WhatsApp Strengthens Account Security With Passwords, Multiple Passkeys and Better Caller Context

01 Event

WhatsApp is rolling out a set of account-security changes designed to make account takeovers harder and give users more information before interacting with unknown callers. The update strengthens two-step verification, expands passkey support and adds caller context on Android.

Meta says more than one billion people have already configured a WhatsApp passkey, making the latest changes relevant at enormous scale.

02 What Changed?

The biggest change affects WhatsApp’s two-step verification. Previously, the feature relied on a six-digit PIN. WhatsApp says it is upgrading that protection to support a full password that can be longer, alphanumeric and include special characters. That gives users far more possible combinations than a short numeric PIN.

WhatsApp is also expanding passkeys. A passkey lets a user verify access using the authentication already built into a device, such as a fingerprint, facial recognition or screen-lock code. Users can now add more than one passkey to the same WhatsApp account, which is useful for people who use devices across Android and iOS.

On Android, incoming calls from numbers outside a user’s contacts can now display additional context, including whether the number comes from another country and whether the caller shares any WhatsApp groups with the recipient.

03 Why It Matters

Account security often fails at the point where convenience and human behavior meet. A six-digit PIN is easy to remember, but users can choose predictable combinations. One-time codes can also be stolen through phishing or social engineering. Stronger two-step credentials create another barrier when an attacker obtains a temporary login code.

Passkeys address a different problem. Traditional passwords can be reused, guessed or entered into fake websites. Passkeys rely on cryptographic credentials associated with a device and are designed to reduce exposure to common phishing methods.

The caller-context change targets social engineering rather than authentication. Scammers frequently depend on urgency: answer immediately, send money now, provide a code, or respond before thinking. Showing that an unknown caller is international or shares a group with you does not prove whether the call is safe, but it provides another signal before you engage.

04 What It Means for You

If you use WhatsApp regularly, the update is a good reason to review the security settings on your account rather than assuming default encryption protects every part of the experience.

End-to-end encryption protects message and call content in transit, but it does not stop someone from tricking you into handing over an account code, impersonating a relative or persuading you to send money. Account protection and scam awareness remain separate layers.

WhatsApp says passkeys can be managed under Settings > Account > Passkeys. Users should also consider upgrading two-step verification when the stronger password option becomes available to them. As with other large app rollouts, availability can vary as features reach accounts and platforms.

Unknown-caller information should be treated as context, not a trust badge. Sharing a group with someone does not mean that person is legitimate, and a domestic number is not automatically safe.

05 Numbers + Context

Meta says more than 1 billion people have already configured passkeys for WhatsApp. That is significant because security features become more valuable when ordinary users actually adopt them rather than leaving them buried in settings.

WhatsApp has also spent the past year expanding anti-scam and high-risk security tools. In January 2026 it introduced Strict Account Settings, a lockdown-style option intended particularly for people at risk of sophisticated attacks, such as journalists and public figures.

06 Earnyx Takeaway

The most useful part of this update is that WhatsApp is strengthening several different points of failure rather than presenting one feature as a complete security solution.

A stronger two-step password helps protect the account. Passkeys improve authentication. Caller context can help users slow down before responding to strangers. None eliminates scams by itself.

For users, the best response is simple: enable the strongest authentication available, keep the app and device updated, never share one-time codes, and treat unexpected requests involving money, credentials or urgency as something to verify through another channel.

Sources / References

Meta Newsroom, “New Account Security Features for WhatsApp,” Aug. 25–26, 2026; Meta security documentation and earlier WhatsApp Strict Account Settings announcement.