info@lankaemarketing.com
+94 71 305 1 670
+94 777 44 2515

Blog

WordPress Plugin Security: Check Your Site in 2026
Posted by Chandimal Gamage

Can a WordPress Plugin Hack Your Website? How to Check and Protect Your Site in 2026

Security, Uncategorized 0

Can a WordPress plugin hack your website? Yes. A security flaw in an installed plugin can sometimes let attackers access data, create unauthorized accounts, change website content or upload malicious files. But an outdated plugin is not automatically hacked, and a website error is not proof of an attack. The right response is to identify the exact plugin, version, vulnerability and signs of compromise before taking action.

If you manage a business website, start with the 15-minute WordPress plugin security audit below. It explains what to check first, how to prioritize risks and when to involve your hosting provider or a security professional.

Why WordPress plugin security matters in 2026

Plugins extend WordPress with forms, SEO tools, payment systems, page builders and many other features. Each plugin also adds code that needs to be maintained. A vulnerability may affect only certain versions, configurations or user roles, so a security headline should never be treated as proof that every installation is exposed.

In its State of WordPress Security in 2026 report, Patchstack recorded 11,334 newly disclosed WordPress ecosystem vulnerabilities during 2025, with 91% reported in plugins. The report also says 46% had no patch available at disclosure. These figures describe reported vulnerabilities in Patchstack’s research, not the percentage of websites compromised.

WordPress’s official hardening guide recommends keeping plugins updated, removing plugins you do not use, choosing trusted sources and maintaining recoverable backups.

The 15-minute WordPress plugin security audit

This is a practical first-pass audit, not a guarantee that the site is malware-free. If you already suspect a breach, preserve evidence and avoid making uncontrolled changes to a live store or business website.

Minutes 0–3: List every installed plugin

  1. Sign in to your WordPress administrator dashboard.
  2. Open Plugins → Installed Plugins.
  3. Record each plugin’s name, version, update status and whether it is active.
  4. Check inactive plugins too: inactive code may still remain on the server, so remove unnecessary plugins rather than simply forgetting them.

Can’t access wp-admin? Ask your host or developer to inspect the installed plugin directory and server logs. Do not blindly delete folders if the site is already failing.

Minutes 3–6: Check vulnerability advisories, not just update badges

Search the exact plugin name and installed version in reputable vulnerability databases, such as the Patchstack vulnerability database, or your security scanner’s advisory details. Verify the affected version range, whether a fixed release exists and whether the flaw requires authentication. A plugin can be fully updated yet still have a newly disclosed, unpatched vulnerability.

Minutes 6–9: Check for warning signs

  • New administrator accounts you did not create.
  • Unexpected redirects, spam pages or modified homepage content.
  • Unexplained changes to payment, form or notification settings.
  • Security alerts from the host, scanner or search engine.
  • Unfamiliar scheduled tasks, modified files or suspicious login activity.

Important: Slow loading, a 500 error, a white screen or an expired SSL certificate can have ordinary technical causes. They are not, by themselves, evidence of hacking.

Minutes 9–12: Confirm backups and recovery access

Verify that you have a recent backup of both website files and database, ideally stored outside the same hosting account. Check whether the backup can be restored and whether you have working host-level access. A backup that has never been tested is not a reliable recovery plan.

Minutes 12–15: Assign a response priority

FindingPriorityRecommended next action
Known actively exploited vulnerability affecting your installed versionUrgentRestrict exposure, apply a verified patch or temporarily disable the affected feature with professional support; inspect for compromise.
Known vulnerability; patched release availableHighTake a verified backup, update promptly, then test the site and review logs.
Known vulnerability; no patch availableHighAssess exposure, disable or replace the plugin where feasible; ask the host/security provider about temporary mitigation.
Outdated plugin with no confirmed advisoryPlanned promptlyCheck compatibility and release notes; back up and update through a controlled process.
Unused or abandoned pluginMaintenanceConfirm it is unnecessary, then delete it and its remaining integrations safely.

How can you tell whether a plugin is vulnerable?

A reliable advisory normally names the plugin, affected version range, vulnerability type, severity, disclosure date and any patched version. Check the details rather than relying on a dramatic social-media post. A vulnerability may require a logged-in editor account, a specific plugin setting or a particular integration. Those conditions matter when deciding how urgently your website is exposed.

Do not confuse three different conditions: an outdated plugin needs maintenance; a vulnerable plugin has a confirmed security weakness affecting its version; a compromised website has evidence of unauthorized activity. One condition does not automatically prove the others.

What should you do if a vulnerable plugin has no update?

  1. Confirm the advisory applies to your exact installed version.
  2. Check whether the affected feature can be safely disabled or the plugin can be temporarily removed.
  3. Review the plugin developer’s official security notice and any mitigation guidance.
  4. Ask your hosting or security provider whether a relevant virtual patch or application firewall rule is available. A generic firewall does not block every plugin vulnerability.
  5. Inspect logs and administrator accounts for evidence of earlier exploitation.
  6. Replace abandoned software with a maintained alternative when practical.

For a critical business website, test changes on staging when possible. Removing a payment, booking or forms plugin without planning can disrupt revenue or customer communications.

Should you turn on automatic plugin updates?

Automatic updates can reduce the time your site runs an older vulnerable version. WordPress supports per-plugin automatic updates through Plugins → Installed Plugins. However, updates can also cause compatibility problems, especially on heavily customized websites. Maintain off-site backups, monitor update notifications and test important functionality after changes. For critical integrations, establish a controlled update process with prompt security exceptions.

See the official WordPress automatic updates guide for the available controls and troubleshooting steps.

What if your WordPress website is already behaving strangely?

Start by documenting the symptoms and their timing. A broken plugin update, expired SSL certificate and malware infection require different fixes.

SymptomPossible explanationFirst check
White screen after plugin updatePHP error or compatibility issueHost error logs, recovery mode, recent update history
SSL or browser certificate warningExpired/misconfigured certificateCertificate validity and host SSL configuration
Unknown administrator accountPotential unauthorized accessAccount audit, login logs, credential security
Visitors redirected to unrelated pagesPossible malicious code or configuration issueServer logs, integrity scan, redirects and DNS
Contact form suddenly stops sendingPlugin conflict, email delivery or configurationForm settings, SMTP logs and recent updates

Suspect a real compromise? Use this recovery sequence

  1. Preserve evidence. Save relevant logs, screenshots and a secure copy of the affected environment before extensive cleanup, where feasible.
  2. Contain exposure. Contact the hosting provider and consider restricting access or placing the site into a controlled maintenance state if customer data or transactions may be affected.
  3. Secure access. Reset compromised credentials, revoke unknown sessions and enforce multifactor authentication for administrators.
  4. Investigate scope. Review files, database, users, plugins, themes, scheduled jobs and hosting accounts. A plugin update alone may not remove an established backdoor.
  5. Restore safely. Clean or rebuild from trusted software and a known-good backup; then patch the entry point before reopening.
  6. Monitor and communicate. Watch logs and business functions. If personal data may have been exposed, seek advice on applicable notification obligations.

For suspected compromise involving payments, customer information or multiple sites on the same hosting account, involve a qualified incident-response professional.

A practical WordPress security routine for small businesses

  • Daily or automated: Backups, uptime/security alerts and monitoring for high-risk advisories.
  • Weekly: Review plugin, theme and core updates; test contact forms, checkout and key pages after changes.
  • Monthly: Audit administrator accounts, unused plugins, backup restore readiness and hosting/PHP support status.
  • After a critical advisory: Reprioritize immediately rather than waiting for the next routine maintenance day.

For websites managed by an agency, assign a named person to receive vulnerability alerts and approve urgent updates. Security depends as much on responsibility and response time as on which plugin is installed.

Common questions about WordPress plugin vulnerabilities

Can a disabled WordPress plugin still be a security risk?

Potentially. Deactivation usually stops normal plugin execution, but files remain installed and exposure depends on the vulnerability. Delete unused plugins after confirming they are not needed.

Does updating a vulnerable plugin mean my site is safe?

Not necessarily. Updating closes the addressed flaw, but it does not prove that an attacker did not exploit it earlier or that other weaknesses are absent.

Are paid WordPress plugins safer than free plugins?

Price alone does not establish security. Evaluate maintenance history, vendor responsiveness, vulnerability disclosures and update support.

Can a WordPress firewall stop every plugin attack?

No. A web application firewall can reduce exposure to some attacks, but coverage varies by vulnerability and configuration. It should complement patching, access controls and monitoring.

How many plugins are too many?

There is no universal safe number. A small collection of poorly maintained plugins can create more risk than a larger collection of actively maintained ones. Review necessity, quality and update discipline.

Does an expired SSL certificate mean the website has been hacked?

No. An expired SSL certificate is a certificate-management problem and does not, on its own, demonstrate unauthorized access. It should still be fixed promptly because visitors may receive security warnings.

Final takeaway: Check the exact risk before taking action

WordPress plugin security is not about installing one more security plugin and forgetting the problem. It is about knowing what is installed, watching credible advisories, keeping reliable backups, applying updates safely and responding quickly when a real vulnerability affects your site. If a business-critical site shows signs of compromise, treat the incident as more than a routine plugin update.

Related reading: Why Is My Website Not Showing on Google? and Crawled – Currently Not Indexed: What to Fix. Website security, availability and search visibility are related, but each needs its own diagnosis.

Sources and further reading

Editorial note: This article provides general security guidance and a practical assessment framework. It does not report an original penetration test or guarantee that a particular website is secure. Review published advisories and platform interfaces before acting.

IS SOMEONE READING YOUR WHATSAPP?
Posted by Chandimal Gamage

Can Someone Read Your WhatsApp Messages Through Linked Devices? How to Check and Remove Them

Cybersecurity & Digital Safety, WhatsApp 0

Quick answer: Yes. If someone has successfully linked another device to your WhatsApp account, that device may be able to read messages available to its session and send messages as you. To check, open WhatsApp on your main phone, go to Linked devices, review every listed session, and log out of anything you do not recognize. An unfamiliar device is a reason to act promptly, but a familiar device name alone does not prove who used it.

If you have been logged out of WhatsApp or see a notice that your number was registered on a new phone, skip to the account recovery section: that is different from an ordinary linked-device session.

How to check who is linked to your WhatsApp in two minutes

  1. Open WhatsApp on your primary phone. Do this in the official app, not through a link in a text message.
  2. On Android: open the three-dot menu and choose Linked devices. On iPhone: open Settings → Linked Devices. The exact wording or placement can change with app updates.
  3. Review the list. Look at device or browser descriptions and any activity information shown. Compare them with your own laptop, desktop browser, tablet and companion phone.
  4. Tap a session you cannot identify, then choose Log out. Repeat for any other suspicious sessions.
  5. Review account security. Turn on two-step verification, keep WhatsApp and your phone updated, and protect access to your unlocked phone.

Important: WhatsApp says it cannot provide the identity, time or location of someone who accessed your account. Treat the Linked Devices screen as a session-management tool, not a forensic investigation report.

What does an unfamiliar linked device actually mean?

WhatsApp supports linked sessions on supported computers, browsers, tablets and companion devices. A linked session can operate independently of your phone being continuously online. Someone who successfully links a device may be able to interact with your WhatsApp account from that device, subject to the platform’s synchronization and feature limits.

That does not mean every unexpected device label is proof of hacking. A browser session from your office computer, an old laptop, or a device you once authorized can be easy to forget. If you cannot account for a session, logging it out is the safer choice.

What if no unfamiliar devices appear?

A clean list is reassuring, but it cannot prove that nobody has ever viewed your messages. For example, someone with access to an unlocked phone may have read chats directly, and a previously disconnected session may no longer appear. Do not assume that a phone call, a missed call or merely knowing your number lets someone read your WhatsApp chats.

Which situation are you dealing with?

What you noticeWhat it may meanFirst action
An unknown computer or browser in Linked DevicesAn active session you cannot explainLog it out and secure the primary phone
A message asking you to scan a QR code or enter a linking codeA possible attempt to trick you into authorizing accessDo not approve it; verify the request independently
A six-digit WhatsApp registration code you did not requestSomeone may be trying to register your numberNever share the code; review security
“Your phone number was registered with WhatsApp on a new device”Possible primary-account registration on another phoneUse WhatsApp’s official Log back in recovery flow
Friends receive messages you did not sendPossible account misuse or another security problemCheck linked devices, secure the account, and warn contacts

How can someone link another device without you realizing?

Device linking normally requires an authorization step, such as scanning a WhatsApp QR code or following the supported phone-number linking process. The risk is often social engineering: a person may persuade you to approve a link by claiming it is needed for a delivery, security check, prize or technical support. Someone with access to your unlocked phone may also be able to authorize a device.

Practical rule: Never scan a WhatsApp linking QR code or enter a linking code because a stranger, caller or unsolicited message tells you to. Use only the official WhatsApp device-linking process for a device you personally intend to connect.

What to do immediately if you find a suspicious device

1. Log out the unfamiliar session

From Linked devices, select the unfamiliar entry and tap Log out. If you are unsure which sessions are yours, consider signing out of all linked sessions and reconnecting only the devices you personally control.

2. Secure the phone itself

Change a compromised phone unlock PIN or password, review who can unlock your device, and install available operating-system and WhatsApp security updates. If someone can routinely access your unlocked phone, logging out a linked session alone may not solve the underlying problem.

3. Enable WhatsApp two-step verification

In WhatsApp, open Settings → Account → Two-step verification and follow the instructions. Add a recovery email you control when the app offers that option. Two-step verification helps protect account registration; it is not a substitute for keeping your phone and linking approvals secure.

4. Check for signs of misuse

Review recent messages and ask trusted contacts whether they received unusual requests from you. If fraudulent messages were sent, warn contacts not to send money or share codes. Avoid claiming you know exactly what a linked session accessed: WhatsApp’s device list does not provide a full history of messages read.

5. Do not pay an “account recovery expert”

Anyone promising to reveal the identity of a linked-device user or secretly recover WhatsApp access for a fee should be treated with caution. Use WhatsApp’s own account and security tools.

What if WhatsApp says your number was registered on another phone?

This is a different problem from an unfamiliar WhatsApp Web session. According to WhatsApp’s official recovery guidance, if your account is compromised and your phone is safe, you can use the Log back in process, enter your international phone number, and verify with the six-digit code sent by SMS or call. WhatsApp states that re-registering with that code logs out other devices.

If a two-step verification PIN appears that you do not know, WhatsApp explains that in some cases you may need to wait seven days to access the account without that PIN. Follow the current instructions shown in the official app and Help Center; do not share the registration code with anyone.

Does logging out stop someone from reading messages they already saw?

Logging out ends that linked session’s future access. It cannot undo information someone may already have read, copied, photographed or forwarded. That is why it is important to act promptly, review sensitive conversations and take extra precautions if you shared financial information, passwords or verification codes.

Can a stranger read WhatsApp just by calling you?

A normal phone call does not, by itself, authorize a WhatsApp linked device. Claims that any missed call automatically gives a stranger access to all WhatsApp messages are misleading. The practical threats covered here are unauthorized device linking, account registration takeover, and direct access to an unlocked phone. Keep your apps updated to reduce exposure to software vulnerabilities as well.

A five-minute WhatsApp privacy routine

  • Check Linked devices after using WhatsApp on shared or public computers.
  • Log out sessions you no longer use.
  • Never share six-digit registration codes or two-step verification PINs.
  • Do not approve device-linking requests you did not initiate.
  • Enable two-step verification and a strong phone screen lock.
  • Update WhatsApp and your operating system regularly.

Frequently asked questions

How do I know if my WhatsApp is linked to another phone?

Open WhatsApp on your primary phone and review Linked devices. The list shows currently linked sessions. A session you do not recognize should be logged out.

Can someone read my WhatsApp messages from a linked laptop?

A properly linked computer may access messages available to that session and send messages through your account. If it is not your device, log it out immediately.

Will WhatsApp notify me if someone links a device?

WhatsApp may show security or linking notifications, but do not rely on receiving or noticing a notification. Check the Linked Devices list directly.

Can I see the location or identity of a person using my WhatsApp Web?

No reliable identity or location investigation is available through the Linked Devices screen. WhatsApp says it cannot provide the identity, time or location of someone who accessed your account.

Does two-step verification stop every linked-device attack?

No. It adds protection to account registration, but you should also prevent unauthorized device linking and protect your unlocked phone.

What should I do if I receive a WhatsApp code I didn’t request?

Do not share the code, do not follow instructions from an unexpected caller, and review your account security. If you lose access, use WhatsApp’s official account-recovery process.

Final takeaway

If you suspect someone is reading your WhatsApp messages, start with Linked devices. Remove unknown sessions, protect your phone, and enable two-step verification. If your number has been registered on a new phone, use the separate official account-recovery flow. The goal is to regain control quickly—not to rely on alarming claims or unverified recovery services.

Related reading from The Digital Edge

Official sources and editorial notes

Editorial note: Menu labels may vary by operating system and WhatsApp version. This article is general safety guidance, not a forensic determination of account access. Last reviewed: 25 October 2026.

Is that Google, Microsoft or bank email real? Learn a 60-second verification method, warning signs and what to do if you've already clicked
Posted by Chandimal Gamage

Is That Email Really From Google, Microsoft or Your Bank? How to Spot a Fake

Cybersecurity & Digital Safety, Security 0

Quick answer: If an email claims to be from Google, Microsoft or your bank, do not trust its logo, display name or urgent wording. Open the company’s app or type its known website address yourself, sign in, and check whether the alert or requested action appears there. If it does not, treat the message as suspicious until you verify it independently.

A fake security alert can look professional, use your name and even appear in a familiar email conversation. The safest question is not “Does this email look real?” but “Can I confirm this request without using anything inside the email?” This guide gives you a practical verification routine, with separate steps for Google, Microsoft and banking messages.

The 60-second test: Is this email genuine?

  1. Stop. Do not click a button, open an attachment, reply, call a number in the message or scan a QR code.
  2. Identify the claim. Is it about a login, payment, password reset, suspended account or urgent verification?
  3. Inspect the sender. Expand the full email address. A recognizable display name is not proof. Watch for extra words, substituted characters and unrelated domains.
  4. Open the real service separately. Use your saved app, a trusted bookmark or an address you know is correct—not a link from the message.
  5. Check the account. Look for the same alert, transaction or notification in the account’s official security or activity area. For banking issues, call the number on your card or official statement if needed.
  6. Decide. If you cannot verify the request, do not act through the email. Report it as phishing and contact the organization through a trusted channel.

Important: Not finding an alert in an app does not prove an email is fraudulent. Some genuine notices are delivered only by email. When in doubt, verify with official support through a separately obtained contact method.

What a fake email can look like in 2026

Phishing is an attempt to persuade someone to reveal credentials, transfer money or open malicious content by impersonating a trusted organization. The warning signs are often about the action requested, not the writing quality. A polished message with perfect grammar can still be a scam.

Email saysWhy to be cautiousSafer next action
“Unusual sign-in. Verify immediately.”Could be a real security alert or a credential-stealing link.Open your account’s security activity page independently.
“Your Microsoft account will be closed today.”Artificial urgency can push you toward a fake sign-in page.Check Microsoft account activity through the official site.
“Your bank transfer is on hold. Confirm your PIN.”A request for a PIN or password is a major danger signal.Use the bank’s app or call its verified number.
“Open the attached invoice to avoid a penalty.”Unexpected attachments may contain harmful content.Verify the invoice through the vendor’s known contact.
“Scan this QR code to secure your account.”QR codes can conceal a destination you cannot inspect easily.Navigate to the service yourself instead.

How to check a Google or Gmail security email

  1. Open a fresh browser tab or the Google app, without clicking the email.
  2. Go directly to Google Account security notifications or the Security section of your Google Account.
  3. Review recent security activity and devices. If you see an unfamiliar session, follow Google’s account-security instructions from that trusted page.
  4. In Gmail, examine the complete sender address and any phishing warning. If suspicious, use the message menu and choose Report phishing.

Google advises users not to enter a Google Account password after following a suspicious email link. A real-looking sender name or familiar logo is not enough to establish authenticity. Google’s official phishing guidance explains these checks.

How to check a Microsoft or Outlook account alert

  1. Open a separate tab and go to your Microsoft account using a trusted bookmark or the address you already use.
  2. Review Microsoft account recent activity for unfamiliar sign-ins or security challenges.
  3. For a work or school account, use your organization’s established Microsoft 365 portal or ask your IT administrator to verify the notice.
  4. In Outlook, use the Report menu and select Report phishing when available.

Microsoft warns that attackers can spoof a sender address. Outlook’s unverified-sender indicators can be useful, but their absence is not a guarantee of safety. See Microsoft’s official Outlook phishing guide.

How to check a suspicious bank email

Banking messages deserve an extra layer of caution because a single rushed action may expose money or sensitive personal information.

  1. Do not use the phone number, payment link or QR code supplied in the suspicious email.
  2. Open your bank’s official mobile app or website using your usual method.
  3. Check recent transactions and secure messages.
  4. If a payment, card issue or identity check remains unclear, call the number printed on your bank card or official statement.
  5. Never provide a PIN, one-time verification code or online-banking password to someone who contacted you unexpectedly.

The US Consumer Financial Protection Bureau advises customers to contact their bank using a number from a different, trusted source when an email or text asks them to verify account information. Read the CFPB guidance.

Why checking the sender address alone is not enough

A suspicious domain is a useful clue, but it is not a complete test. Attackers may imitate brand names, compromise a legitimate mailbox, or use an apparently normal-looking sender. Conversely, some legitimate services send mail through third-party platforms. Email authentication technologies such as SPF, DKIM and DMARC help systems assess whether a sender is authorized, but ordinary readers should not treat a technical “pass” result as proof that a request is safe.

A better rule: Check both the message’s identity and the action it asks you to take. An unexpected request for credentials, payment or software installation should be verified independently even when the email looks convincing.

What if you already clicked the link?

You clicked but entered nothing

Close the page. Do not download or run anything it offers. Keep your browser and device updated. If a file downloaded or you suspect malicious software, run a reputable security scan.

You entered your password

Go to the genuine service independently and change the password immediately. If you reused that password elsewhere, change it on those accounts too. Review active sessions, recovery details and recent account activity; enable multifactor authentication. If you entered a verification code, treat the account as potentially compromised and follow the provider’s recovery guidance.

You shared bank details or sent money

Contact your bank’s fraud department immediately using a verified number. Ask about freezing affected cards or accounts and whether a transfer can be recalled. Keep records of the message and transaction. In the US, IdentityTheft.gov provides personalized recovery steps for identity theft.

How to report the email

  • Gmail: Open the message, choose the three-dot menu beside Reply and select Report phishing.
  • Outlook: Select the message and use Report > Report phishing where available.
  • US readers: Report suspected fraud at ReportFraud.ftc.gov. The FTC also recommends forwarding phishing emails to reportphishing@apwg.org.
  • Bank impersonation: Notify your bank through its verified fraud channel.

A practical habit that works better than memorizing scam examples

Imagine receiving a message that says your cloud storage will be deleted in 30 minutes unless you sign in. The logo is correct, the email mentions your name and the button looks familiar. Instead of deciding whether the design is convincing, close the email and open the storage service from your own bookmark. If the account is functioning normally and no matching warning appears, verify through official support before taking any action. This is an illustrative scenario, not a claim about a tested phishing campaign.

The habit to remember is simple: Never let an unexpected email choose the website, phone number or payment route you use to verify it.

Frequently asked questions

Can a phishing email use the real Google or Microsoft logo?

Yes. Logos and brand colors are easy to copy and do not authenticate a message.

Can a fake email have perfect grammar?

Yes. Writing quality is not a reliable safety test. Focus on the sender, the request and independent verification.

Does a padlock or HTTPS mean the linked website is genuine?

No. HTTPS encrypts the connection to a site; it does not prove that the site belongs to the organization it claims to represent.

Is every urgent security email a scam?

No. Real security alerts can be urgent. The safest response is to check your account through a known app or website instead of following the email’s link.

What if the suspicious email came from someone I know?

Their account could be compromised. Contact them through a different, trusted channel before opening unexpected attachments or links.

Should I reply asking whether the email is real?

No. Replying to the suspicious message is not independent verification. Contact the organization through an established official channel.

Final takeaway

When an email appears to be from Google, Microsoft or your bank, the most reliable first step is to verify the claim outside the email. Use the official app, a trusted bookmark or a known phone number. This simple routine helps protect against fake security alerts, account-takeover attempts and payment scams without requiring advanced technical knowledge.

For related guidance, read our articles on AI voice-cloning scams and WhatsApp privacy and usernames.

Official sources and further reading

WhatsApp Account Banned? How to Appeal in 2026
Posted by Chandimal Gamage

WhatsApp Account Banned or Restricted? How to Appeal and What to Do

Cybersecurity & Digital Safety, WhatsApp 0

Quick answer: If WhatsApp says your phone number cannot use the service, open the official app and select Request review if that option appears. A temporary restriction is different: it generally expires after the time shown. If you see Temporarily banned, check whether you are using an unofficial app or tools that collect other users’ information. There is no legitimate paid service that can guarantee an account will be unbanned.

Losing access to WhatsApp can disrupt family conversations, customer enquiries and important work. The first step is not to reinstall the app repeatedly or pay someone promising instant recovery. It is to identify which message WhatsApp is actually showing. Each message calls for a different response.

WhatsApp banned, restricted or temporarily banned: what is the difference?

Message or situationWhat it generally meansBest next step
“This phone number can’t use WhatsApp”Account banTap Request review if offered.
“Your account is restricted right now”Temporary limits on certain actionsFollow the notice and wait for the restriction to expire.
“Temporarily banned”May involve unofficial apps or scrapingSwitch to the official app and stop prohibited activity.
WhatsApp Web alone is not workingNot necessarily an account banCheck the phone app and linked-device connection first.

These are not interchangeable problems. A restriction can still permit conversations with people you previously contacted, while a banned account cannot access its normal chat history until the ban is lifted. Always use the wording on your own screen rather than assuming every failure means your account has been banned.

How to request a WhatsApp account ban review

  1. Open the official WhatsApp or WhatsApp Business app. Read the full message displayed for your number.
  2. Tap “Request review” if it appears on the ban screen.
  3. Follow the in-app instructions. If you are asked to explain, keep the message short, factual and relevant to your number.
  4. Check WhatsApp for the decision. WhatsApp says most reviews are completed within 24 hours, but that is not a guaranteed deadline.
  5. If access is restored, review your account security and messaging practices before resuming normal activity.

Important: WhatsApp says it reviews one phone number per appeal. Contacting it outside the review process or through another person’s account does not speed up the decision. If no review option appears, WhatsApp says the ban is final and cannot be appealed through that process.

A truthful review message you can adapt

Hello WhatsApp Support. My phone number has been banned, and I would appreciate a review. I use this account for [personal communication/customer enquiries]. I understand WhatsApp’s rules and would like to know whether this action was taken in error. If any activity on my account caused concern, I am willing to address it. Thank you for reviewing my account.

Do not claim you never sent bulk messages if that is not true. If you suspect unauthorized account activity, explain that honestly. No wording guarantees approval.

Why does WhatsApp ban accounts?

WhatsApp says it may ban accounts that violate its Terms of Service, including activity involving spam, scams or risks to user safety. Possible issues to investigate include:

  • Unsolicited bulk messages: Sending repeated promotions to people who did not request them.
  • Automation or abusive messaging patterns: Tools or behavior that violate WhatsApp’s messaging rules.
  • Unofficial modified apps: Third-party versions that WhatsApp does not support.
  • Scraping: Collecting phone numbers, profile pictures or other user information through prohibited automated methods.
  • Compromised accounts: If someone else gained access, their activity may have created problems; this is a possibility to investigate, not proof of the ban’s cause.

WhatsApp generally does not provide users with a complete public breakdown of the detection signals behind an individual enforcement decision. A ban message alone does not establish which particular action caused it.

What if WhatsApp says “Your account is restricted right now”?

This is different from a full ban. WhatsApp says restrictions linked to suspected spam, automation or bulk messaging end automatically when the allocated time passes. During the restriction, you may still communicate with existing contacts but may be unable to start new chats, create groups, add members or use linked devices.

To check the remaining time, WhatsApp advises opening a new chat with a contact you have never chatted with before; the pop-up can show the remaining restriction period. Avoid repeating the activity that may have led to the warning.

What if WhatsApp says “Temporarily banned”?

WhatsApp associates this message with unofficial versions of the app or scraping. If you use a modified WhatsApp client, move to the official application. Stop any prohibited collection of user information. WhatsApp warns that continuing such activity may result in a permanent ban.

Before changing apps, follow official instructions for preserving chats where applicable. Do not assume an unofficial app will safely transfer all your data.

Can a banned WhatsApp account recover its chats?

WhatsApp says chat history and backups cannot be accessed while an account is banned. A backup tied to the number can only be accessed after that number is unbanned. Therefore, avoid instructions from strangers who promise to retrieve your messages by asking for a verification code, backup password or remote access to your device.

What should a small business do when its WhatsApp number is banned?

For businesses that rely on WhatsApp enquiries, account disruption can immediately affect sales and customer service. While waiting for an official review:

  1. Use your website, email or existing social channels to publish a temporary alternative contact method.
  2. Review whether recent messages were requested by recipients and whether your tools comply with WhatsApp’s rules.
  3. Pause questionable automation or mass messaging while you investigate.
  4. Keep records of the in-app notice and review decision without publishing private customer information.
  5. Once restored, prioritize permission-based conversations and clear ways for customers to stop receiving promotions.

WhatsApp Business app versus WhatsApp Business Platform: The phone app and Meta’s API-based Business Platform have different account-management and enforcement processes. If your company uses an API provider, check the applicable Meta Business support and account-quality notices rather than assuming the phone-app review screen is the right route.

Five mistakes to avoid after a ban

  • Paying an “instant unban” agent: WhatsApp says third parties cannot remove bans.
  • Sharing six-digit registration codes: These codes can be used in account takeover attempts.
  • Repeatedly submitting messages through unofficial channels: WhatsApp says this does not accelerate review.
  • Installing modified versions of WhatsApp: These may introduce security risks and further policy problems.
  • Assuming a new phone or VPN fixes a number-level ban: The official review process, when offered, is the appropriate path.

How to reduce the risk of future restrictions

Use the official WhatsApp app; message people who reasonably expect to hear from you; avoid prohibited bulk messaging, scraping and unauthorized automation; secure your phone and account; and respect requests to stop receiving messages. If you manage advertising campaigns, remember that a customer clicking a WhatsApp ad is not permission to send unlimited unrelated promotional messages later.

For related safety guidance, read our articles on WhatsApp usernames and privacy and AI voice-cloning scams.

Frequently asked questions

How long does a WhatsApp ban review take?

WhatsApp says most reviews are completed within 24 hours. This is an estimate, not a promise for every case.

Can I appeal if the Request review button is missing?

WhatsApp’s official account-ban guidance says that if the option is not available, the ban is final and cannot be appealed through that process.

Can someone pay WhatsApp to unban my account?

No legitimate third-party service can guarantee this. WhatsApp says only it can ban or unban an account.

Will reinstalling WhatsApp remove the ban?

Reinstallation does not replace WhatsApp’s official account review process. The restriction is not necessarily a fault with the installed app.

Why can I message old contacts but not new people?

You may be experiencing a temporary account restriction rather than a full ban. Check the exact in-app notice and remaining time.

Is a WhatsApp Business account treated differently?

The WhatsApp Business phone app and the API-based WhatsApp Business Platform have different administration and review channels. Check which product your company uses.

The bottom line

Read the message, choose the matching official action and avoid recovery scams. If you are banned and see Request review, use it. If you are restricted, follow the timer and stop problematic activity. If you are temporarily banned while using an unofficial app, move to the official service. No blog, consultant or tool can promise that WhatsApp will reverse a final decision.

Official sources and further reading

Editorial note: This independent guide summarizes WhatsApp’s publicly available instructions. App screens and enforcement policies may change. It is not affiliated with or endorsed by WhatsApp or Meta. Last reviewed: October 2026.

Stop Spam Calls on iPhone & Android
Posted by Chandimal Gamage

Why Am I Getting So Many Spam Calls? How to Stop Them on iPhone and Android

Cybersecurity & Digital Safety, Security 0

Quick answer: If you keep getting spam calls, your number may be circulating in marketing or data-broker lists, may have appeared in a data breach, or may simply be reached by automated dialling. A sudden increase does not prove your phone has been hacked. To reduce calls, enable your phone’s spam detection, block and report suspicious numbers, ask your mobile carrier about network-level protection, and avoid sharing verification codes or payment details with unexpected callers.

There is no single setting that guarantees zero unwanted calls. The best choice also depends on whether you can afford to miss calls from delivery drivers, doctors, clients or new customers. This guide explains what to change on iPhone and Android—and what to avoid.

Advertisement

Why am I suddenly getting so many spam calls?

Spam calls can include unwanted sales pitches, automated robocalls, and attempts to trick you into giving away money or personal information. Not every unfamiliar number is malicious, and a spam label is a warning rather than proof of fraud.

1. Your number is on a marketing or shared contact list

A number entered on an online form, competition, comparison website or business enquiry may be shared with marketing partners depending on the site’s practices and your consent. Review privacy notices before providing your number.

2. Your number may have appeared in exposed data

Some criminals use contact information collected from leaks or other sources. A surge in calls by itself cannot tell you where your number came from or whether any account was compromised.

3. Automated diallers can call large number ranges

Unwanted callers do not always need to know who you are. Automated systems can attempt many numbers, so receiving a call does not necessarily mean you were individually targeted.

4. Caller ID can be spoofed

The number on your screen may be falsified to resemble a local number or trusted organisation. Blocking one spoofed number may not stop the next call because the displayed number can change.

5. Some calls are legitimate but unwanted

Appointment reminders, delivery calls, surveys and sales calls are different from scams. This matters when deciding whether to silence all unknown numbers.

First, choose the right spam-call protection level

Your situationBest first stepTrade-off
You get occasional nuisance callsBlock and report individual numbersNew numbers can still call
You receive frequent suspected spamEnable caller ID and spam filteringSome calls may be incorrectly labelled
You receive many calls from unsaved numbersConsider call screening or silencing unknown callersYou could miss a legitimate first-time caller
You run a business or expect deliveriesPrefer screening, voicemail and carrier filters over blanket silencingSome unwanted calls will still reach you

How to stop spam calls on iPhone

On recent iPhone software, open Settings → Apps → Phone. Under Screen Unknown Callers, available choices can include Never, Ask Reason for Calling and Silence. Options depend on your iOS version, language, region and carrier. Older iOS versions may show a different menu.

Option A: Screen unknown callers

Where supported, Ask Reason for Calling asks an unfamiliar caller to identify themselves before your phone rings. This can be a useful compromise if you need to receive calls from new customers or service providers.

Option B: Silence unknown callers

Select Silence if you want unsaved numbers sent to voicemail instead of interrupting you. Important: legitimate callers who are not in your contacts may also be silenced. Check voicemail and your call history regularly.

Option C: Review call identification and filtering

Go to Settings → Apps → Phone → Call Blocking & Identification to review available caller identification options. Some spam-filtering features depend on carrier support or supported apps. In the Phone settings, you may also find Call Filtering options for unknown or spam calls.

Option D: Block a specific caller

Open the Phone app, find the unwanted call in your call history, open the caller’s information and choose the block option. The exact controls vary by iOS version.

Official Apple instructions: Screen and block calls on iPhone.

How to stop spam calls on Android

Android menus vary by manufacturer. The steps below describe Phone by Google, which is not the default dialler on every Android phone.

Step 1: Enable caller ID and spam warnings

  1. Open the Phone app.
  2. Tap the menu or three-dot icon and choose Settings.
  3. Open Caller ID & spam or the equivalent setting.
  4. Enable See caller ID & spam, if available.

Step 2: Filter suspected spam calls

If the Filter spam calls option appears, consider enabling it. Google notes that filtered calls may remain visible in call history or voicemail without generating ordinary missed-call alerts. Some Pixel devices use automatic Call Screen protection instead of showing this switch.

Step 3: Report a suspicious number

Open the Phone app, select the call from your recent history, then choose Block or Report spam when available. Reporting helps improve spam identification, but it cannot guarantee future calls will stop.

Step 4: Understand what “Block unknown numbers” means

In Phone by Google, the Blocked numbers → Unknown setting generally targets private or unidentified numbers. It does not necessarily block every caller who is absent from your contacts. Do not confuse these two categories.

Official Google instructions: Caller ID and spam protection and Block or unblock numbers.

Why blocking one spam number often doesn’t work

Spam callers may rotate numbers, use different calling services or spoof caller ID. Blocking remains useful for repeat callers, but for persistent problems, combine device filtering with any reputable anti-spam tools offered by your mobile network. Ask your carrier what the service costs, what it blocks and whether you can review blocked calls.

Should you answer an unknown number?

If you are not expecting a call, letting it go to voicemail is reasonable. But unknown does not automatically mean fraudulent. If you answer, do not disclose passwords, one-time codes, bank details or remote-access permissions. A caller claiming to represent your bank, mobile operator or a government agency should be verified using a number you independently obtain from the organisation’s official website or app.

Simply answering a normal phone call does not usually compromise your phone. The bigger everyday risk is being persuaded to reveal information or take an unsafe action. For a deeper explanation, read Can Someone Hack Your Phone Just by Calling You?.

Are international calls and one-ring calls dangerous?

A missed call from an unfamiliar international number is not proof of a scam. However, one-ring or callback scams may try to persuade you to return a call to a premium-rate or costly international number. Do not call back an unfamiliar number merely because it rang once. If a legitimate caller needs you, they can often leave a message or contact you through another known channel.

How to reduce spam calls without missing important calls

  • Save essential contacts: family, medical providers, schools, delivery services and important clients.
  • Use screening before silencing: if your phone supports it, ask unknown callers to state their purpose.
  • Check voicemail: genuine callers often leave useful information.
  • Protect your number: avoid posting it publicly unless necessary, and check how websites use submitted contact details.
  • Ask your carrier: network-level spam filtering may stop some calls before they reach your phone.
  • Report suspicious calls: use the phone app, your carrier and your country’s relevant reporting authority.
  • Review your settings: if clients or service providers cannot reach you, adjust your filtering level.

Does the Do Not Call Registry stop spam calls?

In the United States, the National Do Not Call Registry can help reduce certain lawful telemarketing calls, but it does not stop scammers or every unwanted call. Rules and reporting services differ by country. The US Federal Trade Commission recommends call blocking and labelling as key practical defences. See its official unwanted-call guidance.

What if you already gave information to a suspicious caller?

  • Shared a password? Change it through the legitimate website or app, and review account sessions and multifactor authentication.
  • Shared a verification code? Contact the affected service promptly and secure the account.
  • Sent money or shared payment information? Contact your bank or card provider immediately using an independently verified contact method.
  • Installed remote-access software? Disconnect from the caller, remove the software with appropriate support and review account security.

The Digital Edge’s 60-second spam-call decision check

  1. Recognise: Is the caller unknown, flagged as spam or asking for urgent action?
  2. Pause: Do not disclose codes, passwords or payment details.
  3. Verify: Contact the organisation independently if the call might be genuine.
  4. Control: Block/report the number and adjust filtering without blocking important contacts.

This is an editorial checklist, not a security test or a guarantee that every scam can be detected.

Frequently asked questions

Why do I get spam calls every day?

Your number may be in calling lists or reached by automated dialling. The frequency alone cannot establish how the caller obtained it.

Can answering a spam call hack my phone?

Ordinarily, answering a normal voice call does not hack a modern phone. Watch for attempts to trick you into sharing codes, clicking links or installing software. Rare advanced vulnerabilities are a separate issue from routine spam calls.

Does blocking a number stop all spam calls?

No. Callers can use different numbers or spoof caller ID. Spam filtering and carrier-level tools can provide broader protection.

How do I stop spam calls on an iPhone without blocking all unknown callers?

Use call screening or supported spam identification tools where available, and keep voicemail accessible. Features vary by device and region.

How do I stop spam calls on a Samsung phone?

Open the Samsung Phone app and look for caller ID and spam protection in its settings. Menu names and availability depend on model, software version and region; consult Samsung’s support for your specific device.

Will changing my phone number stop spam calls?

It may temporarily reduce calls, but a new number can also receive spam. Try filtering and carrier support first, and consider the inconvenience of changing the number linked to accounts and contacts.

Final takeaway

If you’re receiving repeated spam calls, start with caller ID and spam protection, then choose whether screening or silencing unknown numbers fits your circumstances. Protect your personal information, verify unexpected callers independently and remember that no filter is perfect. The goal is fewer interruptions without losing important calls.

Official sources and editorial note

Editorial note: Prepared for The Digital Edge by Lanka E-Marketing using published guidance from Apple, Google and the FTC. Phone menus and protections vary by software version, device, carrier and region. This guide does not claim firsthand testing of every phone model. Last reviewed: October 2026.

Advertisement

Website owner checking Google Search Console to diagnose why a WordPress website is not appearing in Google search results.
Posted by Chandimal Gamage

Why Is My Website Not Showing on Google? 10 Things to Check First

AI Search, AEO & GEO, SEO 0

Quick answer: If your website is not showing on Google, first check whether Google has indexed the exact page using Google Search Console. A page can be missing because Google has not discovered it, cannot crawl it, has been instructed not to index it, selected another canonical URL, or has indexed it but does not rank it prominently for your search. The right fix depends on which situation applies.

Before changing your SEO plugin or paying for backlinks, identify the problem. Searching your company name, checking a URL’s index status, and checking performance for relevant queries answer different questions. This guide gives you a practical diagnostic sequence for WordPress and other websites, with checks you can carry out yourself.

Advertisement

First, determine which Google visibility problem you have

What you observeWhat it may meanFirst action
Search Console says “URL is not on Google”The exact URL is not currently indexedInspect the reason and run a live URL test
Search Console says “URL is on Google” but you cannot find itIt may rank poorly or your search may differ from the queries it appears forCheck Performance → Search results → Pages and Queries
Impressions appear but clicks are near zeroGoogle may display your page, but users are not selecting itReview queries, position, title and relevance
Only some pages are missingPage-level indexing, duplication, linking or quality issues may be involvedInspect each affected URL separately

Important: A site:example.com search is a quick discovery check, not a complete or authoritative inventory of indexed pages. Use Search Console’s URL Inspection tool for a specific URL.

The 10 checks: from basic to advanced

1. Inspect the exact URL in Google Search Console

Open Search Console, choose the correct property, and paste the complete page URL into the top inspection field. Read the reported indexing status, last crawl details, Google-selected canonical URL and any exclusions. Use Test Live URL to see whether Google can access the current page. A live test does not prove the page is indexed.

What to do: Record the exact status before changing anything. If the URL is indexed, skip ahead to checks 8–10 rather than trying to “fix indexing” that is already working.

2. Check for a noindex instruction

A page with a noindex directive is telling search engines not to index it. This can be added through an SEO plugin, the page’s HTML or an HTTP header. In WordPress, check the page’s Rank Math advanced robots settings. Also visit Settings → Reading and review the option that discourages search engines from indexing the site.

What to do: Remove an unintended noindex instruction, publish the change, then retest. Do not remove noindex from private, duplicate, staging or other pages that are intentionally excluded.

3. Check robots.txt and server access

Visit https://yourdomain.com/robots.txt. A robots.txt disallow rule can prevent crawling, but it is not a reliable way to remove a URL from Google. Also check whether security plugins, firewalls, hosting rules or CDN challenges are blocking Googlebot. Server errors, login walls and repeated timeouts can interfere with discovery.

What to do: Use Search Console’s live test and the page indexing report. Correct only rules that unintentionally block important public content. Do not assume every blocked path is a problem.

4. Confirm that the page returns the correct HTTP status

A public page intended for Google Search should normally return HTTP 200 OK. A 404 or 410 indicates the URL is missing; a 5xx error indicates a server problem. Redirects may be appropriate, but Google will generally consider the destination URL rather than the redirected source.

What to do: Test the exact page in a private browser window and inspect its response status. Check for broken permalinks, caching problems, hosting outages and redirect loops. A page that looks fine to a logged-in administrator may still be inaccessible to visitors or crawlers.

5. Submit a clean XML sitemap

A sitemap helps Google discover URLs, but submitting one does not guarantee indexing. For sites using Rank Math, confirm the sitemap is enabled and find its actual address in the plugin settings. Submit the appropriate sitemap index under Search Console → Sitemaps. Include canonical, indexable URLs rather than redirects, errors or deliberately excluded pages.

What to do: Check that the missing page appears in the correct sitemap and that Google can fetch it. Avoid resubmitting the same unchanged sitemap repeatedly.

6. Make sure Google can find the page through internal links

A newly published page with no links from the homepage, relevant articles or navigation may be difficult to discover. Search engines use normal crawlable HTML links to move between pages.

What to do: Link to the article from a relevant category or existing article using descriptive anchor text. For example, a guide about Google AI discovery can naturally link to this indexing checklist. Do not create dozens of repetitive links purely for search engines.

7. Investigate duplicate URLs and canonical selection

Google may discover several URLs with very similar content, including HTTP versus HTTPS, www versus non-www, query parameters, category variants or copied articles. Search Console may report “Duplicate, Google chose different canonical than user” or another canonical-related status.

What to do: Inspect the user-declared canonical and Google-selected canonical. Use a consistent preferred URL, internal links and redirects where appropriate. A canonical tag is a signal, not an absolute command.

8. Match the page to the searcher’s actual question

If Search Console says the page is indexed, the next question is not “How do I force Google to index it?” but “Does this page genuinely answer what people search for?” A services homepage may not be the best result for a detailed troubleshooting query, even if it mentions that phrase.

What to do: Examine Search Console’s Queries report. Compare the searcher’s likely intent with your headline, opening answer, explanations and examples. Add useful specifics: what a status means, where to check it, what not to change and how to verify the result.

9. Improve usefulness, clarity and trust rather than adding more keywords

Google’s people-first guidance asks whether readers learn enough to accomplish their goal and whether content offers original value. A generic article that repeats ten familiar SEO tips without showing how to diagnose a specific problem is unlikely to be the strongest resource.

What to do: Add accurate screenshots from your own Search Console when available, explain your decision process, identify exceptions, link to authoritative documentation, and remove unsupported guarantees. Update stale steps when Google or WordPress interfaces change. Avoid claiming firsthand experiments unless you actually performed them.

10. Measure impressions, clicks and query performance over time

Indexing is not a ranking guarantee, and ranking is not a traffic guarantee. In Search Console → Performance → Search results, filter by the exact page. Compare impressions, clicks, average position and the queries that trigger it. A low click-through rate can have several causes, including query intent and search-result features; it is not proof that your title alone is the problem.

What to do: Keep a dated baseline. Review the data after Google has had time to crawl changes. Make one meaningful improvement at a time so that you can understand what changed.

WordPress checklist: five settings worth checking

  1. Settings → Reading: Make sure the site is not unintentionally discouraging search engines.
  2. Rank Math page settings: Confirm the important post is set to Index and has an appropriate canonical URL.
  3. Settings → Permalinks: Confirm public URLs work and do not unexpectedly return 404 errors.
  4. XML sitemap: Confirm the post is included in the relevant sitemap and the sitemap is accessible.
  5. Caching, security and hosting: Check that visitors and crawlers can access the public page without errors or challenges.

These are diagnostic checks, not instructions to disable security, remove all redirects or change settings that are already correct.

A practical 15-minute Google visibility diagnosis

Use this sequence before commissioning a major SEO rebuild:

  1. Minutes 0–3: Inspect the exact URL in Search Console. Is it indexed?
  2. Minutes 3–6: If not indexed, check noindex, crawl access, HTTP status and the selected canonical.
  3. Minutes 6–9: Check the sitemap and at least one relevant internal link to the page.
  4. Minutes 9–12: If indexed, filter the Performance report by page and inspect actual queries and impressions.
  5. Minutes 12–15: Write down one evidence-based next action and a date to review it.

Example decision: If a WordPress service page is indexed and receives impressions for unrelated searches, resubmitting its sitemap is unlikely to address the core issue. Improve the page’s relevance to the service and the audience. If it is blocked by an accidental noindex directive, content rewriting is not the first priority. These are illustrative scenarios, not results from a claimed client experiment.

How long does it take for a website to appear on Google?

There is no fixed timeframe. Google says crawling and indexing can take from days to weeks, depending on the page and site. Requesting indexing through Search Console does not guarantee inclusion or immediate ranking. If you have fixed a clear technical issue, request indexing once and monitor the status rather than repeatedly submitting the same URL.

Does Google AI Mode change these SEO steps?

Not fundamentally. Google’s documentation says that pages eligible to appear as supporting links in AI Overviews or AI Mode must be indexed and eligible to appear in Search with a snippet. Google does not require a special AI sitemap, AEO tag or unique schema to participate. Useful original explanations, crawlability, internal linking and accurate structured data remain relevant.

For more context, read our SEO vs AEO vs GEO in 2026 guide and How Google AI Mode Finds Sources.

Frequently asked questions

Why is my website not showing on Google even though it is live?

Being live only means the page is accessible to some visitors. Google may not have discovered it, may be blocked from crawling it, may have found a noindex directive, may have selected another canonical, or may have indexed it without ranking it prominently. Start with URL Inspection in Search Console.

Does submitting a sitemap make Google index my website?

No. A sitemap helps Google discover URLs; it does not guarantee indexing or rankings.

Can Rank Math or another SEO plugin guarantee Google rankings?

No. SEO plugins can help manage titles, metadata, indexing directives, canonical URLs and sitemaps, but Google determines crawling, indexing and ranking.

Why does my website appear when I search its name but not my services?

A branded search and a competitive service query have different intent and competition. Review the queries that generate impressions, improve service-page relevance, and assess the strength and usefulness of the page rather than treating this as an indexing error.

Should I request indexing every day?

No. Google says repeated requests for the same URL do not make crawling faster. Fix the underlying issue, submit an appropriate request and allow time for processing.

Will AI-generated content stop my website from ranking?

Google does not ban content merely because AI helped create it. Its guidance focuses on helpfulness, originality, reliability and whether content is produced mainly to manipulate rankings. Review AI-assisted content for factual accuracy and add genuine value.

The bottom line

If your website is missing from Google, diagnose before you optimise. Check the exact URL’s indexing status, eliminate technical blockers, make the page discoverable, then evaluate whether it truly answers the queries you want to reach. A page can be technically healthy and still need stronger content or a clearer match to search intent.

Official references and further reading

Editorial note: This guide is an educational troubleshooting resource prepared by Lanka E-Marketing using Google’s published documentation and WordPress SEO practices. Examples are illustrative, not represented as audited client results. Google controls indexing and ranking; no outcome is guaranteed. Last reviewed: October 2026.

Advertisement
WhatsApp Usernames in 2026: How to Reserve Yours, Hide Your Number and Stay Safe
Posted by Chandimal Gamage

WhatsApp Usernames in 2026: How to Reserve Yours, Hide Your Number and Stay Safe

Cybersecurity & Digital Safety, WhatsApp 0

Quick answer: WhatsApp usernames are an optional new way to let people contact you without giving them your phone number. As of October 2026, you may be able to reserve a username before username-based messaging is activated in your region. On an updated mobile app, look for Settings/You → Account → Username or the username option within your profile; the exact path depends on the version being rolled out. A username does not replace the phone number required to register WhatsApp, and it does not hide your number from people who already have it saved.

That distinction matters. A reserved username is a name held for future use, not necessarily a working way for strangers to message you today. This guide separates what Meta and WhatsApp have officially confirmed from what you should check on your own phone.

Last reviewed: 15 October 2026 · Source basis: Meta’s June 2026 announcement and WhatsApp Help Center documentation. Availability varies by account, app version and country. This is a documentation-based guide, not a claim that we personally tested the rollout in every region.

ADVERTISEMENT

What are WhatsApp usernames, and what changes in 2026?

A WhatsApp username is a unique identifier, such as @janedoe, that people can use to find and contact an account without first exchanging phone numbers. It is different from the display name on your profile: multiple people can share a display name, but each username must be unique.

Meta announced username reservations on 29 June 2026 and said the wider feature would roll out gradually. WhatsApp’s official username explanation confirms that phone numbers remain necessary for account registration.

Reserved versus active: the difference many people miss

StatusWhat it meansCan others message you using it?
Username not availableThe setting has not appeared for your account or region.No.
Username reservedWhatsApp is holding your chosen name until activation.Not necessarily; wait for the in-app activation notice.
Username activeUsername-based contact is enabled for your account.Yes, subject to username-key and other contact settings.

Practical takeaway: Do not replace the phone number on your business website, contact cards or advertisements with a reserved username until you have confirmed it works for customers.

How to reserve a WhatsApp username on iPhone or Android

WhatsApp’s documentation shows two navigation patterns as interfaces change. Use the one you actually see in your updated app rather than assuming everyone has identical menus.

  1. Update WhatsApp using the official Apple App Store or Google Play Store.
  2. Open WhatsApp on your primary mobile phone.
  3. Look under Settings → Account → Username, the route described in Meta’s announcement. In newer interfaces, open You → your profile → Create username / Reserve username, as described in the WhatsApp Help Center.
  4. Enter your preferred unique username. If unavailable, try a meaningful variation or the app’s suggestions.
  5. Follow the displayed prompts to save or reserve it. Read the confirmation carefully to see whether it is reserved or already active.
  6. Wait for an official WhatsApp notification if activation is still pending.

WhatsApp says reservations are not currently available through WhatsApp Web or Desktop. Use your main phone. Never install a modified APK or pay a third-party website claiming it can unlock the feature.

What usernames are allowed?

According to WhatsApp’s username rules, a username must be 3–35 characters, use lowercase letters, numbers, underscores or periods, and cannot consist only of numbers. It must be unique and cannot contain restricted terms. Availability and reserved-name restrictions also apply.

Does a WhatsApp username really hide your phone number?

Yes, in defined situations—not from everyone. Once usernames are active and enabled, WhatsApp says someone who does not already have your number saved generally sees your username instead of your number when you chat, call or participate in a group. But a username is not a way to become anonymous or eliminate the phone number attached to your account.

Who is interacting with you?What to expect
A new person who does not have your numberYour active username can be shown instead of your phone number.
Someone who already saved your numberThey can still see the number they already know.
A business you contact for the first timeYour number can remain private if you have an active username, unless you choose to share it; some country information may be visible.
Someone who already knows your numberThey can still contact you using that number.
WhatsApp account registrationA phone number is still required.

WhatsApp notes that the registered country may be shown in some first-time interactions. Its business privacy guidance also explains that a business with your number from a previous interaction can still have it.

The four-question WhatsApp Username Privacy Check

Before sharing a username publicly, ask: (1) Is it active or merely reserved? (2) Does the other person already know my number? (3) Have I enabled a username key if I need one? (4) Does my public profile reveal other information I would rather keep private? This is our editorial checklist, not a named WhatsApp product or a laboratory-tested security score.

Why is the WhatsApp username option not showing?

The most likely explanation is the gradual rollout. Not seeing the option does not automatically mean your account is restricted or compromised.

  1. Update the official app and reopen it.
  2. Check both the account settings and profile screens because menus differ across versions.
  3. Confirm you are using your primary phone rather than WhatsApp Web or Desktop.
  4. Wait for the feature to reach your region or account; there is no verified universal release date for every user.
  5. If the option appears but saving fails, follow the in-app error message or consult official WhatsApp Help.

Be suspicious of websites or messages that promise instant access to a hidden username setting in exchange for a login code, QR scan, payment or APK download.

What is a WhatsApp username key?

A username key is an optional additional contact control. If enabled, a person trying to message you for the first time through your username may need the key you give them. It is not your WhatsApp registration code, two-step verification PIN or phone password.

WhatsApp says people who already have your phone number, previously chatted with you, or share a group may not need a key. The feature is designed to reduce unwanted contact, not to guarantee that every message is safe. See WhatsApp’s explanation of username keys.

What should WhatsApp Business users do?

For a small business, creator or organisation, username consistency can make an account easier to recognise. But the right steps depend on whether you use the WhatsApp Business mobile app or the WhatsApp Business Platform through WhatsApp Manager.

Meta says eligible accounts can attempt to claim a matching Instagram or Facebook username through linked Meta accounts, subject to availability and verification. WhatsApp Business Platform users can manage reservations in WhatsApp Manager or Meta Business Suite. Follow the official Business Platform instructions for the precise interface.

Important business-specific distinction: WhatsApp’s Business Platform help states that both a business username and phone number may remain visible on the business profile. Do not promise customers that a business username will conceal every business phone number.

A practical launch checklist for businesses

  • Reserve a recognisable name that matches your verified brand presence where possible.
  • Confirm whether your username is active before printing it on packaging or advertisements.
  • Check your Facebook, Instagram, website and customer support instructions for consistency.
  • Tell customers how to identify your genuine account and warn them not to share one-time login codes.
  • Keep existing phone-based contact methods working during the transition.

Can scammers impersonate you with a similar WhatsApp username?

Yes, a lookalike name is a realistic concern. WhatsApp says usernames are unique, but similar-looking variations can exist. A person might mistake @yourbrand.help for @yourbrand_help, for example. That example is illustrative, not an actual reported scam.

WhatsApp’s username abuse guidance advises reporting impersonation and says usernames cannot legitimately be bought, sold or traded.

How to stay safe

  • Verify an unexpected account through an official website or a contact method you already trust.
  • Never share a WhatsApp verification code, two-step verification PIN or banking OTP because someone claims to manage username reservations.
  • Do not pay strangers who claim to sell popular WhatsApp usernames.
  • Use the in-app reporting tools for impersonation or suspicious requests.
  • For account-takeover warning signs, see our related guide: Why you’re receiving WhatsApp verification codes you didn’t request (check this internal URL is published before going live).

Frequently asked questions about WhatsApp usernames

Can I use WhatsApp without a phone number in 2026?

No. WhatsApp says a phone number is still required to register an account. An active username is an optional way to connect without sharing that number with new contacts.

How do I reserve my WhatsApp username?

Update WhatsApp on your main phone and check Settings → Account → Username or You → profile → Reserve username, depending on your interface. If the option is missing, the rollout may not have reached your account.

Why can’t I find the WhatsApp username setting?

The feature is being introduced gradually. Update the app, check your mobile profile and account settings, and wait for availability rather than trusting unofficial unlock tools.

Does a username hide my number from existing contacts?

No. People who already have your phone number saved can continue to see the number they know.

Can someone find my WhatsApp username in a public directory?

Meta says there is no general browsable username directory. Someone needs the exact username to start contact through that method.

Is a WhatsApp username key the same as an OTP?

No. A username key controls first-time contact through your username. A one-time verification code is sensitive account-access information and should not be shared.

Can I change my WhatsApp username later?

WhatsApp says usernames can be changed or deleted, subject to its rules. A deleted personal username has a limited reclaim period, and availability afterward is not guaranteed.

Will reserving a username make it work immediately?

Not necessarily. Reservation holds the name; activation depends on the rollout. Wait for WhatsApp’s confirmation before treating it as a live contact method.

Bottom line: reserve carefully, but don’t confuse reservation with privacy activation

WhatsApp usernames are a meaningful privacy change, especially for people who want to contact new acquaintances or businesses without immediately disclosing a phone number. The safest approach is to use the official app, understand the rollout stage, verify who can still see your number and treat unexpected username-related messages with caution.

Editorial transparency: This article is an independently written, documentation-based explainer from The Digital Edge at Lanka E-Marketing. The four-question privacy check is our editorial framework. We have not claimed a controlled security test, exclusive WhatsApp access or a verified release date for every country. Product screens and rules may change after the review date.

Official sources and further reading

ADVERTISEMENT
Can Someone Hack Your Phone Just by Calling You?
Posted by Chandimal Gamage

Can Someone Hack Your Phone Just by Calling You? What Really Happens

AI, Security 0

Quick answer: If you answered an unknown phone call and said hello, your phone is not normally hacked just because you picked up. A conventional voice call does not automatically hand a caller your photos, passwords, WhatsApp messages or banking apps. The more realistic danger is what happens during or after the call: a scammer may persuade you to disclose a code, visit a fraudulent site, install remote-access software or transfer money. Rare sophisticated exploits are a separate possibility, not the usual explanation for an unwanted call.

So if you just answered, heard silence or a suspicious voice, and hung up, there is usually no reason to assume your device has been compromised. The next step depends on what you actually did—not how frightening the caller sounded.

Advertisement

Can someone hack your phone just by calling you?

In an ordinary phone scam, simply accepting a voice call is not enough to give the caller control of your phone. A call can reveal that your number is active, and a conversation can expose information you choose to share. But those are different from secretly installing malware or taking over a device.

Think of the call as an opportunity for the scammer to persuade you to do something. The caller may claim to be from a bank, mobile carrier, delivery service, technical support team or government office. They may create urgency: “Your account is being emptied right now,” or “We need to verify your identity immediately.” Their goal is to move you from a conversation into an action that gives them access or money.

The US Federal Trade Commission (FTC) specifically advises people to hang up and contact the claimed organisation independently, using its official app, a known website or a number on a statement—not the caller’s instructions. See the FTC’s guidance on unexpected calls claiming your money is at risk.

The Phone Call Risk Check: four situations, four different responses

Rather than asking only “Was it a scam call?”, ask “What did I do while I was on the call?” This editorial checklist separates ordinary exposure from situations requiring urgent action. It is a practical decision aid, not a forensic test or a guarantee that a device is safe.

What happened?Likely concernBest next step
1. You answered, listened, or said “hello”Usually low device-compromise concern from the call aloneHang up; block or report repeat callers; monitor for further contact
2. You gave a name, account detail, password or verification codeIdentity misuse or account takeoverSecure the affected account, change exposed credentials and contact the provider
3. You clicked a link, installed an app or allowed screen sharing/remote accessPhishing, malicious software or unauthorised accessStop access, disconnect if appropriate, seek trusted device support and secure accounts from a known-safe device
4. You approved a transfer or notice suspicious account activityPossible financial loss or active compromiseContact your bank/payment provider immediately using official channels; preserve evidence and report fraud

Important: The risk assessment changes if you receive a credible device-security warning, see unknown account logins or have reason to believe you are individually targeted by advanced spyware. Those situations deserve professional evaluation even if you did not click anything.

How can a phone scam actually lead to hacking or stolen money?

1. The caller tricks you into sharing a one-time verification code

A scammer may already know your email address or phone number and attempt a login or password reset. They then call pretending to be support staff and ask you to read out the one-time code sent to your device. The code may authorise access to your account. Never share an unexpected login or payment code with someone who called you.

2. The caller persuades you to install an app

Fake technical support may ask you to install remote-access software or an unfamiliar mobile application. Depending on its permissions and the actions you approve, this can expose sensitive information or enable further abuse. Legitimate-looking app names and professional-sounding callers are not proof of safety.

3. The caller directs you to a fake website

They may send a text while speaking to you: “Open this secure banking link.” A fraudulent page can collect credentials or payment details. The dangerous step is typically the information you submit, the file you install or a vulnerability exploited by malicious content—not the fact that a voice call arrived.

4. The caller impersonates someone trustworthy

Caller ID can be spoofed: a displayed local number or familiar organisation name does not prove who is calling. The FTC explains caller-ID spoofing and recommends independently checking claims rather than trusting the screen.

5. The caller creates a false emergency

A bank impersonator may claim your savings are under attack and demand an immediate transfer to a “safe account.” Another caller may pretend to be a relative in trouble. A persuasive story, even one that sounds like a familiar voice, is not independent verification. Our related guide explains how AI voice-cloning family scams work.

What if you answered an unknown international number?

The country code alone does not establish whether a call is fraudulent. International numbers can be legitimate, and caller ID can be manipulated. If a call rings once and stops, do not call back simply to discover who it was. Return calls to unfamiliar international numbers can sometimes create charges; check with your mobile provider if you are concerned. For an unexpected call that claims to represent a business, use contact details you find independently.

But aren’t there “zero-click” phone hacks?

Yes, zero-click exploits are real—but they should not be confused with routine phone scams. In certain sophisticated attacks, a vulnerability in software that processes incoming content or communications can be exploited without the victim tapping a link. These attacks require specific technical weaknesses and are not evidence that every unknown caller can hack a modern phone by making it ring.

Apple describes mercenary spyware as an exceptionally sophisticated and costly threat that targets a very small number of people, including some journalists, activists and public figures. Apple also states that the vast majority of users will never be targeted by these attacks. See Apple’s explanation of threat notifications and mercenary spyware.

If you receive an authentic security alert from your device maker, have a high-risk public role, or have credible evidence of targeted surveillance, follow the manufacturer’s guidance and seek qualified security help. Everyone else should focus first on common, preventable risks: keeping software updated, using strong authentication and refusing suspicious requests.

I answered a suspicious call. What should I do now?

If you only answered and hung up

  1. Do not panic or assume your phone is infected.
  2. Do not call the number back just to investigate.
  3. Block or report persistent suspicious calls using your phone’s built-in features.
  4. Keep your phone and apps updated.
  5. Watch for follow-up texts or calls asking you to take action.

If you shared a password, code or financial information

  1. End the conversation immediately.
  2. Use the official website or app—not a link supplied by the caller—to contact the affected service.
  3. Change any exposed password, especially where it was reused; review active sessions and enable stronger authentication.
  4. Tell your bank or account provider if you disclosed card, banking or payment details.
  5. Check for unauthorised changes and preserve messages or transaction records.

If you installed software or granted remote access

  1. Stop the session and revoke access where you can do so safely.
  2. Use a separate trusted device to change important passwords if compromise is suspected.
  3. Update the operating system and security tools, and seek reputable technical support to inspect or remove suspicious software.
  4. Contact your bank immediately if sensitive financial information may have been exposed.

The FTC’s recovery guide for scam victims covers account credentials, payments and access to phones or computers.

If you sent money

Contact the bank, card issuer or payment service immediately, explain that the transaction was induced by fraud, and ask whether it can be stopped, recalled or disputed. Recovery is not guaranteed and depends on the payment method and circumstances. Report the incident to your local law-enforcement or consumer-protection authority. In the United States, reports can be made at ReportFraud.ftc.gov.

How to reduce the risk of scam calls on iPhone and Android

  • Install updates promptly. Security patches fix known vulnerabilities. Update the operating system as well as messaging and calling apps.
  • Use built-in call screening or spam protection. Availability and menu names vary by device, carrier and country.
  • Do not treat caller ID as authentication. Call organisations back through official contact details.
  • Protect accounts. Use unique passwords or passkeys and enable multi-factor authentication where available.
  • Review app permissions. Remove software you do not recognise and be cautious with accessibility, screen-sharing and remote-control permissions.
  • Agree on a family verification routine. Independently call a loved one before acting on an urgent request for money.

Three common claims: what is true?

“If I say yes on a scam call, they can immediately empty my bank account.”

Not simply because you said the word “yes.” A spoken response is not, by itself, the same as authorising a bank transfer or giving someone access to an account. Nevertheless, avoid confirming sensitive details or following instructions from an unknown caller.

“If a caller knows my name, they must have hacked my phone.”

No. Names, phone numbers and other details may come from public sources, previous data breaches, marketing lists or social engineering. Knowing something about you does not prove access to your device.

“If the number looks like my bank’s number, the call is safe.”

No. Caller ID can be spoofed. Hang up and contact your bank through its official app, the number on your card or a trusted statement.

Frequently asked questions

Can someone hack my iPhone just by calling me?

Not through an ordinary scam voice call alone. Rare sophisticated vulnerabilities exist, but most people who simply answer an unknown call have not thereby handed over their phone. Keep iOS updated and treat credible manufacturer security alerts seriously.

Can someone hack my Android phone by calling me?

An ordinary incoming call does not normally provide remote access to your Android phone. Risk rises if you install untrusted software, grant dangerous permissions, reveal credentials or encounter an exploitable technical vulnerability.

Can a scammer access my photos just because I answered?

Normally, no. A regular voice call does not grant photo-library access. Such access would require another mechanism, such as compromised software, permissions, credentials or a serious device vulnerability.

Can answering an unknown call steal money from my bank account?

Not ordinarily. Financial losses typically involve fraudulently obtained credentials, shared verification codes, unauthorised access or a payment you were manipulated into approving. Contact your bank promptly if you disclosed information or notice suspicious activity.

Should I change my passwords after answering a spam call?

Not solely because you answered and hung up. Change affected passwords if you disclosed credentials, followed a suspicious login link, granted access or notice signs of account compromise.

Is it safer to ignore all unknown numbers?

Letting unexpected calls go to voicemail can reduce unwanted interactions, but some legitimate callers use unfamiliar numbers. If a message claims urgent action is required, independently verify the claim before responding.

The bottom line: focus on what the caller asked you to do

Answering a suspicious phone call is not the same as being hacked. For most readers, the most effective protection is simple: end suspicious conversations, verify claims independently, never share verification codes, avoid unexpected installations and act quickly if an account or payment is actually exposed.

If the caller asks you to scan a payment code or disclose a banking OTP, see our separate guide to QR-code and OTP scams. Those are different mechanisms and deserve their own precautions.

Sources and editorial method

This article is an evidence-informed explainer, not a report of an original laboratory experiment. The Phone Call Risk Check is an editorial framework developed to help readers choose proportionate next steps; it has not been clinically or scientifically validated. We distinguish common impersonation fraud from rare advanced device exploits, and we do not claim to have tested a live attack or interviewed victims.

Editorial note: Prepared for The Digital Edge by Lanka E-Marketing, with AI-assisted drafting and human editorial review recommended before publication. This is general consumer-safety information, not individual forensic, legal or financial advice. Last reviewed: 13 October 2026.

Advertisement

AI voice cloning scam - can AI clone your voice
Posted by Chandimal Gamage

Can AI Clone Your Voice and Scam Your Family? How to Recognise a Fake Emergency Call

AI, Technology 0

Imagine hearing your child’s voice on the phone: “I’ve had an accident. Please send money. Don’t tell anyone.” The voice sounds familiar, the fear feels real, and the caller insists there is no time to check. But is the person speaking actually your child?

Quick answer: Yes, AI tools can imitate a person’s voice, and criminals can use voice cloning to make a family emergency scam more convincing. However, a familiar-sounding voice does not prove a caller’s identity, and not every emergency scam uses AI. The safest response is to pause, end the call, and contact your loved one through a number you already know before sending money or sharing information.

Updated October 2026 · The Digital Edge | Lanka E-Marketing · Consumer cybersecurity guidance

How can AI clone someone’s voice for a scam?

Voice-cloning technology can learn patterns from recorded speech and produce synthetic audio that resembles a particular speaker. A criminal might obtain publicly available voice clips, create an imitation, and use it during a phone call or recorded message. The US Federal Trade Commission (FTC) has specifically warned that some family emergency scammers use AI to imitate loved ones’ voices.

The technology is only one part of the fraud. The more important tactic is social engineering: creating urgency, fear, secrecy, and a request for money before the recipient has time to verify the story. Criminals can also impersonate relatives without AI, so an unusual accent or robotic sound is not a reliable test.

A realistic example (illustrative, not a reported case)

A parent receives a call late in the evening. A frightened voice says, “Mom, it’s me. I’m in trouble. Please send the money now.” Another person joins, claiming to be a hospital employee or lawyer. The caller insists that telling other relatives will make things worse. The parent is asked to transfer money to an unfamiliar account.

At this point, the key question is not “Does the voice sound real?” It is “Can I independently confirm that this emergency and payment request are genuine?”

Can scammers really copy a voice from a short recording?

Some voice-cloning systems can produce a convincing imitation from relatively short samples, but the quality varies with the recording, the software, the language, and the circumstances. A scammer may obtain audio from public videos, social posts, voicemail, or other sources. This does not mean every voice clip is enough to create a perfect copy or that posting a video automatically exposes someone to fraud.

Because convincing imitations are possible, voice recognition alone should not be treated as identity verification when someone asks for money, login codes, or sensitive information.

The Family Voice Verification Protocol: four actions before you pay

We use the following four-action checklist as a practical editorial framework for families. It is not an official authentication standard, and no single step is foolproof.

  1. Pause: Resist urgency. Tell the caller you will verify the situation. Do not send money, read out an OTP, or disclose account details during the call.
  2. Disconnect: End the call rather than relying on the incoming caller ID. Caller ID can be misleading or spoofed.
  3. Verify independently: Call your relative using a number already saved in your contacts, or reach them through another trusted channel. If they do not answer, contact someone else who is likely to know where they are. If you have a credible reason to believe someone is in immediate danger, contact the appropriate emergency service through its official number.
  4. Decide only after confirmation: Check the actual situation and the destination of any requested payment. Never let a caller’s demand for secrecy prevent you from asking another trusted person.

The rule worth remembering: A familiar voice is a clue, not proof. Independent confirmation comes before payment.

Seven warning signs of a fake family emergency call

  • The caller demands money immediately and discourages you from hanging up.
  • You are told not to contact other relatives, friends, or authorities.
  • The story includes a sudden accident, arrest, hospital bill, or travel emergency.
  • Someone claiming to be a lawyer, doctor, or police officer takes over the call and increases the pressure.
  • Payment is requested through gift cards, cryptocurrency, wire transfers, or an unfamiliar account.
  • The caller asks for an OTP, password, banking login, or remote access to your device.
  • Details change when you request independent confirmation.

Important: None of these signs alone proves that audio was AI-generated. A real emergency may also involve urgency. The safest approach is to verify the facts through a separate trusted contact method.

Can you tell an AI voice from a real human voice?

Not reliably by listening alone. Some synthetic voices may have awkward pauses or unnatural intonation, but others can sound convincing. Background noise, poor phone connections, stress, and ordinary speech differences can also make genuine voices sound strange. Online “AI voice detector” claims should not replace independent verification.

Instead of asking whether you can detect the technology, ask whether you can verify the person’s identity and the emergency without relying on the suspicious call.

What about a family secret word or question?

A prearranged family phrase can be a useful extra check, especially when everyone understands when to use it. But it is not a replacement for calling back: secrets can be overheard, shared accidentally, guessed, or exposed in messages. Avoid questions whose answers appear on social media, such as birthdays, pets’ names, or school names.

Agree on a simple process: if an unexpected caller asks for money, hang up, use a trusted number, and consult another family member. Treat any secret phrase as one supporting signal, never the only proof.

What if you already sent money or shared information?

Act immediately. Recovery is not guaranteed, but speed matters.

  1. Contact your bank or payment provider through its official app, card number, or website. Report suspected fraud and ask whether the transaction can be stopped, recalled, disputed, or investigated.
  2. Protect affected accounts. If you revealed a password or verification code, change the relevant credentials using the official website or app, enable stronger authentication, and follow your bank’s instructions.
  3. Preserve evidence. Save call times, phone numbers, messages, receipts, transaction references, and screenshots without sharing private codes publicly.
  4. Warn your relative and family. Tell them someone may be impersonating a loved one so others do not respond to similar requests.
  5. Report the scam. In the United States, use ReportFraud.ftc.gov. Elsewhere, use your local police, financial-fraud reporting service, and bank’s official fraud channel.

Be wary of people who contact you afterward promising guaranteed recovery in exchange for an upfront fee. That can be a second scam.

Advertisement

A five-minute family safety plan you can set up today

Prevention is easier when everyone knows what to do before an alarming call arrives. Here is a short family exercise:

  1. Choose two trusted ways to contact each person, such as a saved mobile number and a known messaging account.
  2. Agree that no one will transfer emergency money solely on the strength of an incoming call or voice message.
  3. Identify a second relative or friend to contact when the person named in the emergency cannot be reached.
  4. Discuss a private family phrase as an additional check, while recognising its limitations.
  5. Make sure older relatives and teenagers know they can hang up, verify, and ask for help without embarrassment.

Try this scenario together: “Someone calls sounding like me and asks for $2,000 urgently. What will you do before paying?” If each family member can answer with an independent verification step, the plan is easier to remember under pressure.

How is an AI voice scam different from a WhatsApp or OTP scam?

All three may rely on impersonation, but the immediate deception differs. A voice-cloning scam tries to make a caller sound familiar; an unexpected WhatsApp verification-code incident may indicate someone is attempting to register an account; and an OTP scam attempts to persuade someone to reveal or approve a security code. None of these warning signs alone confirms a successful account takeover.

For related practical guides, read how QR-code and banking OTP scams work and what to do about WhatsApp verification codes you did not request.

Frequently asked questions about AI voice cloning scams

Can AI copy my voice from a video on social media?

It may be possible to imitate a voice using publicly available recordings, depending on their quality and the tools used. This does not mean every public video results in a usable clone. Use independent verification for unexpected money requests regardless of how convincing the caller sounds.

Can someone steal money just by cloning my voice?

A cloned voice by itself does not automatically withdraw money from a bank account. In family emergency scams, the impersonation is typically used to convince someone to send money or disclose sensitive information. Different fraud schemes may use other methods.

What should I do if my son or daughter calls crying and asks for money?

Take the concern seriously, but end the call and contact them through a number you already know. If they cannot be reached, check with another trusted person. If you have credible evidence of immediate danger, contact emergency services using an official number.

Will a secret family password stop voice-cloning scams?

A private phrase can add a layer of protection, but it is not foolproof. It may be leaked or guessed. Confirm the request through a separate trusted contact method before sending money.

Can I identify an AI-generated voice by how it sounds?

Not reliably. Audio artifacts are inconsistent, and a real voice may sound different over a poor connection. Do not base financial decisions on whether a voice sounds natural.

Where should I report an AI voice-cloning scam?

Report suspected financial fraud promptly to your bank or payment provider and to the appropriate national consumer protection or law-enforcement authority. In the US, the FTC accepts reports at ReportFraud.ftc.gov.

The bottom line

AI voice cloning can make an old family emergency scam more persuasive, but the strongest defence does not depend on detecting AI. Pause. Disconnect. Verify independently. Then decide. Share that process with your family before anyone receives a frightening call.

Sources and editorial transparency

Editorial note: This is an educational guide informed by public consumer-protection guidance and editorial analysis. The family call described above is a hypothetical example, not a claimed firsthand incident or an independently investigated case. The “Family Voice Verification Protocol” is our practical editorial checklist, not an official government or bank standard. Rules and reporting channels vary by country. This article does not provide individual financial or legal advice.

Advertisement
Person scanning a payment QR code beside a suspicious banking login screen and OTP scam warning
Posted by Chandimal Gamage

Can Scanning a QR Code Empty Your Bank Account? How QR Code and OTP Scams Really Work

Technology, WhatsApp 0

Can scanning a QR code steal money from your bank account? Usually, scanning alone is not enough. The danger often begins when a code sends you to a fraudulent payment page, you enter banking credentials, share a one-time password (OTP), approve a payment you did not intend, or install harmful software. Here is how to tell those situations apart—and what to do next.

Updated: October 11, 2026 · By The Digital Edge, Lanka E-Marketing · Consumer cybersecurity guide

Can a QR Code Really Empty Your Bank Account?

Not by simply displaying or scanning a code in ordinary circumstances. A QR code typically contains information such as a web address or payment details. It does not automatically give a stranger permission to transfer money from your bank account. However, a malicious code can lead to a convincing imitation of a bank website, direct a payment to the wrong recipient, or prompt an unsafe download. A separate vulnerability in an app or device could also change the risk, which is why software updates matter.

Likewise, receiving an unexpected OTP is not proof that your account has been hacked. It may mean someone entered your number, attempted a login, or triggered a verification process. The crucial questions are what action the code authorises and whether anyone else can use it.

How QR-Code and OTP Banking Scams Work

These scams can look different. The following five-stage model is an editorial explanation—not an official bank or law-enforcement classification, and not every incident follows every stage.

1. The trigger: a normal-looking request

You see a QR code on a parking meter, restaurant table, parcel notice or payment sign. Or you receive a message claiming to be from your bank: “Your account will be blocked unless you verify it now.” The request may use urgency, authority or convenience to discourage checking.

2. The redirection: a destination you did not verify

A QR code can conceal a web address until it is scanned. A fraudster may place a sticker over a legitimate payment code, send a fake code in a message, or build a lookalike login page. A padlock icon or HTTPS connection only indicates an encrypted connection; it does not prove that a website belongs to your bank.

3. The information request: credentials or card details

The page may request a username, password, card number or other information. Entering those details can expose them to whoever controls the fake page. If you use the same password elsewhere, additional accounts may also be at risk.

4. The authorisation trick: the OTP or payment approval

Some scammers call while posing as bank staff and ask you to read out a one-time code. Others persuade you to approve a push notification or a payment inside your genuine banking app. An OTP is not always a login code: depending on the service, it may authorise account access, a new device, a password reset or a transaction. Read the accompanying message carefully and never approve an action you did not initiate and understand.

5. The consequence: money or account access at risk

The outcome depends on the payment system and what the victim disclosed or approved. Possible consequences include an unauthorised transaction, a payment sent to a scammer, account takeover or compromised personal information. Not every scan, code or suspicious page results in a loss.

Four Different Situations—And Why the Difference Matters

What happened?Likely concernFirst response
You scanned a QR code but did not open a site or enter anythingUsually lower risk; check for unexpected redirects or downloadsClose the page, do not install anything, and keep your device updated
You entered a bank username or password on a suspicious pageCredential theft and possible account accessContact your bank and change credentials using its official app or independently verified website
You shared an OTP or approved an unfamiliar promptPossible login, reset or transaction authorisationCall your bank’s fraud team immediately; explain exactly what you shared or approved
You see a payment you did not makePotential financial fraudContact the bank immediately, request appropriate restrictions and dispute or report the transaction

What to Do Right Now if You Think You Were Scammed

If you only scanned the code

Do not panic. Check the destination shown by your camera or scanner. If you did not enter information, approve a payment or install software, the risk is generally different from a completed phishing attempt. Close the suspicious page, review downloads and update your device. If something installed unexpectedly, seek trusted technical help and avoid banking on that device until it is assessed.

If you entered banking details

Open your bank’s app directly or type the bank’s verified address yourself—not through the QR code, suspicious message or search ad. Contact its fraud department and ask whether access needs to be blocked or credentials reset. Change reused passwords on other accounts, starting with your email account if it shares the password.

If you gave away an OTP or approved a payment

Contact the bank immediately. Explain whether the code related to login, device registration, password reset or a transaction, if known. Ask what protective steps and payment-recall or dispute options are available. The availability of refunds and recovery depends on your country, bank, payment type and circumstances; no outcome can be guaranteed.

If money has already left your account

  1. Call the bank’s official fraud number immediately and ask it to secure affected accounts or cards.
  2. Report the transaction, ask for a case or reference number, and follow the bank’s dispute instructions.
  3. Preserve screenshots, transaction IDs, suspicious URLs, QR-code locations, messages and call records. Do not share sensitive codes publicly.
  4. Secure your email and other linked accounts; review devices, active sessions and recent transactions.
  5. Report the incident to the relevant police or cybercrime authority in your country.
  6. Watch for “recovery agents” demanding an upfront fee. A second scam often follows the first.

Important: If you suspect your phone has malware, contact your bank from a separate trusted device or phone where possible.

Advertisement

How to Check a QR Payment Before You Scan

  • Inspect the physical code: Be wary of stickers covering an original code or signs of tampering.
  • Preview the destination: Check the domain carefully before opening. Look for misspellings, unexpected subdomains and unrelated addresses.
  • Use the official app: For banking, shopping and parking payments, use the provider’s official app or a verified payment channel when possible.
  • Verify the recipient: Check the business name, account or merchant details and amount before approving payment.
  • Question unexpected login requests: A parking or restaurant payment should not casually require your full online banking password on an unfamiliar site.
  • Do not install a random app: Treat unexpected app downloads or requests for powerful device permissions as warning signs.

How to Protect Your Bank Account From QR and OTP Scams

Use unique passwords and a password manager; enable the strongest multifactor authentication your bank supports; keep your phone and banking apps updated; enable transaction alerts; and review statements regularly. Never share a verification code with a caller or message sender, even if they know your name or claim to work for your bank. If someone contacts you unexpectedly, hang up and contact the organisation using a number you independently verified.

Remember that a legitimate banking app can still be used to send money to a scammer if you are deceived into approving the payment. Security is not only about keeping attackers out; it is also about checking what you are authorising.

Our Editorial Test: The “Pause, Preview, Verify, Approve” Check

Before paying through an unfamiliar QR code, use this four-question checklist:

  1. Pause: Is anyone rushing or threatening me?
  2. Preview: Where does the code actually lead?
  3. Verify: Does the destination and recipient match the real business or bank?
  4. Approve: Do I understand the exact payment, login or permission being requested?

This is an editorial checklist created to make established safety advice easier to remember. It is not a substitute for your bank’s security procedures.

Why This Matters Beyond Banking

QR codes are used in restaurants, travel, events, marketing campaigns and customer service. For businesses, a tampered payment code or a compromised customer-facing page can damage trust as well as expose customers to fraud. Digital marketers and website owners should regularly check published QR destinations, secure the linked websites, and provide clear official payment and contact information.

For a related example of account-security warning signs, read our guide to unexpected WhatsApp verification codes. Editorial note: publish or verify that destination before keeping this internal link live.

Frequently Asked Questions

Can scanning a QR code automatically take money from my bank account?

Usually no. Scanning normally reveals or opens information. Fraud typically requires an additional step such as entering credentials, authorising a payment, sharing a code or installing harmful software. Software vulnerabilities are a separate risk, so updates remain important.

What if I scanned a fake QR code but did not enter anything?

Close the page and check for unexpected downloads or prompts. If you did not submit information, approve a payment or install anything, the situation is generally lower risk than sharing credentials. Contact your bank if you notice suspicious activity.

Can someone withdraw money using only my OTP?

It depends on the bank and what the OTP authorises. A code may be one part of a login, account change or transaction approval. Treat any code you did not request as sensitive and contact your bank if you shared it.

Does HTTPS mean a QR-code payment page is safe?

No. HTTPS encrypts the connection but does not establish that the business or banking page is genuine. Verify the domain and payment recipient independently.

What should I do first if I sent money to a scammer?

Contact your bank or payment provider immediately through an official channel. Ask about account protection, transaction reporting, disputes and any available recall process. Then preserve evidence and report the scam to the appropriate authority.

Can my bank refund a QR-code or OTP scam payment?

Possibly, but rules vary by jurisdiction, payment method and whether a transaction was authorised. Report promptly and ask the bank to explain its investigation and dispute process. Avoid anyone promising guaranteed recovery for a fee.

Final Takeaway

A QR code is a shortcut, not automatically a bank-account hack. An OTP is a security tool, not something to share with a caller. The danger is often the convincing sequence that gets a person to visit the wrong site, disclose information or authorise the wrong action. Before you scan, sign in or approve: pause, preview and verify.

Sources and Further Reading

Editorial transparency: This is an explanatory guide based on established fraud patterns and public safety guidance. The five-stage model and four-question checklist are editorial teaching tools, not the results of a controlled experiment or an account of a personally verified bank-fraud case. No specific scam incidence or financial-loss statistic is asserted here. Banking procedures and consumer protections vary by location. This article is not legal or financial advice.

Advertisement
Posts pagination