You scanned a QR code you should not have
That QR was not a menu and not a prize: it was the WhatsApp Web screen. Scanning it authorised your account on someone else phone, and from there they can read and write everything of yours.
The session stays open until you close it. Changing your password does nothing here: WhatsApp does not use a password. What cuts the access is logging out the linked device.
-
Log out the other session
- Open WhatsApp on your phone and go to Linked devices: on Android it is in the three-dot menu above the chat list; on iPhone, in Settings.
- Log out of every device you do not recognise. If in doubt, log out of all of them: you lose nothing, your phone stays connected.
- Turn on two-step verification. With that password, a new QR is no longer enough to get in.
- Check your profile photo, your name and your groups: it is common for them to change something in order to commit fraud as you.
- If money was moved or loans were requested in your name, report it to your bank today.
See where Linked devices is
Android
-
1 In the chat list, tap the three dots at the top, then Linked devices. -
2 Look at the list and tap every session you do not recognise. -
3 Tap Log out. Repeat for each one until only yours are left.
iPhone
-
1 Tap Settings, bottom right in the tab bar. -
2 Tap Linked devices. -
3 Look at the list and tap every session you do not recognise. -
4 Tap Log out. Repeat for each one until only yours are left.
Illustration. Depending on your WhatsApp version the screen may look slightly different, but the option names are the same.
See how to turn on two-step verification
Android
-
1 In the chat list, tap the three dots at the top, then Settings. -
2 Tap Account. -
3 Tap Two-step verification. -
4 Tap Turn on, create a 6-digit PIN you do not use anywhere else and add your email when asked.
iPhone
-
1 Tap Settings, bottom right in the tab bar. -
2 Tap Account. -
3 Tap Two-step verification. -
4 Tap Turn on, create a 6-digit PIN you do not use anywhere else and add your email when asked.
Illustration. Depending on your WhatsApp version the screen may look slightly different, but the option names are the same.
Logging out on your phone does not close linked sessions. WhatsApp Web and WhatsApp Desktop stay connected for up to 14 days afterwards. They have to be logged out one by one from Linked devices.
-
Warn your contacts
The fraud almost always starts by asking three or four people you trust for money. Copy this warning and send it by SMS, another app or a call: let them know before anyone pays.
URGENT: My WhatsApp account was stolen and someone is asking for money in my name. IT IS NOT ME. Do not transfer money, do not open links that come from my account, and do not reply to those messages.
Did this guide help?
What was missing?
Thank you. If someone you know goes through this, send them this page.
Thanks for telling us. Now we know what to fix first.
It is anonymous: only the button you tapped is stored.
Rule for next time: WhatsApp never asks you to scan QR codes that arrive by message, email or social posts. A WhatsApp QR is only ever scanned from your own Linked devices screen.
If you are also going to file a report
None of these channels returns your account: recovery is technical. They cover the crime, the impersonation and the money, and it is worth opening them today because the deadlines run from the same day.
- Guardia Nacional · 088. Guidance and cybercrime reports, every day. Save your screenshots and receipts before you call, and do not share them around.
- Mexico City cyber police · 55 5242 6489. If you are in Mexico City, they will guide you and explain how to file the report.
- Your carrier, before PROFECO. If your SIM was cloned, the complaint goes to the Telecommunications Sub-Procuracy: Concilianet or the Consumer Phone line, 55 5568 8722 and 800 468 8722. Since January 2026 carriers are required to verify your identity with official ID and CURP before handing over a duplicate. If they did not, they broke the rule.
- Your bank, today. If money moved, the deadline to dispute the charges runs from the same day. If the bank does not respond, CONDUSEF takes the complaint.
In Mexico no channel can force Meta to give your account back. The only thing that recovers it is your SIM with your number.