saved; two-factor authentication in your other services; and a password manager, which simply won't fill in your password on a look-alike site.
Lesson notes
How people hand over their accounts themselves
Accounts get hijacked not by hacking but by your own hands. The classic approach is a request from someone you know: “Vote for my niece in a contest — you enter your number and a code, it's to stop fake votes.” The page looks decent and the request seems genuine — except your friend's account isn't theirs anymore.
There's one sign here: a vote is never a way to sign in to a messaging app. If an outside page asks for your phone number and a code that will be sent to you, it's a sign-in form. The code you enter opens your account on someone else's device: your chats, contacts, and voice messages go with it, and then your own people are asked for money in your name.
The second approach comes in the government's name: an email saying “your account will be deleted in 24 hours, confirm it,” with a link. Login.gov never calls you or asks for codes, and real notices show inside the account itself. The rule is simple: go there through your own route — the app or a bookmark — not through a link in an email.
What protects you in advance: a two-step verification password in your messaging app (Settings → Privacy and Security → Two-Step Verification) — without it, an account given away by a code can't be saved; two-factor authentication in your other services; and a password manager, which simply won't fill in your password on a look-alike site.