The six digit PIN that locks people out of their own number

Two-step verification is a six digit PIN required whenever your number is registered on a new device. It is the best protection a business number has against being taken - and the most common reason a migration stalls for a week, because the person who set it has left.

What it defends against

Somebody obtaining your SIM or intercepting the verification code and registering your number on their phone. With the PIN set, the code alone is not enough. Without it, whoever receives the SMS owns your WhatsApp.

How it goes wrong

• One person knows it. They leave, or forget, or are on leave the day you need to migrate.
• It is not written down anywhere the business controls. A PIN in a departed employee's password manager is a PIN you do not have.
• It blocks the migration nobody planned. Moving a number to the Cloud API needs it disabled first, and disabling it needs it.

Doing it properly

1. Set a PIN on every business number.
2. Store it in the company's password manager, not a person's, with at least two people holding access.
3. Add a recovery email the business owns - a shared mailbox, not somebody's personal address.
4. Record it beside the SIM. The PIN, the SIM and the account the SIM is registered to are three facts that are only useful together. See choosing a number.
5. Test it once, deliberately, before you need it in a hurry.

The recovery email, which people skip

WhatsApp lets you attach an email address to the PIN. It is the only route back if the PIN is forgotten, and it is skipped constantly because the prompt appears at a moment when somebody is trying to get on with something else.

Use a shared mailbox the business controls - not the owner's personal address, and not an address that stops working when somebody leaves. The whole point of the recovery route is that it survives the situation that created the problem.

When to change it

• When somebody who knew it leaves, particularly on bad terms. This is the same reflex as changing a lock.
• After any incident involving the phone - lost, stolen, repaired by somebody you do not know.
• Not routinely. A PIN rotated on a schedule is a PIN somebody writes on a note, and there is no attacker this defends against.

What it does not protect

The PIN defends the registration of the number. It does nothing about a linked device somebody already has, an unlocked handset left on a counter, or a laptop with WhatsApp Web signed in. Those are the more common losses, and they are handled by checking your linked devices rather than by the PIN.