🔐 Securing your WhatsApp Business and Instagram (and Facebook): the guide for sellers and creators in Morocco

🌐 Français · English · العربية

For a seller or a creator, WhatsApp Business and Instagram are not just apps: they are the shop window, the till and the customer list. Losing them for a week means lost sales, and a scammer writing to your customers under your name. This guide explains the scams going around, the settings to turn on step by step, and what to do if it has already happened.

Updated: October 2026

🎬 This guide goes with the episode "Karim's password" of the Sirr el Code series. Short link to the episode: oufrid.com/motdepasse, which leads to the Has my password leaked? tool.

This guide builds on Theft, scams and AI: protecting your phone in 2026, which covers the phone itself (anti-theft, SIM card PIN, Advanced Protection). Here, we deal with the accounts.

App menus change often. The paths below are those of the official help pages checked on 28/10/2026. If your screen looks different, search the settings for the keyword ("two-step verification", "two-factor authentication").

In short

Never give away the 6-digit code you receive by SMS, not to a friend, not to a "technician". WhatsApp spells it out: not even to friends or family.
Turn on two-step verification on WhatsApp Business: since August 2026, WhatsApp has been replacing the old 6-digit PIN with a real password. Add an email address and a passkey.
Turn on two-factor authentication on Instagram and Facebook, preferably with an authentication app, and keep your backup codes off your phone.
Protect your email first: it is the recovery key to everything else.
Never share a password with an employee or an agency: give them their own access in Meta's business portfolio, or a linked device on WhatsApp Business.
Meta never contacts you by private message about the security of your account.

Why sellers' accounts are targeted

The account is worth money. An account with thousands of followers can be resold, used to advertise scams, or held to ransom.
Your customers trust you. With your WhatsApp, the scammer sends your customers "new payment details" or asks your relatives for money in an emergency. The Moroccan press described exactly this pattern in October 2026: hijacked accounts, requests for money, payments redirected to new accounts, then a chain reaction through contacts (L'ODJ, 25/10/2026).
Your number is public. It is on your page, your bags, your invoices. Anyone can try to register it on another phone: all they are missing is the code.
Sellers are in a hurry. A message saying "your page will be deleted in 24 hours" works better on someone who makes a living from it.

The 5 most common scams

Scam	What is really happening	The right reflex
1. "I sent you a code by mistake, can you send it back?"	Someone is trying to register your number on their phone. The message often comes from a friend's account that has already been hacked.	Never give the code. Call your friend by phone, not on WhatsApp.
2. Fake Meta support	A private message from "Meta Support" or "Instagram Team": account reported, verification required, link to follow.	Instagram never contacts you about account security by private message. Check Recent emails in the app.
3. "Copyright violation"	An email or message threatens to delete your page within 24 or 48 hours, with a link to a fake "appeal" form that steals your username, password and code.	Do not click. A real notice can be found in the app itself and in Recent emails.
4. Fake verification badge	Someone offers you the blue badge in exchange for a payment or your login details, by private message.	Meta Verified, the official subscription, is purchased inside the app. Nobody sells the badge by private message.
5. SIM swap	The scammer gets a duplicate of your SIM card and receives your texts, and therefore your codes.	Do not rely on SMS alone: WhatsApp password, passkey, authentication app, and a PIN on the SIM.

Scam 1 in detail. The 6-digit code WhatsApp sends by SMS is used to install your account on a phone. Whoever has it replaces you. WhatsApp's help asks you never to share this code, "not even with friends or family", and states that changing your password is not enough to remove the intruder: you have to re-register the account with a new code (WhatsApp, recovering a compromised account). The pretext varies: a mistake, an emergency, a "technical intervention", a contest. If you receive a code you did not ask for, someone is trying: do not reply, and turn on two-step verification.

Scams 2 and 3: checking an email without clicking. Instagram and Facebook show the emails they really sent inside the app: Settings → Accounts Center → Password and security → Recent emails (Facebook keeps security emails from the past year; Instagram, those from the last 14 days). If the message is not there, it is fake (Facebook, checking an email, Instagram, authentic emails). Facebook also reminds you that its staff never ask for your password by email.

Unsure about a message? Paste it into the scam checker: it spots the signs of a scam without sending anything over the Internet.

Passwords: what the authorities really say

The rules have changed, and many people still follow the old ones.

Length matters more than symbols. The US NIST (standard SP 800-63B-4, final version of July 2025) sets a minimum of 15 characters for a password used on its own, forbids imposing composition rules ("one capital, one digit, one symbol") and requires checking passwords against a list of already leaked passwords.
No forced change every 3 months. The same NIST forbids requiring periodic changes; you change it as soon as there is any doubt of compromise. France's ANSSI does not recommend systematic expiry for ordinary accounts either.
A different password for each service, in a manager. ANSSI recommends a password vault and multi-factor authentication; Morocco's DGSSI asks for passwords that are "long, complex and unique" for each service, and for two-factor authentication to be turned on "whenever possible".

In practice: a passphrase of 4 or 5 random words for your email and your password manager, and passwords generated by the manager for everything else. Test yours with Has my password leaked?: the tool checks whether it appears in real data breaches without ever sending it, and generates a strong passphrase.

Settings, step by step

1. WhatsApp Business

Two-step verification. According to the official help checked on 28/10/2026: More options (⋮) → Settings → Account → Two-step verification on Android (Settings → Account on iPhone). Since the announcement of 25/08/2026, the 6-digit PIN is becoming a password: at least 8 characters, with at least one letter and one number (WhatsApp blog, WhatsApp help). If your app still shows the old PIN, turn it on anyway.
Add an email address during setup: it lets you receive a login code by email and reset two-step verification if you forget it.
Create a passkey: Settings → Account → Passkeys. You log back in with your fingerprint, your face or your screen lock. You need Android 9 or later, a password manager and a screen lock; you can now add several, for example one Android and one iPhone (WhatsApp help, passkeys).
Check linked devices: More options → Linked devices. Log out any device you do not recognise.

2. Instagram

Two-factor authentication. According to the official help checked on 28/10/2026: More → Settings → Accounts Center → Password and security → Two-factor authentication, choose the account, then the method (Instagram help). Three methods: authentication app (recommended, such as Google Authenticator or Duo Mobile), SMS, or WhatsApp.
Backup codes: in the same section, Additional methods → Backup codes. Write them down on paper or in your password manager, not in your phone's photo gallery.
Passkeys: since April 2026, Meta says they also work on Instagram, with Accounts Center gradually becoming the Meta Account over a year (Meta, 23/04/2026). If your app offers it, accept.
Check the email and phone number on the account, and remove linked accounts and third-party apps you do not recognise.

3. Facebook (profile and Page)

Two-factor authentication: Settings & privacy → Settings → Accounts Center → Password and security → Two-factor authentication. Methods: security key, authentication app, SMS. You can get 10 recovery codes (Facebook help).
Passkeys: available on Facebook and Messenger since 2025; Facebook offers to create one when you log in. Do not create one on a shared device (Facebook help, passkeys).
Your Page depends on your profile: if an admin's profile falls, the Page is in danger. Every admin must have two-factor authentication turned on.

4. The recovery email

It is the back door to all your accounts: whoever controls your email can reset Instagram, Facebook and your WhatsApp password.

An address kept for important accounts, not the one printed on your invoices.
A unique passphrase, a passkey or an authentication app (for Gmail: myaccount.google.com/security).
Check that this address's recovery phone number and email are still yours.

Working as a team without sharing the password

Giving the password to an employee, a community manager or an agency means losing control: you no longer know who logs in, and you cannot remove a single person's access.

Instagram, Facebook and ads: the business portfolio. In Meta Business Suite, Settings → People → Invite people, then choose the assets (Page, Instagram account, ad account) and the tasks allowed. Only people with full control can add someone; Meta advises giving only the access people need. For an agency, use Partners with partial access (Meta Business help, partners).
Keep at least two trusted people with full control (you and a partner or a relative), each with two-factor authentication. If one person holds everything and loses their account, the business is stuck.
WhatsApp Business: linked devices. Up to four linked devices in addition to the phone, so several people can answer customers, without ever sharing the verification code (WhatsApp Business help). When someone leaves the team, log out their device the same day.
On the day an employee leaves or an agency contract ends: remove their access, check linked devices, and change any password they may have seen.

Hacked account: the official steps

Act fast: every hour, the scammer can write to your customers.

Reinstall or open WhatsApp with your number and enter the 6-digit code received by SMS or call. According to WhatsApp's help, this is the only way to kick the intruder out: all other devices are logged out.
If the app asks for a two-step verification password the scammer created and you do not know it, the help says to wait 7 days before trying again. If you had added an email, you can receive the code by email.
Warn your contacts and customers through another channel (Instagram story, SMS, phone call): the intruder may have impersonated you.
You need the SIM card for the number: if you have lost it, contact your carrier.

Instagram

According to the official help (Instagram, hacked account):

Look for an email from security@mail.instagram.com announcing a change of address: it contains a link to reverse the change.
Otherwise, on the login screen, tap Forgot password? → request a login link.
If that does not work, request support from the app with an email address only you control. If the account contains photos of you, you may be asked for a video selfie (deleted after 30 days).
The general entry point: instagram.com/hacked.
Once you are back in: new password, two-factor authentication, and a check of the email, phone number, linked accounts and third-party apps.

Facebook and Pages

Open facebook.com/hacked from a device you have logged in with before; there is a separate path for a hacked Page. Meta also has a recovery hub shared by Facebook and Instagram: meta.com/account-recovery-support.

Filing a complaint in Morocco

Unauthorised access to a computer system is punishable under the Penal Code (articles 607-3 and following, from Law 07-03). Keep screenshots (messages, numbers, the scammer's payment accounts) and:

report it on e-blagh.ma, the DGSN reporting platform launched in June 2024, which also covers online fraud;
or file a complaint at a police station or with the Royal Gendarmerie, especially if customers paid the scammer.

The final checklist

[ ] I have never given, and will never give, a code received by SMS.
[ ] WhatsApp Business: two-step verification on, with a password and an email.
[ ] WhatsApp Business: passkey created.
[ ] WhatsApp Business: linked devices checked, unknown ones logged out.
[ ] Instagram: two-factor authentication with an authentication app, backup codes stored off the phone.
[ ] Facebook: two-factor authentication on for every Page admin.
[ ] Recovery email protected by a unique passphrase and two-factor authentication.
[ ] A different password for each service, in a manager, and checked with Has my password leaked?.
[ ] PIN turned on for the SIM card (see the phone guide).
[ ] Team and agency: personal access in the business portfolio, at least two people with full control.
[ ] Any suspicious message goes through the scam checker before any click.

What I could not verify

To be honest: I found no alert published by the DGSSI (maCERT) or the DGSN specifically about WhatsApp accounts stolen through the code; the Moroccan cases mentioned come from the press. I also have no official Moroccan source on SIM swapping, nor the exact date when the WhatsApp password and Instagram passkeys reach every phone in Morocco (Meta talks about a gradual rollout). The Meta Business Suite "People" menu path comes from a help page that is not dated. I will update this guide as soon as I have better sources.

Sources

Need help?

I secure the online presence of sellers in Morocco: website, store, accounts and team access. See the e-commerce service, or contact me.

← All guides