WhatsApp has announced a significant expansion of its account security features, including stronger two-step verification, enhanced caller context for unknown numbers, and the ability to register multiple passkeys. The company also confirmed that over one billion users now utilize passkeys for account access.
Passkeys offer a more secure login method by allowing users to authenticate with their device's biometric features, such as fingerprint or Face ID, or their screen-lock code, eliminating the need for traditional passwords, PINs, or one-time codes. WhatsApp has now enabled users who operate across both Android and iOS platforms to link multiple passkeys to a single account, streamlining account recovery and reducing reliance on a single device. This move shifts account protection away from user-remembered secrets, making phishing attempts considerably more difficult.
The platform's two-step verification system has also received an upgrade. Previously relying on a six-digit PIN, this additional layer of protection has been enhanced to support a full password. This new password can be longer, incorporate alphanumeric characters, and include special symbols, significantly increasing its strength compared to a short numeric PIN. This change aims to provide a more robust defense against account takeovers, even if an attacker manages to obtain a user's one-time registration code. WhatsApp explicitly encourages users to upgrade from easily guessable PINs like "123456."
In an effort to combat social engineering tactics, WhatsApp on Android will now provide additional context for calls from numbers not saved in a user's contacts. This information may include details such as whether the incoming call originates from a different country or if the caller shares any common groups with the recipient. This feature is designed to give users more information to consider before deciding whether to answer a call, thereby mitigating the pressure often exploited by scammers.
These three security enhancements collectively address different facets of account protection. Passkeys make authentication more resilient to theft, the strengthened two-step verification acts as an additional barrier if a one-time code is compromised, and the caller context provides users with crucial information before engaging in a potentially suspicious interaction. The milestone of one billion passkey users on WhatsApp suggests a growing adoption of phishing-resistant authentication methods on a large scale.
