WhatsApp New Security Features: Stronger 2FA, Passkeys

WhatsApp has announced a new set of security features aimed at making user accounts harder to take over and helping people identify potentially suspicious calls. The Meta-owned messaging platform is strengthening two-step verification, expanding passkey support and adding more information about calls from unknown numbers. 

The changes come as messaging accounts continue to face risks from phishing, social engineering and attempts to obtain verification credentials. WhatsApp said the new measures are designed to add further protection while keeping account recovery and everyday use relatively simple.

Stronger Two-Step Verification

One of the key changes is an upgrade to WhatsApp's two-step verification system. The existing six-digit PIN is being replaced with a stronger password that can include letters, numbers and special characters.

The additional layer is intended to make it more difficult for someone to gain control of an account even if they manage to obtain a user's one-time verification code. Users will be able to create a more complex credential instead of relying only on the traditional six-digit PIN. 

Multiple Passkeys Supported

WhatsApp is also expanding its passkey feature by allowing multiple passkeys to be associated with the same account.

Passkeys allow users to authenticate through security mechanisms already available on their devices, such as biometrics or a device screen lock. The expanded support can be particularly useful for people who use more than one device or switch between Android and iOS hardware. 

WhatsApp said more than one billion users have now protected their accounts with passkeys, highlighting the growing use of passwordless authentication on the platform. 

More Information on Unknown Calls

The company is also adding more context to calls received from numbers that are not saved in a user's contacts. On Android, users can receive additional information that may help them decide whether to answer an unfamiliar call.

The information can include details such as whether the caller is from another country and whether the caller shares groups with the recipient. The feature is intended to give users more context before they interact with unknown callers, particularly as scam and impersonation calls remain a concern. 

Focus on Account Takeovers

The latest measures are focused primarily on protecting the WhatsApp account itself. While WhatsApp messages and calls use end-to-end encryption, account takeover attempts can target users through methods outside the encryption system, including stolen verification codes and social engineering.

WhatsApp continues to maintain end-to-end encryption for personal communications, meaning messages and calls are designed to remain accessible only to the communicating users. 

The new tools therefore add another layer to the platform's broader security approach rather than replacing existing encryption protections.

Rollout Begins

WhatsApp has started rolling out the new security measures, although availability can vary depending on the platform, account and rollout stage. Users should keep the application updated to access features when they become available.

The company is encouraging users to make use of available security settings, particularly stronger two-step verification and passkeys, as part of protecting their accounts from unauthorised access.

For users who frequently receive calls from unknown numbers, the additional caller information on Android could also provide a useful warning before answering potentially unwanted or suspicious calls.