Don’t screenshot the WhatsApp code

Do not photograph the six digits. This page is the verification code, not the phone number in a chat header, and not a SIM-swap or port-out at the carrier. Those are separate leaks. The scam here is a code.

WhatsApp’s own help center says never share the 6-digit registration code or the two-step PIN with anyone. Apple says the same thing about verification codes: nobody legitimate needs you to send a picture of them. A screenshot of that SMS is a gift. Delete it. The header-and-SIM-swap walkthrough is a different page: phone numbers and SIM-swap. Chat hygiene when the shot is not an OTP: WhatsApp screenshots.

What a screenshot of the code still feeds

Open larger image in a new tab

If the thread shows the phone number and a preview of the SMS, you handed over two ingredients. Cover the number even when you are only showing a sticker. Cover the code always. Delete the code from the camera roll. Do not forward the SMS as an image into a family group “so they can see it was real.” Real is a sentence in your own words. The digits are the payload.

WhatsApp will even send a push when someone tries to register your number. Their help page on unexpected verification codes is blunt: without that SMS code, the other person cannot finish. Photographing the code and sending it is how you finish it for them.

Why would anyone screenshot an OTP on purpose?

Support asks for “what you saw.” Relatives ask “is this legit?” People post the banner to a forum. All of those requests can be answered without the digits and without the full number. Describe the sender name. Describe that it said WhatsApp. Do not photograph the six characters. Do not photograph the header that prints +country and the rest.

If you already captured it, bar both, export PNG, then delete the original. Do not keep a “for my records” copy of a live login code. Codes expire. Screenshots do not. Cover technique for short strings: blur vs black bar. Still hygiene: how to blur a screenshot.

If the SMS is already in Recents, kill the digits

1. Stop. Do not send the photo to anyone, including “WhatsApp support” in a chat that started this morning.
2. Duplicate the image only if you must prove a banner existed. Prefer describing the sender in text and skipping the file entirely.
3. If you still need a still, paint one solid Black bar over the entire six-digit run, with padding, not a light Blur.
4. Bar the number in the header or the SMS preview in the same frame.
5. Save a PNG copy, send that if you truly must, then delete Recents and empty Recently Deleted. Check iCloud or Google Photos for the original.

Open larger image in a new tab

What you should see in the rare file you keep: a sender name and a timestamp, with every digit gone. What you should not see: six characters you could still guess at 200% zoom.

Is blur enough on a six-digit code?

Six digits are the short-alphabet case. A polite smear can leave stems. A highlighter tint can be stretched. This is not a claim that a named person was hijacked because of Gaussian blur. It is the narrower rule: do not leave the code in the file. A solid bar, or better, no photograph of the code at all. Research context: PETS 2016. Highlighter traps: Markup brightness reveal.

Does the number in the header matter if the code is gone?

Yes. Takeover reporting describes needing the number and the OTP. The number is how a port-out or a social-engineering call starts. A sticker screenshot with a clean header is a number you published. Cover the header. Crop if you do not need it. Recapture after you hide the number in WhatsApp settings if you are posting a chat for another reason. The SIM-swap article is the place for that header hunt. Here, the rule is simpler: do not keep the code. Contact strings in chrome: hide phone and email.

What should you do if someone asks you to send the SMS screenshot?

Refuse the digits. If they are support, use the in-app path, not a PNG of a one-time code. WhatsApp will not ask you to screenshot the registration SMS. Apple will not ask you to screenshot a verification code to “keep your account.” If they are a relative, read nothing aloud that is a code. If they are a stranger, stop.

Notification shade shots of the same SMS are the same SMS. Lock-screen photos of the same SMS are the same SMS. A cropped banner that still shows six digits is still the code. Delete Recents copies after you refuse. Cloud photo backup will otherwise keep the factor for months. Relatives who mean well will still ask for the picture. Answer with the sender name only. Do not negotiate the digits “just this once.” Do not screenshot the WhatsApp “linked devices” screen either if it shows the number you are trying to protect. Banner hygiene for non-OTP captures: notifications in screenshots.

If you already sent the code

Treat the account as under attack. Do not argue about whether the blur was “good enough.” Change what you can from a device you still control. Enable two-step verification in WhatsApp if it is not on. Tell people close to you that a code may arrive and that they should not read it to anyone. Contact the carrier if service drops, which is the FCC’s first sign of a port-out. Then delete every copy of the still, including chat backups of the image you sent.

Recap

Official help pages already say never share the WhatsApp registration code. A screenshot is sharing. Do not photograph the six digits, and do not leave the number in the header of the same frame. If a still already exists, bar the digits, export PNG, and delete the original. Bar the header and delete the code.