Account Takeover of WhatsApp Group Administrators: Verification-Code Hijacking, Linked Devices and Layered Mitigations

The account of a WhatsApp group administrator is a high-value target. Whoever controls it inherits the administrator's powers in every group the account manages, including adding and removing members, changing group settings and posting with the trust that members place in a known person. This narrative review examines account takeover as it affects group administration, with a focus on the "verification-code" scheme widely documented in Brazil, in which a fraudster requests the victim's WhatsApp registration code under a pretext and re-registers the account on another device. The review draws on official WhatsApp Help Center documentation, on public guidance from Brazilian banking and law-enforcement bodies, on CERT.br material and on peer-reviewed research on SIM-swap authentication. All sources were accessed and verified in October 2026. The analysis describes the attack chain, the consequences specific to groups, the native protections documented by WhatsApp (two-step verification, recovery email, passkeys, re-registration, linked-device review and group permission settings) and the role that administrator tooling can play in limiting the damage of a compromised account. The review finds that platform documentation consistently identifies refusal to share the registration code and activation of two-step verification as the primary controls, that re-registration with the genuine number is the documented recovery path, and that group-level damage can be reduced by restricting administrator rights, requiring approval of new members and keeping a record of administrative actions. No original data are reported, and the evidence base on prevalence is weak. The author discloses a competing interest as the founder of a group management tool discussed in the paper.