WhatsApp has rolled out a set of new security features aimed at making it harder for attackers to take over accounts. The updates include a stronger option for two-step verification, support for multiple passkeys and additional information for calls from unknown numbers.
The changes come as phishing attempts, hacking and other online scams become increasingly sophisticated, making account security a growing concern for messaging app users.
Stronger protection with two-step verification
WhatsApp’s existing two-step verification adds a six-digit PIN as an extra layer of protection. It is designed to help prevent account takeovers even if someone obtains a user’s one-time passcode.
With the latest update, users can choose a longer password instead of the six-digit PIN. The new password can contain letters, numbers and special characters, providing an additional layer of protection against attempts to guess the security code.
Multiple passkeys on one account
WhatsApp is also expanding its passkey support by allowing users to register more than one passkey on the same account.
The option could be useful for people who regularly use multiple devices, including those who switch between iOS and Android devices.
WhatsApp introduced passkey support in 2024. Unlike conventional passwords, passkeys allow users to authenticate themselves using built-in device security features such as Face ID or a fingerprint.
How passkeys protect accounts
Passkeys are designed to reduce the risks associated with traditional passwords, which can be stolen through phishing or other attacks.
Instead of relying on a username and password combination, passkeys use cryptographic credentials linked to a user’s device. Access can be verified through the device’s biometric authentication or other supported security method.
The approach also makes remote account access more difficult for attackers because they would need access to the device storing the user’s part of the passkey.
More information for unknown calls
WhatsApp is also adding more details about calls received from unknown numbers. The feature is intended to give users more context when they receive a call from someone they do not recognise.
Together, the new measures give users more options to secure their accounts while making authentication less dependent on conventional passwords and PINs.