Securing Messaging Apps: Plain-English Guide

Criminals who take over your messaging app can talk to everyone you know while pretending to be you. Apps such as WhatsApp, Signal, iMessage and Facebook Messenger hold years of private chats, photos and family groups, and your friends trust anything that arrives from your name. This guide explains, in plain English, the few settings that lock your account to you, how to check who you are really talking to, the warning signs of a hijacked account and what to do if it happens. It is written for individuals, families, older people and very small businesses. App menus change from time to time, so if a setting has moved, search for its name in the app's own help pages. For organisations, see the Account Takeover Prevention Guide.

Key takeaways

Never share a code sent to your phone. The most common way messaging accounts are stolen is a message asking you to pass on a six-digit code. No real friend, company or app support team needs it.
Turn on the extra PIN. WhatsApp calls it two-step verification and Signal calls it Registration Lock. Either one stops someone moving your account to their phone with just a text code.
Encryption protects the message, not you from a scam. End-to-end encryption (only you and the person you are chatting with can read the messages) is built into these apps, but it cannot stop a criminal who has tricked you or taken over a friend's account.
Check money requests by another route. If a "friend" or "family member" asks for money in a chat, call them on the number you already have before you pay.
Know the recovery steps before you need them. Write down your PINs and recovery codes somewhere safe, because some apps cannot reset them for you.

What makes a messaging app safe or unsafe

Most popular messaging apps now use end-to-end encryption. This scrambles each message on your phone and only unscrambles it on the other person's phone, so the company running the app, and anyone listening on the network, cannot read it. Meta says personal chats and calls on Messenger have used end-to-end encryption by default since a rollout that began in December 2023, built on the same Signal Protocol that Signal uses.

Encryption is good news, but it only protects messages while they travel. The real risks for most people are different:

Account takeover: a criminal registers your phone number on their own phone and becomes "you" in every chat and group.
Impersonation: someone messages you from a new number claiming to be your child, parent or boss, often with a story about a lost or broken phone.
A lost or shared phone: anyone who can unlock your phone can read your chats.
Extra devices: most apps let you use your account on a computer or tablet too. A device you forgot about, or one a criminal added, can quietly see your messages.

Set it up in 15 minutes

These are the settings that matter most. The names below come from each company's own help pages, checked in October 2026.

App	Setting to turn on	Where to find it	What it does
WhatsApp	Two-step verification	Settings, then Account, then Two-step verification, then Turn on (or Set up PIN)	Asks for a six-digit PIN you choose whenever your number is set up on a phone, so a stolen text code is not enough.
Signal	Signal PIN and Registration Lock	Settings, then Account, then Registration Lock	Uses your PIN to stop anyone else registering your number on Signal.
iMessage (Apple)	Contact Key Verification	Settings, then your name, then Contact Key Verification, then turn on Verification in iMessage	Helps you confirm you are only messaging the people you intend to, and alerts you to rare, advanced attacks.
Messenger (Meta)	Recovery PIN for encrypted chats	Messenger prompts you to set one up when your chats are upgraded	Lets you get your encrypted chat history back on a new or extra device.

Open WhatsApp Settings and tap Account, then Two-step verification.
Tap Turn on or Set up PIN and enter a six-digit PIN. Do not use your birthday, your bank PIN or 123456.
Add an email address you can still get into. WhatsApp recommends this, because it lets you reset the PIN if you forget it. You can skip it, but then forgetting the PIN is harder to fix.
Look at the list of linked devices (computers and tablets using your account) and log out any you do not recognise.

Signal

When Signal asks you to create a PIN, choose one you will remember. It can be numbers or letters, and there is no length limit, so longer is better.
Go to Settings, then Account, and turn on Registration Lock.
Write the PIN down and keep it somewhere safe. Signal says it does not know your PIN and cannot reset it for you. If you forget it with Registration Lock on, you may have to wait up to seven days before you can register again.
Keep the PIN reminders switched on. Signal asks you to type your PIN now and then so you do not forget it.

The Signal PIN brings back your profile, settings, contacts and block list on a new phone. It does not bring back your old messages, so use the app's own backup or transfer option if your chats matter to you.

iMessage

Make sure two-factor authentication (a second check, such as a code on your other device, when you sign in) is on for your Apple Account. See the Two-Factor Authentication for Everyone Guide.
Set a passcode on every Apple device you use for messages.
If you want the extra check, open Settings, tap your name, choose Contact Key Verification and turn on Verification in iMessage. Apple says all your devices need iOS 17.2, macOS 14.2 or later, with iCloud Keychain switched on.

Apple is clear that Contact Key Verification does not stop phishing or text message scams. It is mainly for people who face serious, targeted threats, such as journalists or campaigners. For most families, two-factor authentication and a good passcode matter more.

Messenger

Protect the Facebook or Messenger account itself with a strong, unique password and two-step verification. See the Password Managers Explained for Everyone Guide.
When Messenger asks you to set up a recovery method such as a PIN for your encrypted chats, do it, and store the PIN safely.
Use the privacy controls Meta added, such as choosing whether others see when you have read their messages, if you prefer.

Check who you are really talking to

Encryption only helps if the person on the other end is who you think. Two simple habits catch most problems.

New number, familiar story: "Hi Mum, I've broken my phone, this is my new number" is a classic opening. Before you reply with anything personal or send money, call or text your relative on their old number, or ask a question only they would know.
Safety numbers and security codes: Signal gives each one-to-one chat a safety number. Open the chat, tap the chat name and choose View Safety Number. You can scan each other's QR code in person, or compare the numbers, then tap Mark as verified. Signal says the number often changes simply because someone got a new phone or reinstalled the app, but frequent or unexpected changes can be a warning sign. WhatsApp and iMessage offer similar checks.
Voice and video can be faked: a short voice note or video call is no longer proof. See the Spotting Deepfake Scams Guide.
Groups: be careful with links and requests posted in big community groups. A message from a group member you have never met deserves the same caution as a stranger's.

Everyday privacy settings worth a look

Disappearing messages: some apps can delete messages automatically after a set time. On Messenger, Meta says disappearing messages last 24 hours, work only in encrypted chats and tell you if someone takes a screenshot. They are useful for sensitive chats, but the other person can still photograph their screen with another device.
Who can see your profile photo and "last seen": limiting these to your contacts makes it harder for a stranger to copy your photo and pose as you.
Who can add you to groups: limiting this cuts down on spam groups pushing investment schemes. See the Romance and Investment Scam Awareness Guide.
Lock screen previews: turn off message previews on your lock screen if other people often see your phone, because a preview can show a login code to anyone nearby.
Your phone itself: a strong screen lock and automatic updates protect every app at once. See the Securing Your Smartphone Guide.

For wider settings on Facebook, Instagram and other social apps, see the Social Media Privacy Settings Guide.

Signs something is wrong

You get a text with a registration or verification code you did not ask for. Someone may be trying to move your account to their phone. Do not share the code.
A friend or a stranger asks you to "send back" a code that was "sent to you by mistake".
Your app suddenly logs you out and asks you to register your number again.
Friends tell you they have received odd messages or money requests from you.
A device you do not recognise appears in your linked devices list.
Your mobile phone suddenly loses signal for no reason. This can mean your number has been moved to another SIM card. See the SIM Swap Fraud Guide.

What to do if it happens

Re-register the app on your own phone straight away using your phone number. You will get a new code, and the criminal's session is usually pushed off. If they set their own two-step PIN, follow the app's help pages for recovery.
Warn your contacts by phone, email or another app, so they ignore requests that seem to come from you. The UK National Cyber Security Centre (NCSC) advises this for any hacked account.
Log out every device and app you do not recognise, then turn on two-step verification or Registration Lock if it was off.
Check the email account linked to the app for new forwarding rules, and change its password if you reused it anywhere.
Tell your bank immediately if you or anyone else sent money, using the number on the back of your card.
Report it (see Where to get help below).

If you cannot get the account back, the NCSC suggests setting up a new account and telling your contacts, bank and other services your new details. For a fuller recovery plan, see the Identity Theft Recovery Guide.

Where to get help

UK: follow the NCSC guidance on recovering a hacked account. If you lost money, tell your bank and report it to Report Fraud, which the NCSC describes as the UK's reporting centre for cyber crime. In Scotland, contact Police Scotland on 101.
App help pages: WhatsApp Help Center, Signal Support and Apple Support have the current steps for each setting.
US and elsewhere: contact your bank first, then your national fraud reporting service. See the Identity Theft Recovery Guide for US and EU contacts.

Common failure patterns

Reading out a code to a "friend". The message often really is from a friend's account, because theirs was taken over first. A code is never safe to share, whoever asks.
Two-step PIN set up, recovery email skipped. On WhatsApp, the email is what lets you reset a forgotten PIN. Add one you can still open.
A forgotten PIN with no note. Signal cannot reset your PIN. Keep it in a password manager or a written note stored safely.
Old laptops still linked. A computer you sold or a shared family tablet can keep showing your messages. Check linked devices every few months.
Trusting encryption to spot scams. A padlock or "end-to-end encrypted" label tells you nothing about who is on the other end.
Paying first, checking later. Once money is sent by bank transfer it can be very hard to recover. Call the person first, every time.

Practitioner checklist

Turn on WhatsApp two-step verification and add a recovery email.
Turn on Signal Registration Lock and write down your Signal PIN.
Make sure your Apple Account and Facebook account use two-factor authentication.
Set up the Messenger recovery PIN when asked and store it safely.
Check the linked devices list in each app and remove anything you do not recognise.
Agree a family rule: any money request in a chat is checked by phone first.
Limit who can see your profile photo and add you to groups.
Keep your phone's screen lock on and its software up to date.
Save the Report Fraud website and your bank's fraud number where you can find them quickly.

Securing Messaging Apps Guide: Plain-English Steps to Stay Safe