Table of Contents
Introduction
WhatsApp has rolled out several major account security features that US users need to know about. The Meta-owned messaging platform now supports multiple passkeys across devices and stronger two-step verification with alphanumeric passwords — a significant upgrade from the old six-digit PIN system.
With over 3 billion users worldwide and millions of active users in the United States, WhatsApp is a prime target for scammers and hackers. These new security features are designed to protect US consumers and businesses from account takeover, phishing, and social engineering attacks.
If you're still using a six-digit PIN like "123456" for your WhatsApp account, this is your sign to upgrade to an alphanumeric password immediately.
Multiple Passkeys: Secure Across All Your Devices
WhatsApp already allowed users to add passkeys for secure logins via fingerprint, Face ID, or screen lock code. Now, the platform lets users create separate passkeys for each platform — Android and iOS.
"More than a billion people have already set one up, and you can now add more than one passkey to your account if you use both Android and iOS devices," WhatsApp said in its announcement.
How it works:
- Set up a different passkey for your Android device and another for your iOS device
- Each passkey uses your device's built-in biometric authentication (fingerprint, Face ID) or screen lock
- Passkeys are phishing-resistant — they cannot be stolen in a data breach or tricked out of you by scammers
- To get started, go to Settings > Account > Passkeys
Multiple passkeys mean you can securely access WhatsApp on all your devices without compromising security.
Stronger Two-Step Verification: Alphanumeric Passwords
Perhaps the most significant update is the upgrade to WhatsApp's two-step verification (2SV) feature. Previously limited to a six-digit PIN, it now supports full alphanumeric passwords — longer, more complex, and harder to guess.
- Before: Six-digit PIN (e.g., 123456)
- Now: Alphanumeric passwords with special characters (e.g., Secure$Pass2026!)
- Why it matters: A longer, more complex password is exponentially harder for attackers to guess or crack
"Until now it was a six-digit PIN, we've now upgraded it to a full password: longer, alphanumeric, and even with special ch@racters to make it harder to guess," WhatsApp stated.
This is especially important for US users because:
- US consumers are primary targets for account takeover attacks
- Weak PINs like "123456" and "000000" are still commonly used
- Stronger 2SV protects your personal and business communications
- It adds a critical barrier against SIM-swapping attacks
Call Screen Context: More Information Before Answering
WhatsApp has also added more information to call screens, giving users more context about contacts not in their address book before answering. This is a direct response to the surge in scam calls on the platform.
On Android, users will now see:
- Whether the number is from a different country
- If you have any groups in common with the caller
"Scammers rely on urgency – now you can take a beat with some more info before answering," WhatsApp said.
Why this matters for US users:
- International scam calls are increasingly targeting US WhatsApp users
- Scammers impersonate US companies, government agencies, and financial institutions
- Having more context helps you identify and avoid scams before you engage
- This is part of WhatsApp's broader effort to protect users from fraud
Why This Matters for US Users
US WhatsApp users face unique security challenges:
- SIM-swapping attacks — US mobile carriers are frequently targeted by SIM-swappers trying to take over WhatsApp accounts
- Phishing campaigns — US consumers receive more phishing attempts than almost any other country
- Business communication — many US small businesses use WhatsApp to communicate with customers, making accounts valuable targets
- High-profile individuals — US public figures, journalists, and business leaders are at higher risk of targeted attacks
- Family communication — WhatsApp is a primary communication tool for many US families, especially with international relatives
The average cost of a personal account takeover in the US can exceed $1,000 in direct losses, not including the damage to reputation and personal relationships.
How to Enable These Security Features
For US users, here's how to secure your WhatsApp account:
1. Set Up Multiple Passkeys
- Open WhatsApp
- Go to Settings (gear icon)
- Tap Account
- Tap Passkeys
- Create a passkey for each device you use
2. Upgrade Your Two-Step Verification
- Open WhatsApp
- Go to Settings > Account > Two-step verification
- Enable or update your password
- Use a strong alphanumeric password with special characters
- Save your recovery email (in case you forget your password)
3. Review Call Screen Information
- When you receive a call from an unknown number, review the context shown
- Check if the number is from a different country
- Look for any groups in common
- If something seems off, don't answer and report the number
Taking just 5 minutes to enable these features can dramatically reduce your risk of account takeover and scams.
WhatsApp's Security Roadmap: What's Next?
WhatsApp has been aggressively rolling out security features in 2026:
- January 2026: "Strict Account Settings" — an Apple Lockdown-style feature for high-risk users like journalists and public figures
- March 2026: Fraudulent device-linking warnings — alerts when a linking request may be fraudulent
- August 2026: "Scam Alert" feature (beta) — uses local machine learning to warn users when targeted by scammers
- August 2026: Multiple passkeys and stronger 2SV (this announcement)
The "Scam Alert" feature uses a local machine learning model to detect scam patterns — all processing happens on your device, protecting your privacy.
Final Thoughts
WhatsApp's new security features represent a significant step forward in protecting US users from account takeover, scams, and fraud. The upgrade from six-digit PINs to alphanumeric passwords, combined with multiple passkeys and better call context, provides a robust defense against the growing threat landscape.
Key takeaways for US users:
- Multiple passkeys — secure access across all your devices
- Alphanumeric 2SV passwords — ditch "123456" for something stronger
- Call screen context — more information to spot scam calls
- Upgrade now — don't wait for an attack to happen
- Stay informed — WhatsApp is rolling out even more security features
If you're a US business using WhatsApp for customer communication or internal messaging, now is the time to review your security settings. Contact SystemLogicIT for a comprehensive security assessment to protect your business communications.