WhatsApp has replaced the six-digit PIN on its two-step verification with a full password, requiring at least eight characters including a number and a letter, with special characters allowed. Accounts can now also hold more than one passkey, which helps if you move between Android and iOS.

Both remain optional, but the company says more than a billion people have set up a passkey since the feature arrived in 2023.

The timing matters more locally than the feature itself does. Two-step verification exists precisely to stop an account takeover when somebody already holds your one-time passcode, and that is now the live scenario here.

NordVPN reported last week on malware distributed through fake Takealot, DStv and SARS sites that reads SMS one-time PINs straight off Android handsets. On Tuesday, MTN South Africa chief executive Ferdi Moolman told a results conference that RICA registration quality cannot hold up at current churn rates, and named WhatsApp account hijacking syndicates as the consequence.

Passkeys sidestep both problems, because they rely on a cryptographic key tied to your device rather than a code sent across a network, so an attacker needs the physical handset. WhatsApp has also added caller context on Android, showing whether an unknown number is registered in another country and whether you share any groups, and is testing a Scam Alert feature running an on-device model.

TechCrunch reported the changes alongside comparable moves by Signal and Telegram, noting an attacker would need physical access to the device holding the passkey. Engadget confirmed the new password requires a minimum of eight characters with at least one number and one letter, replacing PINs the app has used since 2017. BleepingComputer noted the rollout follows this month's limited beta of Scam Alert, and that WhatsApp counts more than three billion users across 180 countries.

For most South African businesses, the WhatsApp number is the customer relationship. Lose it, and you lose the order history, the group chats and the trust, and no support desk gets that back quickly. Settings, then Account, then Passkeys takes about two minutes, and setting the new password takes another two.

Do it on every handset that touches a business account, staff phones included. One caveat worth checking yourself: none of the coverage says whether these changes reach the WhatsApp Business app or the Business Platform running through the Cloud API, which is what many of you actually operate.

If your support desk runs on the API, ask your solution provider directly rather than assuming the consumer rollout covers you.

You might also like our piece on the SA banking trojan reading OTPs off Android phones, the WhatsApp Business fees landing on 1 October, and what the Lego South Africa data breach handed to phishing operators.

Get more SA tech and business news and subscribe to The Open Letter.