As reported by BleepingComputer, WhatsApp is rolling out multi-passkey support and alphanumeric two-step verification (2SV) passwords — incremental but meaningful upgrades to the authentication posture of a platform used by over three billion people. While these features may appear consumer-facing, they carry direct implications for enterprise security teams, particularly those managing BYOD environments or using WhatsApp Business for customer engagement.
Why This Matters Beyond the Consumer Headline
The single most important change is the expansion of passkey support to multiple devices. Previously, users operating across Android and iOS had a structural friction point: a passkey bound to one platform ecosystem created gaps in the other. Attackers routinely exploited these gaps through SIM-swap or SMS-interception attacks targeting the fallback authentication path. By allowing per-platform passkeys, WhatsApp is reducing reliance on telephony-based recovery — the weakest link in its account security chain for years.
The upgrade from six-digit PINs to alphanumeric passwords for 2SV addresses a different but equally persistent problem. Six-digit PINs offered only one million possible combinations, making them trivially brutable in offline scenarios where an attacker has already obtained partial account access. The move to full passwords — with special character support — brings 2SV in line with modern credential standards, though it also introduces the risk that users will reuse existing weak passwords unless guided otherwise.
The call-screen context feature — showing country origin and shared group membership for unknown callers — is a lightweight but effective anti-social-engineering control. Scammers depend on urgency and ambiguity; this strips both away at the moment of decision.
Who Is Affected
What Defenders Should Do
Security teams should not treat WhatsApp's feature rollout as a set-and-forget improvement. Adoption is the real vulnerability. Based on Shield53's experience with enterprise messaging audits, passkey enrollment rates on consumer platforms typically sit below 15% without active prompting. The technical controls exist; the human layer does not.
Shield53 Recommendations
- Issue a security advisory to all staff instructing them to enable passkeys on every device they use for WhatsApp, not just their primary phone. Provide step-by-step guidance (Settings > Account > Passkeys).
- Mandate 2SV password upgrades for any employee using WhatsApp Business or official WhatsApp for work communications. Enforce a minimum 12-character passphrase — not a recycled corporate password.
- Audit WhatsApp Business API integrations to ensure session tokens and linked devices are reviewed quarterly. Passkeys protect the user account layer; API tokens remain a separate attack surface.
- Update mobile device management (MDM) policies to require screen lock (biometric or PIN) on any device with WhatsApp installed — passkeys depend on device-level authentication being active.
- Brief high-risk personnel separately. Executives and others flagged in threat assessments should enable WhatsApp's Strict Account Settings (rolled out January 2026) in addition to passkeys, as this provides elevated protection against targeted spyware and account compromise.
- Monitor for device-linking abuse. WhatsApp's March 2026 warning for fraudulent linking requests is a control, not a guarantee. Train users to treat any unexpected linking code as a red flag and report it to IT.
The broader takeaway is that consumer messaging platforms are quietly becoming some of the most authentication-mature surfaces in the ecosystem. Meta's investment here — passkeys, ML-based scam detection, lockdown modes — reflects both the scale of abuse and the regulatory pressure mounting on encrypted communications. Enterprises that still treat WhatsApp as an ungovernable shadow-IT channel should revisit that stance. The security features are now sufficient to warrant formal inclusion in acceptable-use policies, with enrollment requirements rather than mere suggestions.
