The WhatsApp Hijack Targeting Business Accounts

At 2 a.m., Thuraya's boutique WhatsApp number messaged all 380 saved customers: a new bank account, an urgent stock emergency, pay today. She was asleep. Three customers had already paid before she woke up, and getting the number back took a full day she could not spare.

How the hijack actually happens

Every hijack starts the same way. Someone convinces you, or someone on your team, to hand over a code or approve a device that should never leave your own phone. Three versions are doing the rounds right now.

• The verification code trick: a message arrives from what looks like a friend or a regular customer, claiming they accidentally sent their WhatsApp code to your number and asking you to forward the six digits back. Those digits are not theirs, they are the key to your own account. Forward them, and your business number becomes someone else's.
• The linked device trick: a newer version, sometimes called a pairing scam, sends a link to a page that looks like WhatsApp and asks you to scan or type in a code to 'confirm' something. Approve it, and a stranger's phone quietly joins yours as a linked device, reading every chat as it arrives.
• The cloned profile: a scammer copies your logo, photos and business name onto a lookalike WhatsApp Business number, then messages your real customers, or strangers, offering the same products at a special price and collecting payments that never reach you.

Fake bank and courier messages feed it

These tricks rarely arrive alone. They usually follow a fake bank alert or a fake courier text: a card blocked, a delivery held, a link to click. The link asks for an OTP, a one time password meant to confirm a transaction, and that same habit of typing in a code because a message asked nicely is exactly what a WhatsApp hijacker is counting on next. Royal Oman Police has previously warned about scammers using a real company's name on WhatsApp to advertise a product, then asking a buyer to enter bank details through a link, after which the money simply leaves the account.

Oman's telecoms regulator has been tightening the network side of this. In mid August 2026 the Telecommunications Regulatory Authority issued a regulation limiting promotional calls and texts to between 8 a.m. and 9 p.m., requiring operators to filter suspected fraud traffic, and giving customers one clear channel to report suspicious messages. It covers calls and SMS from licensed operators, not WhatsApp itself, which is exactly why protecting your own business number is still on you and your team.

No bank, courier company or WhatsApp itself will ever ask you to read out or type in the six digit code that protects your business account.

What one hijacked night cost Thuraya

Thuraya, who runs a boutique in Al Mouj, is a composite example built from how these hijacks typically play out for a small team. Here is what one bad night added up to, in numbers she could redo with her own.

Your customer list is also at risk

A hijacked WhatsApp number does not just embarrass you, it can expose the personal data of everyone saved in that chat list: names, numbers, order history. Oman's Personal Data Protection Law has applied since February 2023, and the compliance grace period under its executive regulation ended in February 2026, so this is no longer distant homework. If a hijack puts customer data at genuine risk, the law expects the business holding that data to tell the Ministry within 72 hours of finding out. Chatbot.OM's Oman AI Chat Guide walks through what the law expects of a business that keeps a WhatsApp customer list, in plain language.

The five minute protection checklist

1. Turn on two step verification in WhatsApp Settings, so a stolen code alone cannot unlock your account without a PIN only you know.
2. Open Linked Devices once a week and remove anything you do not recognise instantly, the same way you would check who has a key to the shop.
3. Never share the six digit code with anyone, including someone claiming to be WhatsApp support, your bank, or a courier company. None of them will ever ask for it.
4. Agree a second channel with your own staff and regular customers for anything about money: a phone call or an Instagram message, never a WhatsApp request alone.
5. If you send order updates or offers in bulk, connect through an official WhatsApp Business Platform link rather than the personal app on one phone. It verifies through Meta's business check instead of a QR pairing code a stranger can trick you into approving.

What this means for you

If your WhatsApp number is hijacked tonight, do not wait until morning. Email WhatsApp support from a different address with the words 'Lost or Stolen' and your phone number, so the account gets disabled before more messages go out. Warn your customers a different way, an Instagram post, a shop sign, a phone call, since your own WhatsApp is now the scammer's tool, not yours. Report it to Royal Oman Police on the toll free cyber crime line, 80077444, and write down the exact time you noticed something wrong. That timestamp matters if you later need to tell the Ministry that customer data was put at risk.

The bottom line

A WhatsApp hijack takes a scammer minutes to start and takes you a full day and a difficult conversation to clean up. The five checks above take less time than reading this article, and they close the exact door scammers are using on business accounts right now.