In an age when digital identity is as precious as any physical possession, WhatsApp has introduced three layered defenses against account compromise — passkeys, stronger two-step verification, and caller context for unknown numbers. The updates, arriving in late August 2026, reflect a broader reckoning in the technology world: that convenience and security need not be enemies, and that ordinary users deserve tools once reserved for the technically vigilant. Each feature addresses a distinct vulnerability, quietly acknowledging that the threats people face online are neither abstract nor distan
WhatsApp rolls out three new security features for account protection
Passkeys cannot be easily stolen, guessed, or forgotten
Mark
So passkeys sound like they're replacing passwords. Does that mean WhatsApp is phasing out the old login method entirely?
Mimi
Not entirely, no. The announcement says passkeys are now available as an option, but it doesn't say passwords are going away. It's more that passkeys are being offered as a more secure alternative for people who want them.
Luke
Right, and that's important to note—this is opt-in. The user has to go into settings and actively add a passkey. Most people probably won't.
Mark
Why would someone use passkeys if they're optional? What's the actual advantage over a strong password?
Mimi
Passkeys use cryptographic keys that are generated automatically and never transmitted the way a password is. A password, even a strong one, can be intercepted or guessed. A passkey can't really be either of those things. And you don't have to remember it.
Luke
Though the security benefit assumes your device itself is secure. If your phone is compromised, the passkey is only as safe as your biometric or screen lock.
Mark
Fair point. What about the two-step verification change? That seems more straightforward.
Mimi
It is. Instead of a six-digit PIN, you can now set a custom password. The real security gain is that someone can't reset your account with just an email link anymore. They'd need your password too.
Luke
But again—it's optional. And WhatsApp says they'll prompt you to re-enter it periodically so you don't forget it. That's a usability trade-off.
Mark
And the caller information feature—that's only on Android right now?
Mimi
Yes. It shows you whether an unknown caller is from another country or if you share group chats with them. It's meant to help you spot scams.
Luke
The limitation there is that it only works for unknown numbers. If a scammer spoofs a number that looks familiar, or if they're in a group chat with you, the feature doesn't help. It's a partial solution.
Mark
So these are incremental improvements, not a complete overhaul.
Mimi
Exactly. They're closing specific vulnerabilities, but they're not eliminating the need for users to be thoughtful about their own security.
El Pulso
- Account takeovers and phone scams remain among the most common digital threats facing everyday users, and WhatsApp's 2 billion-plus user base makes it a prime target.
- A single stolen password or intercepted SMS can hand an attacker full control of someone's WhatsApp identity — a gap these updates are designed to close.
- Multiple passkeys replace guessable passwords with cryptographic keys unlocked by fingerprint or Face ID, making silent credential theft far more difficult.
- Custom passwords for two-step verification raise the barrier for account resets, ensuring that even a compromised email inbox is not enough to seize an account.
- Unknown callers on Android will now surface their country of origin and shared group memberships, giving users a critical moment of context before a potential scam takes hold.
- The phased rollout — Android first, other platforms likely to follow — signals that WhatsApp is treating this as an evolving security architecture rather than a one-time fix.
In an age when digital identity is as precious as any physical possession, WhatsApp has introduced three layered defenses against account compromise — passkeys, stronger two-step verification, and caller context for unknown numbers. The updates, arriving in late August 2026, reflect a broader reckoning in the technology world: that convenience and security need not be enemies, and that ordinary users deserve tools once reserved for the technically vigilant. Each feature addresses a distinct vulnerability, quietly acknowledging that the threats people face online are neither abstract nor distant.
WhatsApp has introduced three security updates designed to make account takeovers meaningfully harder. The changes arrived this week and each targets a different weak point in how people protect their digital identity.
The first allows users to store multiple passkeys for a single account. Rather than typing a password, the phone generates cryptographic keys automatically during sign-in — keys that cannot be guessed, stolen, or forgotten. A fingerprint, Face ID, or screen lock is all that is needed to confirm identity. Meta highlighted the feature as particularly useful for people who move between iOS and Android devices.
The second update strengthens two-step verification, which has long been optional on the platform. Where users were previously limited to a six-digit PIN, they can now set a custom password. The significance is practical: without two-step verification, an attacker with access to your email can reset your WhatsApp account through a simple link. With it active, that link alone is no longer sufficient. WhatsApp will periodically prompt users to re-enter their credentials to prevent them from being forgotten.
The third feature brings context to unknown callers. When someone outside your contacts rings you, WhatsApp will now show whether the number originates from another country or whether you share any group chats with that person. The goal is to give users enough information to judge, in the moment, whether a call might be a scam attempt. For now, the feature is available only on Android, suggesting a broader rollout is being staged carefully.
Together, the three tools address the most common entry points for account compromise — weak credentials, vulnerable recovery flows, and deceptive contact. None offer absolute protection, but each shifts the balance a little further toward the user.
WhatsApp has rolled out three new security tools aimed at making it harder for someone to take over your account. The updates arrived this week and address different angles of account protection—from how you log in, to how you verify your identity, to who's calling you.
The first feature lets you store multiple passkeys for a single account. A passkey is a login method that replaces passwords entirely. Instead of typing a string of characters, your phone generates cryptographic keys automatically and exchanges them in the background when you sign in. Meta, WhatsApp's parent company, noted this is especially useful for people who switch between iOS and Android devices. To add a passkey, you navigate to Settings, then Account, then Passkeys. The appeal of passkeys is straightforward: they cannot be easily stolen, guessed, or forgotten the way passwords can. They also feel frictionless—you only need to confirm your identity briefly using your fingerprint, Face ID, or screen lock code.
The second improvement touches two-step verification, a security layer that has existed on WhatsApp for some time but remains optional. Previously, two-step verification relied on a six-digit PIN. Now users can choose a custom password instead. The change matters because it raises the bar for someone trying to reset your account. Without two-step verification enabled, an attacker who gains access to your email can reset your WhatsApp account using just a link sent to your inbox. With two-step verification active, that link alone is not enough—they would also need your PIN or password. WhatsApp will periodically prompt you to re-enter your credentials to make sure you have not forgotten them.
The third feature addresses a common source of fraud: unknown callers. When someone not in your contacts calls you, WhatsApp will now display additional context about the caller. This might include whether the number originates from another country or whether you share any group chats with that person. The idea is to give you enough information to make a quick judgment about whether to pick up, particularly in cases where the caller might be attempting a scam. This feature is currently available only on Android devices, suggesting a phased rollout may be underway for other platforms.
Taken together, these three updates reflect WhatsApp's effort to close gaps in how people protect themselves. Passkeys address the vulnerability of weak or reused passwords. Customizable two-step verification makes account recovery harder to compromise. And caller context gives users a fighting chance to spot fraud before they engage with it. None of these tools are foolproof, but they shift the odds in the user's favor.
Citas Notables
Passkeys are considered especially secure because, unlike passwords, they cannot easily be stolen, guessed or forgotten.— Meta (WhatsApp's parent company)
Quieres la nota completa?
Lee el original en The Star ↗
Technology