01 · Definition
What is account takeover?
Account takeover (ATO) is the moment an attacker controls an account that belongs to someone else and can act as its owner: sign in, change settings, read data and send messages under their name. It is an outcome rather than a single technique. Phishing, SIM swap fraud, a brute-force attack and credential stuffing (replaying passwords leaked from other sites) are the routes; the takeover is where they lead.
In WhatsApp business messaging there are three accounts worth taking. The first is a person's Meta account that holds admin rights on the business portfolio: whoever controls it can add users, create system user tokens, change the webhook callback URL or reassign the WhatsApp Business Account. The second is the business phone number itself: anyone who can complete registration for it can try to move it to their own setup, which is why PIN verification (the six-digit two-step verification PIN) matters. The third is your customers' accounts in your own app or website, often protected by one-time codes you send on WhatsApp or SMS.
Defending against ATO is layered. Make credentials hard to steal, with phishing-resistant sign-in such as a passkey or hardware security key. Make a stolen credential insufficient on its own, with two-factor authentication on people and the PIN on the number. Detect unusual sign-ins (new device, new country, recent SIM change) and step up verification. And limit what any one compromised account can do, with least-privilege roles, separate tokens per integration and alerts on admin changes.
Key takeaways
- Account takeover (ATO) is an attacker gaining control of a real account and acting as its owner.
- WhatsApp businesses have three accounts worth taking: Meta admin logins, the business phone number and customers' accounts in your app.
- Most takeovers start with a phished password, a one-time code the victim was tricked into sharing, or a SIM swap that reroutes SMS.
- Phishing-resistant sign-in, the six-digit two-step verification PIN and step-up risk checks close the main routes.
- Phishing and SIM swap fraud are routes in; account takeover is the outcome they lead to.
02 · Specifications
Account takeover: key facts and limits
| WhatsApp-side targets | Meta admin logins, the business number, customer accounts |
|---|---|
| Two-step verification PIN | 6 digits, required at registration once enabled |
| Strongest common factor | Passkey or hardware security key (phishing-resistant) |
| Weakest common factor | SMS code (exposed to SIM swap and social engineering) |
| OTP template safeguard | add_security_recommendation: "do not share" line |
| OTP expiry footer | code_expiration_minutes, 1–90 |
03 · Operation
How does account takeover work?
The attacker obtains a credential
A password typed into a lookalike "Meta support" page, a password reused from a breached site, a one-time code the victim is talked into reading out ("I sent my code to you by mistake"), or SMS codes rerouted after a SIM swap.
They try to sign in or re-register
With an admin password they open Business Settings; with a phone number they start registration on a new device or setup; with a customer's details they hit your app's sign-in or password-reset flow.
The second factor decides the outcome
A passkey or security key will not work on a fake domain, and an authenticator code or two-step PIN the attacker lacks stops the attempt. An SMS code alone fails against a SIM swap.
Risk signals trigger step-up checks
A new device, an unfamiliar country or network, a SIM change in the last few days or a burst of failed attempts should force extra verification, or a cooling-off delay before sensitive actions such as changing the phone number or email.
Blast radius stays small and visible
Least-privilege roles, a separate system user per integration and an audit log of role changes, token creation and webhook edits turn a takeover into a contained incident you can detect within minutes.
04 · Code samples
Account takeover in code
# An OTP template that tells customers never to share the code, and expires it fast.curl -X POST "https://graph.facebook.com/v26.0/{WABA_ID}/message_templates" \-H "Authorization: Bearer {ACCESS_TOKEN}" \-H "Content-Type: application/json" \-d '{"name": "login_code","language": "en_US","category": "AUTHENTICATION","components": [{ "type": "BODY", "add_security_recommendation": true },{ "type": "FOOTER", "code_expiration_minutes": 5 },{ "type": "BUTTONS", "buttons": [ { "type": "OTP", "otp_type": "COPY_CODE", "text": "Copy code" } ] }]}'
add_security_recommendation adds Meta's fixed "do not share this code" line; code_expiration_minutes (1–90) adds an expiry footer.
05Playground
A working model of ATO. Use its controls to replay it step by step.
Follow three takeover routes to the control that stops each
- Phished password to Meta admin login: tries login
- Meta admin login to Passkey or 2FA: challenged
- Shared OTP to Customer account: code used
- Customer account to Step-up checks: new device
- SIM swap to Business number: SMS rerouted
- Business number to Two-step PIN: PIN asked
- SIM swap to Customer account: OTPs seen
Hop 7 of 7
SIM swapCustomer accountOTPs seen
Arrives at Customer account — your app's sign-in.
Hop 7 of 7: SIM swap to Customer account — OTPs seen.
06 · Cautions
Common mistakes with account takeover
Relying on SMS codes alone
A SIM swap or a convincing phone call defeats them. Offer passkeys or authenticator apps for staff and high-value customers, and keep SMS as a fallback rather than the default.
Leaving the number without a two-step PIN
Without the PIN, whoever completes registration can try to take the number. Turn on two-step verification, keep the PIN in a password vault and share it with as few people as possible.
Sharing one admin login across the team
A shared Meta login has no personal second factor and no useful audit trail. Give every person their own account with two-factor authentication, and keep full admin rights to two or three people.
Not alerting on admin changes
Attackers quietly add an admin, create a token or change the webhook URL first. Alert on those events in real time so a takeover is caught in minutes, not at the next monthly review.
07 · Worked example: A wallet takeover stopped at the step-up check
Example: A wallet takeover stopped at the step-up check
A Surat fintech app signs customers in with a WhatsApp OTP. A fraudster who already has a customer's phone number and date of birth calls her posing as the app's support desk and talks her into reading out the login code. He signs in from a new Android device in another state within a minute. The app's risk engine scores the attempt: unknown device, new location and a payout-account change requested straight after login. Instead of completing the change, it asks for the customer's existing passkey and holds payout edits for 24 hours, while a notice goes to her known device. She taps "This wasn't me", the session is killed and the wallet balance never moves. Because Meta fixes the authentication template's wording, the team keeps the do-not-share line switched on, adds "we will never call you for this code" to its login screen, and tightens the cooling-off rule for new devices.
08 · Rationale
Why does account takeover matter?
A hijacked admin account or number does damage at the speed of an API. An attacker can message your customers under your verified business name, export contact lists, point the webhook at their own server so replies flow to them, or get the number restricted by sending spam, and regaining control through Meta support can take days. On the customer side, every takeover of an account you protect becomes a fraud loss, a support case and a story about your brand. Preventing ATO is far cheaper than recovering from it.
09 · Recommended practice
Best practices for account takeover
- Make two-factor authentication mandatory for everyone with access to the business portfolio, not just admins.
- Send the security recommendation in every authentication template and keep codes valid for minutes, not hours.
- Before a password or phone-number change, notify the old channel and add a short delay for risky sessions.
- Rehearse recovery: know who holds the PIN, who the backup admins are and how to revoke system user tokens fast.
10 · Questions and answers
ATO FAQs
- What is the difference between account takeover and phishing?
- Phishing is one way in; account takeover is the result. A phishing page steals a password or code, and the takeover happens when the attacker uses it to control the account. SIM swaps, brute force and reused passwords lead to the same outcome.
- Can someone hijack my WhatsApp Business API number?
- They can try if they can complete registration for it, which is why the two-step verification PIN matters. Once the six-digit PIN is enabled, registration also requires it, so keep it in a vault and limit who knows it.
- What should I do if my Meta business admin account is compromised?
- Secure the person's account first, then remove what the attacker added. Reset the password, re-enable two-factor authentication, check Business Settings for new people, system users, tokens and webhook changes, revoke anything unknown and contact Meta through its official support channels if access is lost.
- Does sending OTPs on WhatsApp instead of SMS prevent account takeover?
- It helps against SIM swap interception, but only partly. A customer's WhatsApp account can itself be hijacked if they share their registration code, so keep codes short-lived, include the do-not-share line and add risk checks.