WhatsApp wants to lock down accounts with new features. WhatsApp is pushing some new features to combat scammers and hackers from hacking into accounts.Users of the Meta-owned messaging app will soon have better two-step verification because they can link multiple passkeys, and Android users will get more context if the call comes from an unknown number. WhatsApp published more about these changes today (August 25) - one account already has over 1 billion passkeys linked - even as efforts against phishers, social engineers, and account takers evolve.About The AuthorA journalist and writer interested in geopolitics, national politics, conflict and war reporting, with a growing focus on technology and the automobile industry. His work is driven by a curiosity to understand the political, social and technological forces shaping contemporary India and the world. He enjoys engaging with people, exploring perspectives often overlooked in mainstream narratives, and breaking down complex subjects into accessible, well-researched stories. Alongside political and geopolitical writing, he closely follows developments in technology and automobiles, particularly how innovation, policy and changing consumer trends are reshaping these sectors.For most of you, though, the most significant enhancement is about WhatsApp’s already available two-step verification.From a six-digit PIN to a full passwordThe existing two-step verification for WhatsApp used a six-digit numerical PIN code. When someone tried to register your WhatsApp account, the PIN provided as an extra protection method-so merely knowing the SMS or one-time registration code wasn't enough to take over someone's WhatsApp account. WhatsApp is raising that guard level as people will now also be able to set an expanded alphanumeric password (that includes special symbols) instead of a restricted six-digit PIN.While this might sound like a tiny change, it addresses a major pitfall that short, human-selected PINS have: predictability.There are only a million possible six-digit PIN combinations theoretically, and in real-world terms, a user choosing an easy number to remember (like date of birth or year) or a combo like “123456” can reduce the set of possible combos for attackers dramatically using sophisticated software. With a bigger pool of letter and symbol combination, that opens the doors up for longer and more randomly generated combinations where attackers may have less luck getting lucky.| Security feature | What changes | Why it matters |More articles by AuthorTrending Stories| ---------------------- | ------------------------------------------------------------------- | ---------------------------------------------------- || Two-step verification | Six-digit PIN upgraded to a longer password format | Makes credentials significantly harder to guess || Passkeys | More than one passkey can be added | Useful for people using both Android and iOS devices || Unknown caller context | Android users see additional details | Helps users assess suspicious calls before answering || Existing protection | One-time registration code still forms part of account verification | Adds another barrier against account takeover |Why two-step verification is neededAttacks on WhatsApp accounts tend to exploit human weaknesses, also known as social engineering, more often than sophisticated hacking. One common social media scam involves tricking someone into providing a temporary verification code. If an attacker then has access to a phone number and that verification code, they may try to use it to register that WhatsApp account on another device.Two-step authentication makes this much harder, however, because the verification code alone won’t work.This is precisely the reason this feature continues to exist even though the assumption would be that none of us will ever voluntarily give away our passwords to our accounts. In an age in which more and more attacks rely on impersonation of friends, family members, companies, or technical support, knowing there’s another reason someone is impersonating you, even if impersonating of the purpose is logging in to your account. The newer addition toWhatsApp's app now adds more context. Specifically, for Android devices, the new unknown number incoming call interface will provide additional context such as whether the unknown caller is also from a different country and whether both individuals share any common contacts, via both phone number and WhatsApp groups.According to the report, this additional information is designed to allow the user to take a few moments and evaluate a call before choosing whether or not to answer it. The addition of context is different from WhatsApp's previous Silence Unknown Callers feature, which automatically silenced unknown phone numbers outside of a user's address book while also allowing them to see whether or not they've missed the calls entirely.How effective will the stronger verification be?Although the new feature can significantly strengthen your defence against account takeover, its impact remains largely in the hands of the user to implement properly. A complex, long password is more secure than a simple PIN like "123456" or a birth year, for example. The strength of this advantage is dulled if you're simply trading a weak PIN for one that’s just as predictable a password. The most secure password is one that you don't use across any other accounts. Similarly, the new features won't do much if social engineering dupes you into revealing both your registration code and your two-step verification passcode. These features can mitigate threats, but can’t prevent someone from tricking you into divulging both pieces of information. This is why WhatsApp's other big move, adding support for passkeys, is potentially the most important one.More than one passkeyUsing passkeys, you verify yourself by authenticating with native methods on your phone: your fingerprint, face scan, or screen unlock code. According to the app, you can now associate multiple passkeys to a single account. That will likely come in handy for those with an Android or iPhone that use WhatsApp simultaneously.You will find it under Settings > Accounts > Passkeys.As they’re based on how the actual service works together with the authenticating device, passkeys will help circumvent traditional phishing attempts, since they don’t rely on the same user-reusable password you might foolishly input to a fake website. Over 1 billion people use passkeys, so it looks like the tech is evolving beyond an experimental security option and into everyday use. Plus, the option to add more than one passkey is really useful. If someone uses a smartphone that alternates between iPhone and Android, they will no longer need to rely on one passkey that is tied to the given OS.A broader push towards layered securityThe newest update also falls part of a broader security effort from WhatsApp, and earlier this year the service rolled out Account Settings, an optional 'lockdown-style' security function for those most likely to be a sophisticated threat – like activists or journalists. The feature is said to allow for severe restrictions, including blocking media and files from untrusted senders as well as disabling calls from unknown numbers.All this context is useful because an individual security measure can hardly secure all users in every kind of situation.A strong two-step verification password can help stop account takeovers. Passkeys can reduce exposure to phishing. Caller information can help users identify potentially suspicious communication. Strict Account Settings can provide an additional layer for people facing higher-risk threats. Together, these measures reflect a shift towards layered account security rather than reliance on a single PIN, password or SMS code.The bottom lineIt’s not a revolutionary new way to secure an account-WhatsApp’s latest update doesn’t reinvent the wheel-but it is addressing a real shortcoming with WhatsApp’s current approach. Replacing the 6-digit PIN with a longer password for more robust protection against account hijacking and multiple passkey support to make passkey-enabled security more convenient for users logging in across multiple devices are both smart steps. Similarly, the new caller context system addresses the human element of security; scammers can be so successful not because they can brute force encryption, but because they can trick users into rushing and forgetting to verify their identity.While none of the updates will make it impossible to compromise an account and there’s little for those billions of users who have already turned on two-step verification, now there are more tools for securing accounts against this very common takeover method. FAQsWhat new features has WhatsApp introduced to enhance account security?WhatsApp has introduced several new features to enhance account security, including an upgrade from a six-digit PIN to a longer alphanumeric password format for two-step verification, support for multiple passkeys, and additional context for incoming calls from unknown numbers on Android devices.How does two-step verification improve security on WhatsApp?Two-step verification improves security by requiring an expanded alphanumeric password instead of just a six-digit PIN, making it significantly harder for attackers to guess the credentials. This adds an extra barrier to account takeover attempts beyond just the SMS or one-time registration code.What role do passkeys play in enhancing WhatsApp's security features?Passkeys enhance WhatsApp's security by allowing users to authenticate using native methods on their devices, such as fingerprints or face scans. Users can now associate multiple passkeys with a single account, making it more convenient and secure, especially for those using both Android and iOS devices.What new security features has WhatsApp introduced to protect user accounts?WhatsApp has introduced enhanced two-step verification that allows users to set a longer alphanumeric password instead of a six-digit PIN. Additionally, users can now link multiple passkeys and Android users will receive more context about unknown callers.How does the updated two-step verification improve account security on WhatsApp?The updated two-step verification replaces the previous six-digit PIN with a longer alphanumeric password, making it significantly harder to guess and reducing the risk of account takeover by preventing easy-to-predict PIN choices.What is the significance of adding multiple passkeys for WhatsApp users?Adding multiple passkeys allows users who operate WhatsApp on different devices, such as Android and iOS, to securely authenticate without being limited to a single passkey tied to one operating system, improving convenience and security across platforms.end of article