WhatsApp is one of the most widely used and reliable messaging and voice-over-IP (VoIP) services today. However, users commonly make the mistaken assumption that because WhatsApp has end-to-end encryption, it must be completely safe. They consequently share information and click on links, all the while thinking they are being protected.
End-to-end encryption does protect you — up to a point. But it isn’t an impenetrable fortress wall that will repel all invaders. There are some chinks in the armor. WhatsApp scams are possible, and dangerous individuals are out there. Here’s how to protect yourself.
Is WhatsApp safe to use?
Yes, WhatsApp is safe to use for everyday messaging and calls with family, friends, or work, but it’s not completely private. It’s end-to-end encrypted, which keeps your communication safe from interception while in transit between you and the recipients and also prevents WhatsApp and Meta from reading them.
However, encryption, no matter how strong, doesn’t protect your messages if your account was compromised or if your device was left unlocked. Similarly, recipients can save and forward content they received, and WhatsApp won’t alert you. Not to mention, WhatsApp itself collects metadata and user information to share with Meta’s companies and partners.
One prominent issue with WhatsApp is that your backups aren’t end-to-end encrypted by default, leaving up to 90% of users with their backups unencrypted.
Suspicious WhatsApp Messages?
How safe is WhatsApp for kids?
WhatsApp can be suitable for teenagers and tweens who already know their contacts and general online safety. But standard WhatsApp accounts are not child-safe by default. There are very limited options for parental oversight and supervision, increasing the risks of cyberbullying or grooming over messages.
The National Center on Sexual Exploitation (NCOSE) labels WhatsApp as one of the “breeding grounds for child sexual abuse, grooming, sextortion and sex trafficking.” The ability to add anyone to a WhatsApp group also puts children at risk. One incident included 300 secondary-school-aged kids being added to a WhatsApp group along with unknown individuals.
As a parent, you should enable all possible security settings on your child’s WhatsApp account. Tap on Settings, Privacy, then Groups. Set “My contacts” as the only users who are allowed to add the account to groups.
Is WhatsApp safe for sending your private photos?
WhatsApp is generally considered safe for sending private photos. End-to-end encryption takes care of that. As long as your actual physical device is protected to stop any offline snoopers, you will be fine. The one minor weakness in the chain is the backup feature.
When sending more sensitive media, use the View Once feature by tapping the “1” icon before sending. That way, it disappears after the recipient views it once. That said, they could still screenshot it, so complete secrecy isn’t guaranteed.
On the WhatsApp mobile app on iPhone, you have the option to upload a backup of your chats and media to your iCloud account. On the off-chance that iCloud is hacked, your photos will be at risk. If your backups are stored on a separate iPad or MacBook, physical access to those devices could result in your backups being stolen.
As of 2025, WhatsApp supports passkey-protected backups. Before backing up your conversations, go to Settings, Chats, then “Chat backup” and enable “End-to-end encryption backup,” entering a strong passkey.
But it’s not just your own device’s security that you need to worry about. Before you start sending the contents of your entire Photos app to another user, you need to stop and think about the other person’s phone.
Before sending photos to another user, ask yourself the following:
- How secure is their device? Does their phone have a PIN?
- Does their WhatsApp have 2-step authentication enabled?
- Would this recipient forward your photos to others or take screenshots? If you’re sending sensitive photos, a leak could lead to sextortion.
The bottom line is, how trustworthy is the person you’re sending your photos to? If you find yourself hesitating, trust your gut.
Is WhatsApp secure from hackers?
So far, there have been no public incidents of WhatsApp’s encryption being broken. Whenever there’s a “WhatsApp hack” in the news, it’s usually through bypassing WhatsApp’s built-in security, compromising the device itself or tricking the user.
One recent example includes Paragon Graphite spyware targeting about 90 journalists and civil society users through a zero-click compromise. In 2026, WhatsApp patched CVE-2026-23863 and CVE-2026-23866 vulnerabilities where the app would automatically launch executable attachments or trigger URL and media processing.
WhatsApp’s biggest security vulnerability will always be its individual users. Social engineering is still one of the most common tactics scammers and hackers use to get access to codes, spread malware links, or perform a SIM swap, enabling them to steal multiple accounts, not just WhatsApp.
Are WhatsApp calls and video calls secure?
WhatsApp video and voice calls are end-to-end encrypted by default, so you won’t have to manually enable it. However, call metadata is not encrypted.
It doesn’t include the call itself but information on the call’s duration, timestamps, and participating parties. This puts them at high risk of spyware and on-device compromises, either on your own device or on the recipient’s.
If the device is compromised with malware or spyware, no strength of encryption will keep your conversations private. A recording device can steal calls in their entirety, regardless of encryption.
The CVE-2021-24043 vulnerability, now patched by WhatsApp, enabled hackers to create malicious RTCP packets that trick the app into parsing data outside of the allowed parameters, which could be used to compromise private calls.
A deeper dive into WhatsApp security
Got some rapid-fire questions about WhatsApp security? Well, we’ve got some rapid-fire answers for you.
WhatsApp is safe for having conversations with strangers who may become eventual dates. But you should not click any links they give you, and you need to be very circumspect about what you reveal about yourself until you get to know them better.
Use WhatsApp’s Block and Report tools if a match starts asking for money or verification codes, or if they start sending you suspicious links out of nowhere.
It is, in general, safe to chat with strangers on WhatsApp. However, you should not click any links they give you, nor give them any personal information, such as contact details or intimate photos. In your Settings, set Group to “My contacts” to prevent strangers from adding you to their groups without your explicit approval.
Your photos can be leaked, despite end-to-end encryption on WhatsApp. Screenshots can be taken, or images can be removed from the device by a thief or accessed by malware. Or you may simply commit human error and send a photo to the wrong person! Before sending any sensitive media, use the View Once feature. However, don’t treat it as foolproof.
It is safe to open a WhatsApp message from an unknown number, but it is not safe to open any links in that message. The link could be connected to malware. If you determine that the message is likely a scam or a phishing attempt, block and report the contact so WhatsApp can investigate the individual.
Anonymous WhatsApp polls are not completely safe in that the information that’s shared is not entirely private. Group admins have access to information regarding who voted in which way.
WhatsApp can see and collect the metadata, and third-party polling platforms installed on your phone may have terrible security policies. For more sensitive questions, it’s best to stick to anonymized survey tools to avoid parts of your personal data being revealed through WhatsApp’s “View votes” option.
Yes, WhatsApp is much safer than regular SMS texting. That’s because WhatsApp messages are end-to-end encrypted by default, while text messages aren’t and can be intercepted more easily. Also, WhatsApp allows you to delete recently sent messages or use the View Once feature to minimize the risk of leaks.
Yes, third-party applications, whether legitimate parental control apps or spyware, can record end-to-end encrypted calls made through WhatsApp. The encryption only protects your calls and messages from being intercepted while in transit. However, since the encryption is done locally on your phone, any installed spyware or screen recording software will be able to see your entire call.
Is WhatsApp’s end-to-end encryption truly secure?
Is it really “military-grade encryption,” as it’s often referred to? WhatsApp uses the Signal Protocol to encrypt its messages. It was developed by Open Whisper Systems and is also used by the Signal messaging app, which is known for its privacy and security.
The answer is yes. End-to-end encryption on WhatsApp is secure. When you send a message, it is encrypted with a key. That key is then instantly sent to the recipient, where it is then used to decrypt your message. What encryption does not protect against is metadata harvesting or attacks through social engineering and spyware. Additionally, since backups aren’t automatically encrypted, they could be compromised. For example, some business chats on WhatsApp use Meta-hosted tools and Meta AI chat, which aren’t the most privacy-friendly.
The whole encryption/decryption process is done in the background at lightning speed. You don’t actually see it happening as you send and receive messages. Note that end-to-end encryption doesn’t stop the recipient from screenshotting your messages. It also doesn’t protect you from notifications and link previews provided by the app.
While end-to-end encryption is secure, the usual caveats about backups and Meta being Meta still apply. WhatsApp is owned by Meta, the same company fined $5 billion by the FTC in 2019 after the Cambridge Analytica scandal, in which a third-party app harvested data from tens of millions of Facebook users without proper consent. Strong encryption on a message doesn’t guarantee strong data practices from the company running the app.
What are the main security concerns with WhatsApp?
So, your conversations, photos, and videos are protected by end-to-end encryption. That means everything is cool, right?
Well, from a technical standpoint, yes. But it bears repeating that not all threats are secret break-ins through the back door. It’s much easier for a scammer to come through the front door instead.
Security concerns on WhatsApp include:
- Malware links: The golden rule here is if you don’t know the person very well, don’t click any links they send you. Doing so could be as harmful as handing over complete access to your phone.
- SIM swap attacks: Since WhatsApp doesn’t do passwords, the way to take over a WhatsApp account is to register a phone number on another phone. If this happens to you, an activation code will be sent to you to confirm that you want this change. The scammer will then contact you and attempt to persuade you to hand it over.
- Phishing and social engineering: Scammers can impersonate family and friends, support agents, recruiters, or crypto offers to pressure you into sharing codes or sending funds through gift cards or wire transfers.
- Spyware campaigns: Pegasus-style tools target devices directly and don’t have to crack encryption. They’re usually slipped in through zero-click attacks or malicious links.
- Group chat vulnerabilities: Public invites to WhatsApp groups or those forwarded through compromised contacts can expose you to scams, spam, or harassment online.
- Cloud backups: WhatsApp backups are not end-to-end encrypted by default. You’d need to manually add a passkey before backing up to your preferred cloud server.
- WhatsApp scams: WhatsApp is often used by scammers to target unsuspecting victims. Meta had to delete over 6.8 million accounts related to scams and fraud.
Scammers are getting better at crafting convincing messages. It’s no longer enough to simply look for typos or grammar errors to identify a scam. Use Moonlock’s Scam Detector to help you check suspicious messages for the warning signs of a scam or phishing attempt. Here’s how you do it:
- Sign up for a 7-day free trial of Moonlock.
- Open Moonlock, then choose Scam Detector from the left-hand sidebar.
- Copy and paste the suspicious message into the Scam Detector.
- Click Check.
Moonlock will check the message, determine whether it’s safe to engage with it or not, and provide you with advice on what to do in the case of a dangerous message. This will help protect you from scammers.
How to safeguard your privacy while using WhatsApp
There’s no need to uninstall WhatsApp due to security concerns. Instead, follow these tips on how to stay safe on WhatsApp:
- Don’t click links from unknown people.
- Don’t hand over activation codes if asked.
- Enable 2-step verification on WhatsApp by going to Settings > Account > Two-step verification.
- Disconnect your phone from WhatsApp Web when you’re not using it.
- Use a strong password and 2-factor authentication on your Apple Account to protect your WhatsApp backups.
- Use a PIN on your phone.
- Enable encrypted backups by going to Settings, Chats, Chat Backup, then End-to-end encrypted backup, and select “Use passkey.”
- Turn on Advanced Chat privacy by opening the sensitive chat, then tap on the group or contact name. Select Advanced Chat Privacy, then toggle “Advanced chat privacy” on.
- Create a passkey by going to Settings > Accounts > Passkeys > Create passkey.
- Keep your Accounts Center disconnected unless you’re using cross-app features.
- Restrict Privacy by disabling last seen, read receipts, profile photo, and calls.
- Run a Deep Scan using Malware Scanner to ensure that your device isn’t infected.
We may sound a tad pessimistic at times, but unfortunately, there are always going to be a few people out there who are determined to crash the party and ruin things for everybody else.
By learning the tactics of would-be attackers and employing some countermeasures to foil their plans, you can stay safe on WhatsApp. To paraphrase a Scooby-Doo villain, “I would have gotten away with it, too, if it weren’t for that meddling Moonlock.”
This is an independent publication, and it has not been authorized, sponsored, or otherwise approved by Meta Platforms, Inc. WhatsApp is a trademark of Meta Platforms, Inc.
