Act as though every new message from the account could be fraudulent. Tell your firm’s incident, compliance and data-protection leads; preserve messages and alerts; use WhatsApp’s official recovery process without sharing a verification code or PIN; warn clients and colleagues through a different trusted channel; then assess whether personal data, client money or firm systems were affected. A compromised account is not automatically an ICO- or FCA-reportable incident, so the firm must make and document a risk and materiality assessment.
This is UK-focused guidance for advisers, advice-firm owners and incident leads. Firms and clients elsewhere must apply their local regulator and privacy rules.
As an Amazon Associate I earn from qualifying purchases.
What to do in the first 30 minutes
1. Escalate inside the firm and preserve evidence
Notify the firm’s incident lead, information-security contact, compliance lead and data protection officer (DPO) immediately. If your firm has an incident-response plan, open an incident under that process and record who made each decision.
Free tools Windows power users keep installed
One-click scans. No signup required.
Preserve relevant WhatsApp messages, screenshots, account alerts, call records, payment instructions, recipient details and timestamps. Follow the firm’s evidence policy and avoid deleting, editing or forwarding material unnecessarily. There is no single government-prescribed evidence-preservation method for every compromise, so use the controls your firm has adopted.
#1 Best Overall
- Compact & Portable Design: This Small Excel, Word, PowerPoint, & Windows Cheat Sheet Mouse Pad measures 11.8" x 9.8", offering a portable mouse pad. Its compact size fits in bags or laptop cases, suitable for professionals, students, or travelers.
- Multi-Software Shortcut Guide: Featuring essential shortcut keys for Excel, Word, PowerPoint, & Windows, this small mouse pad provides a quick reference for frequently used shortcuts, offering a reference designed to support workflow efficiency
- Smooth & Precise Surface: The finely-textured surface ensures precise mouse control, allowing for smooth and accurate movement during work or gaming sessions.
- Durable & Non-Slip Design: This Multi-Software Shortcut Mouse Pad features stitched edges to reduce fraying. The non-slip rubber base helps keep it securely in place, and the water-resistant fabric allows for easier maintenance.
- Clear Print Quality: Displays high-resolution printing intended to remain legible through regular use and cleaning
2. Recover the account through official WhatsApp routes
Use the WhatsApp app and its official help and account-recovery flow. Prompts and waiting periods vary with the account’s state and can change, so do not rely on a fixed recovery time.
Never give a verification code, two-step-verification PIN or other security detail to a caller or contact who says they are helping. A person who asks for a code is trying to take control, not restore it. The Ministry of Justice’s hacked-account guidance says users can often recover a compromised account and should check Linked Devices once access is restored.
3. Warn contacts over a separate trusted channel
Use a previously verified phone number, email address, firm switchboard or client portal to tell clients, colleagues and other contacts that messages from the WhatsApp account may be fraudulent. Treat requests for transfers, credentials, one-time codes or changes to payment details as suspicious until confirmed by an established route.
4. Secure the accounts around WhatsApp
The takeover may involve the phone number, email account or a device rather than WhatsApp alone. Change passwords from a known-clean device, check the email account for unauthorised forwarding rules and sessions, install outstanding operating-system and app updates, and review bank and other sensitive-account activity. Do not assume that regaining WhatsApp access has secured the rest of the environment.
Work out what the attacker could access or send
Once immediate containment is under way, establish facts rather than assuming that a takeover exposed every chat. Identify when the firm first noticed the problem, how access was lost, which devices or sessions were active, and what messages or files may have been visible or sent.
Rank #2
- [MULTIFUNCTIONAL]You'll get 2 pieces computer monitor memo boards that you can stick on the left and right edges of your monitor, and they're the perfect office desk organizers and accessories. Computer monitor side panels desktop organizer are suitable for home work or office,bringing convenience. Desktop memo is used to organize meeting memos, important messages, business cards, planning notes.Paste on the message board to keep track of important things and to-do items to prevent forgetting.
- [🌟HIGHLY QUALITY] The material of computer screen side note holder is transparent acrylic. Durable, simple, stylish, light weight, easy to use, not easy to fall off or break. This cute office supplies for women desk can be used for a long time. This computer desk accessories is waterproof and dirt resistance, and look simple and stylish. The transparent acrylic sticky note holder as cubicle accessories is easy to notice the context of your sticky notes.
- [📋Easy to use] Office must haves cool office gadgets for desk ready to tear, easy to install and remove, not easy to leave traces. You only need to peel off the protective film on the surface of the computer side board memo, wipe off the dust on the edge of the computer monitor, and then stick the desk essentials for women office on the right or left side of the tape, and you're done. A perfect gift for your colleagues, friends or classmates and family members or relatives
- [🏢MULTI-SCENE USE] This desk supplies computer memo board can be applied to home and office, clear your office decor for women, suitable for most computer monitors, screens and cabinets, you can put it where you think, this cute office decor serve as a reminder. Stick on the computer side. It’s a good office gadgets can remind work improve office productivity. Pasted cabinets, dressers, refrigerators, walls, etc as cubicle accessories. To make life more orderly.
- [💌NOTE] The adhesive force of the computer sticky note holder is very strong. It can not be directly pasted on the computer screen. It should pasted on the black edge of the screen. Narrow edge not recommended!!! If you are not satisfied with your purchase, or if the product is damaged or broken in transit, please let us know immediately. We will promptly solve your problem.
| Question | What to establish | Why it changes the response |
|---|---|---|
| Account access only | Could the attacker send messages, or also read chat history, contacts, files and media? | Reading client information may create a personal-data breach even if no payment was made. |
| Scope of people affected | Which clients, colleagues or suppliers received messages, and how many? | A broad recipient group increases potential harm and may affect regulatory materiality. |
| Financial activity | Were payment instructions issued, bank details changed, or funds sent? | Actual or attempted loss requires urgent bank and fraud-reporting action. |
| Wider systems | Was the phone, email account, SIM, cloud backup or another firm system also compromised? | An isolated messaging compromise may become a wider operational or information-security incident. |
| Evidence status | What is confirmed, what is suspected and what remains unknown? | Clear uncertainty records support proportionate notifications and later review. |
Record the timeline, affected people, data categories, containment steps, decisions and outstanding questions. The Information Commissioner’s Office (ICO) expects organisations to assess risk and retain a record of personal-data breaches, including those they decide not to notify.
How to tell clients and colleagues
Send the warning through a channel that the attacker does not control. Keep it factual and specific: identify the affected account, give the time window if known, state that unexpected instructions must not be followed, and provide a trusted way to verify the firm’s requests.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesInclude practical protective instructions
- Do not send money, passwords, account numbers, identity documents or verification codes in response to a WhatsApp message from the affected account.
- Do not click links or install software supplied in an unexpected message.
- Call the adviser or firm using a number already held in the client’s records, not a number supplied in the suspicious message.
- Forward screenshots or message details to the firm’s designated incident contact so the firm can assess scope.
If the firm knows that a particular client received a fraudulent instruction, contact that client directly rather than relying only on a general notice. Keep a record of who was contacted, when, by which channel and what advice was given.
Decide whether the incident is an ICO-reportable personal-data breach
A hacked WhatsApp account is not automatically a reportable breach. The firm must determine whether there was a security breach involving personal data and whether it is likely to result in a risk to people’s rights and freedoms. Consider chat content, contact details, identification documents, financial information, vulnerability information and any data contained in attachments or backups.
The 72-hour rule
Where a qualifying UK GDPR breach is likely to pose a risk, the firm must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. The clock concerns the firm’s awareness of the breach, not necessarily the moment the attacker first entered the account. If the firm misses 72 hours, notify as soon as possible and explain the delay.
Rank #3
- Stay Organized with Ease: Our To Do List Notepad provides multiple sections with plenty of space to jot down all of your important tasks.A versatile office supply perfect for daily task management, helping you keep track of everything that needs to be done and prioritize effectively.
- Achieve Your Productivity Goals: Begin each day on a positive note, reminding you of your potential, strength, and the significance of staying focused on your goals. Our Daily Checklist Notepad is the ultimate tool to streamline your daily planning and elevate your productivity. With a clear and concise overview of your tasks, you can effortlessly prioritize what truly matters and make consistent strides towards achieving your goals.
- Reliable and Stylish: Our to do list planner combines functionality with durability. With a transparent PP cover, the inner pages are well-protected from dirt and wear. Additionally, the back cover is crafted with thick paperboard, offering a stable surface for your writing needs. Each notepad includes 52 pages of high-quality, 100gsm paper, which is thick and non-bleeding, resulting in a smooth and enjoyable writing experience.
- Versatile Use: This daily checklist notepad, suitable for teacher supplies and a wide range of applications, proves invaluable in various settings including work, school, and home. Whether you need to organize your daily tasks, plan a project, or create a grocery list, this notepad serves as the ideal tool. Its compact size ensures easy portability, allowing you to conveniently carry it with you throughout your day.
- Perfect Present for Anyone: Our Daily To-Do List Notepad is the perfect present for those who value organization and productivity. With its stylish design and versatility, this office desk accessory is also a practical addition to school supplies. Suitable for students, professionals, and homemakers alike, it helps keep tasks and priorities in check effortlessly.
If the breach is likely to result in a high risk to people’s rights and freedoms, affected individuals must also be informed without undue delay. The threshold is separate from the ICO-notification test: a breach can require an ICO notification without requiring direct notice to every individual, or require both.
What an individual notice should say
Use plain language and describe the nature of the breach, its likely consequences, what the firm has done or proposes to do, and practical protective steps. Depending on the information involved, those steps may include watching for impersonation, phishing, unusual account activity or fraudulent payment requests. Do not speculate about facts that have not been established.
The ICO’s published guidance states: You must also keep a record of any personal data breaches, regardless of whether you are required to notify.
Keep the internal record even where the assessment concludes that notification is unnecessary.
Information needed for an ICO report
The ICO reporting form asks what happened, when and how the firm found out, who may be affected, what the firm is doing and who else has been told. The firm should also consider whether its insurer, law enforcement or the National Cyber Security Centre (NCSC) should be informed where a malicious actor caused the incident.
Decide whether the FCA should be told
Assess the compromise against the firm’s applicable FCA rules and the facts of the incident. A personal WhatsApp account takeover may not meet the FCA’s materiality threshold by itself. It becomes more likely to require regulatory engagement if it caused, or could cause, significant customer harm or operational disruption.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- 【Adjustable & Ergonomic】：This laptop stand can be adjusted to a comfortable height and angle according to your actual needs, letting you fix posture and reduce your neck fatigue, back pain and eye strain. Very comfortable for working in home, office and outdoor.
- 【Sturdy & Protective】 ：Made of sturdy metal, it can support up to 17.6 lbs (8kg) weight on top; With 2 rubber mats on the hook and anti-skid silicone pads on top & bottom, it can secure your laptop in place and maximum protect your device from scratches and sliding. Moreover, smooth edges will never hurt your hands.
- 【Heat Dissipation】 ：The top of the laptop stand is designed with multiple ventilation holes. The open design offers greater ventilation and more airflow to cool your laptop during operation other than it just lays flat on the table.
- 【Portable & Foldable】：The foldable design allows you to easily slip it in your backpack. Ideal for people who travel for business a lot.
- 【Broad Compatibility】：Our desktop book stand is compatible with all laptops from 10-15.6 inches, such as MacBook Air/ Pro, Google Pixelbook, Dell XPS, HP, ASUS, Lenovo ThinkPad, Acer, Chromebook and Microsoft Surface, etc.Be your ideal companion in Home, Office & Outdoor.
Indicators of a potentially material operational incident
- Material disruption to financial services.
- A large number of affected customers.
- Unauthorised access to information systems.
- Significant data loss.
- Unavailability of, or loss of control over, IT systems.
Also consider whether the event could significantly damage the firm’s reputation, impair its ability to provide adequate services and cause serious customer detriment, or have serious financial consequences for the UK financial system or other firms. The answer depends on the incident’s scale, duration, data, customers and consequences; do not treat every hacked account as automatically reportable.
How to contact the FCA
For a material incident, the FCA says firms should contact their named supervisor. If there is no named supervisor, use the firm notification form under SUP 15. A dual-regulated firm should inform the Prudential Regulation Authority as well. Principle 11 requires openness and cooperation: Firms subject to Principle 11 of the FCA’s Principles for Businesses must deal with the FCA in an open and cooperative way.
This current operational-incident process applies until new reporting rules take effect on 18 March 2027. Keep the rationale for notifying or not notifying, the information supplied and any follow-up commitments in the incident record.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If a client paid or shared information with a scammer
Tell the client to contact their bank immediately using the number on the back of their card or on a statement, not a number supplied by the suspected fraudster. Speed can improve the chance of stopping or recalling a payment.
For online scam or hacking reports in England and Wales, GOV.UK directs people to Report Fraud. In Scotland, report crime to Police Scotland; GOV.UK specifically directs people in Scotland who have lost money to Police Scotland. The firm should also consider whether the ICO, FCA, insurer, law enforcement or NCSC needs to know.
Best Value
- Twin-Ball Design : Hiacry gel pen features a double ball conical tip that reduces writing resistance and provides a stable and smooth writing experience. 0.7mm quick drying black ink ensures no jumping, leakage or seepage.
- Quick-Dry Long Lasting Ink：0.7mm black ink can slide effortlessly, dry immediately, & is not easily dirty. It has a high-capacity reservoir (up to 1300 meters), which is very suitable for left-handed & right-handed users.
- Sleek Design for Journaling & Planning: Engineered with a low center of gravity and precision tip for steady ink flow, these journaling pens excel at note-taking, sketching, planning, and more. They combine stylish pens with top-tier performance.
- Rolling Ball Design：The pocket clip with roll ball design can be easily attached to notebook pockets and binders, in addition, the fidget on the pen clip is also a small toy for your daily thinking to relieve stress.
- Comfortable Non-Slip Grip：The ergonomic pen barrel has a soft rubberized coating for a comfortable, non-slip grip, so you won't get fatigued even after long hours of writing.
Warn clients about recovery fraud. After an initial scam, someone may claim to be able to recover the money for an upfront fee or further personal information. Clients should verify any recovery offer independently through the bank or a known official channel.
Finish the recovery and prevent a repeat takeover
Check WhatsApp sessions
After access is restored, open WhatsApp’s Linked Devices screen and log out every unfamiliar session. Confirm that the phone number, profile details and privacy settings are correct. Review recent messages for fraudulent instructions and preserve evidence before deleting anything.
Enable two-step verification
Turn on WhatsApp two-step verification and store the PIN securely. Do not share it with anyone who contacts you. Confirm that the recovery email address belongs to the firm or adviser and is itself protected.
Harden the phone, number and email
- Ask the mobile provider to investigate an unexpected SIM replacement or loss of service.
- Change the email password and revoke unfamiliar sessions or app access.
- Check email forwarding and mailbox rules for unauthorised changes.
- Install current security and operating-system updates.
- Review bank statements and other sensitive accounts for unusual activity.
- Update the firm’s client-verification procedure so WhatsApp alone cannot authorise a payment or change of bank details.
Review the firm’s controls
Decide whether regulated advice, payment instructions or sensitive documents should be sent through WhatsApp at all. If the firm permits it, define approved accounts, device management, retention, client-verification and escalation rules. Train staff to recognise code-stealing attempts and to use a second channel for high-risk instructions.
Keep the incident under review
Continue monitoring for impersonation, delayed reports from clients and additional compromised accounts. Update the incident record when new evidence changes the scope or risk assessment. Close the incident only after access, devices, related accounts, client communications and regulatory decisions have been reviewed and assigned an owner.
The FCA reported on 18 March 2026 that “In 2025, over 40% of cyber incidents reported to us involved a third party.” That is sector-level context, not a statistic about WhatsApp or adviser-account compromises; it is a reminder to examine suppliers, telecoms, email providers and other connected services when tracing the cause.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
