WhatsApp Business Cloned: What to Do in the First Minutes and How to Prevent It from Happening Again

Reporting, police report, and the bank

After regaining access — or while trying — there are steps that cannot wait:

• Report to WhatsApp support through the official app channels, informing them the number was taken.
• File a police report. This document supports any subsequent conversations with the bank, carrier, and affected clients.
• Contact the carrier if SIM swap is suspected, and request blocking and registration of the incident.
• Notify the bank if a transfer request was made in the company’s name, with the incident number in hand.
• Gather evidence — screenshots sent by clients, timestamps, destination accounts used by the scammer. This helps both in the investigation and in contacting those affected.

It’s worth deciding internally who handles each of these tasks before it’s needed. In the middle of a crisis, the team often freezes waiting for the owner to decide everything.

The five locks that prevent the next case

• Two-step verification activated, with a PIN that no one outside the company knows and that isn’t the owner’s birthday.
• Recovery email registered in the app to reset the PIN when necessary.
• Clear and trained rule: no six-digit code is ever shared with anyone, under any circumstances, not even the boss, support, or clients.
• Password and account protection at the carrier to make SIM swaps harder.
• Periodic review of connected devices, disconnecting unknown sessions.

These five locks take fifteen minutes to set up and solve most cases. The problem is they depend on discipline from several people — and that’s exactly where the customer service structure makes a difference.

The structural problem: whose phone is the number on?

In most small companies, the business number lives on one person’s phone. This creates a vulnerability no lock can fix:

• The personal device is the entry point. If the salesperson’s phone is compromised, the company’s number goes with it.
• When the employee leaves, they take the number. This is the most common version of "losing the company’s WhatsApp" and doesn’t involve any scammer.
• There is no record of what was said on behalf of the company, which even hinders damage assessment.
• Recovery depends on a single person, who may be off, traveling, or out of signal.

As long as the number is tied to one device and one person, the company continues to have a single point of failure — and security depends on the individual care of whoever carries the phone in their pocket.

The risk from within

Not every problem with the company’s number is caused by a scammer. Many cases that become headaches originate internally, so better passwords alone don’t solve them:

• The salesperson leaves and takes the conversations. If the number was on their phone, the company loses history, contacts, and continuity of service suddenly.
• Lost or stolen device with an open session and no screen lock.
• Shared computer with WhatsApp Web connected and no one logging out.
• Recovery email password saved in a file accessible to half the office.
• Exporting conversations and contact lists without control, which later becomes material for competitors or scams.

Defining who has access to what, reviewing it when someone joins or leaves, and keeping the channel in the company’s name is what separates an incident from permanent loss. Also worth reading permissions and security in WhatsApp CRM.

Groups, lists, and data leaks without a scam

There is also a silent leak that doesn’t take down the number but exposes the customer base and feeds exactly the scams described here:

• Groups with clients where every participant sees everyone else’s phone number — perfect material for someone impersonating the company.
• Poorly configured broadcast lists, with replies going to the wrong place.
• Screenshots of conversations shared on social media with client names and phone numbers visible.
• Contact spreadsheets circulating through personal apps among team members.

Replacing groups with individual service, controlling who exports contacts, and treating client phone numbers as protected data reduces the attack surface before any incident happens.

Why the official API changes the game

A number connected to the official WhatsApp Business API doesn’t live on a phone. It lives in a company account within Meta, and this changes the nature of the risk:

• No six-digit codes circulate daily. The connection is made once, through official registration, not by an SMS someone can be tricked into sharing.
• Access is per person. Each agent logs in with their own user, and removing someone is revoking access, not recovering a device.
• The account belongs to the company. The business portfolio, approved templates, and history are under the company’s CNPJ — provided the account is created in the correct portfolio.
• Everything is logged. If something happens, there is a history to know what was sent, by whom, and when.
• The verified profile helps clients recognize the legitimate company channel, making it harder to imitate with similar numbers.

It’s not magic protection: you still need to manage passwords, access, and permissions carefully. But the most common scam vector — asking someone distracted for the code — simply ceases to exist.

When the scammer doesn’t take the number: they imitate it

There is a variation that affects companies with a strong digital presence and involves no hacking. The scammer creates a new number, sets the company’s photo, name, and description, and starts contacting clients, often copying real conversations seen in groups or ads.

• Report the fake profile within the app itself, advising clients to do the same — volume of reports speeds up takedown.
• Publish the official number on all channels, always consistent and visible, and use direct links on the website and ads.
• Notify your base. Clients who know the company never requests payment via new messages don’t fall for the scam.
• Keep the official profile complete, with photo, description, website, and, when possible, company verification — this gives clients a point of comparison.

The one-page crisis plan

Every company that serves customers via WhatsApp should have, printed or on an internal board, a short plan with five lines:

• Who is responsible for attempting to recover the number.
• Where the team communicates while the channel is compromised — an alternate group, phone, or email.
• What notice is pre-written for the website, social media, and email.
• Who files the police report and contacts the carrier and bank.
• When customer service resumes and on which temporary number, if any.

Companies with this plan resolve incidents within hours. Those without spend two days figuring out what to do while the scammer talks to the client base.

After it’s over: what to review

Once the case is resolved, use the scare to fix the structure. Three questions usually suffice: is the business number tied to a personal device? Can the company revoke someone’s access without depending on that person’s phone? Is there a record of what was communicated on behalf of the brand?

If the answer to any is uncomfortable, the fix isn’t buying more antivirus — it’s changing where the number lives and how the team accesses it. It’s the difference between a company that depends on one person’s attention and a company that controls its own customer service channel.