Sending a code via WhatsApp: is it safe?
“Never share a verification code” is good advice against account takeovers. With reverse OTP, users send a code to sign up. This guide explains why that is something different, how to tell a safe flow from a scam and how to explain it to your visitors.
- How the WhatsApp scam works
- Three signs of a safe flow
- What the code unlocks
Christian Schätzlein, Founder and developer of Sendity
3 min read
Sign-ups by message. No form, no code.
Sendity is a sign-up widget for your website. Instead of filling in a form, your visitors send one short message via WhatsApp or email. Sendity checks who it came from and hands your site the name and the confirmed phone number or email address.
See how Sendity works →-
One message instead of a form Visitors tap send in WhatsApp or their email app. Nothing to type, no confirmation email to click.
-
Confirmed by the message itself The contact comes from the sender of the message, so typos and made-up addresses never reach your list.
-
Pay per confirmed contact Start with 1,000 free credits, no credit card. After that, prepaid packages with no subscription.
The warning targets one specific trick: someone gets a code that was sent to you and uses it to take over your account.
How the scam works
A fraudster starts setting up WhatsApp with your number. WhatsApp sends you a code by SMS. Then the fraudster writes to you, often posing as a friend, and asks you to forward it. Whoever enters the code gets your account.
What is different with reverse OTP
The code was not sent to you. It appears on the website you opened yourself, and you send it to the business account named there. It belongs to this one sign-up and unlocks nothing in your WhatsApp account.
What the business learns
Your number and the name in your WhatsApp profile, the same as if you had written to them yourself. No password, no received code, no access to your chats.
Explaining it on your page
Visitors who know the warning hesitate. One sentence next to the button helps: “You send the code shown here; it only confirms this sign-up.”
Three signs of a safe flow.
If one of them is missing, do not send anything.
You started it
You opened the website and tapped sign up yourself. Nobody asked you in a chat.
The code is on the page
You did not receive it by SMS. It is shown on the page and already written into the message.
It goes to a business account
The chat opens with a business account, not with a person from your contacts. Afterwards you are signed up, nothing else happens.
Scam or sign-up?
The same word, “code”, for two very different things.
| Aspect | Account takeover scam | With Sendity |
|---|---|---|
| Where the code comes from | Sent to you by SMS from WhatsApp | Shown on the website you opened |
| Who asks for it | Someone in a chat, often under time pressure | Nobody; you start the sign-up |
| Where it goes | To a person | To the business account named on the page |
| What it unlocks | Your WhatsApp account | Only this one sign-up |
What users do not give away.
Sending the code reveals less than filling in a form.
No password, no received code
Nothing that could open an account changes hands.
A code that expires
The code is short-lived and tied to this one request. Sent later or elsewhere, it is worthless.
A visible recipient
The message goes to a business account, the same one a visitor would write to with a question.
Live on your page in minutes.
Sendity runs as a compact widget on your page. Pick the path that fits your website.
Sending a code: common questions.
Can someone take over my WhatsApp with the code I send?
No. It is not a WhatsApp code. It only confirms the sign-up on the website where it was shown.
What if someone asks me to send a code?
Do not. Only send a code you see on a website you opened yourself, and never forward a code you received by SMS.
Will the business message me afterwards?
Only if you agreed to it. Verifying your number is not consent to marketing.
Is there an alternative to WhatsApp?
Yes, sending the code by email, or by SMS if the website allows it.
Keep reading.
Reviewed for accuracy in by Christian Schätzlein.
See what sending a code feels like.
Try the live demo on your phone. It takes ten seconds.