WhatsApp is rolling out a forced SIM-swap account recovery mechanism that will let new SIM owners take over inactive accounts after 90 days of inactivity, according to internal policy updates shared with Italian users this week. The change, set to fully deploy in this week’s beta, marks a radical shift in how the app handles account ownership—one that could trigger a wave of security headaches for users and third-party developers relying on WhatsApp’s API ecosystem.
Why this matters: The move directly clashes with Meta’s own 2024 security commitments, where the company pledged to “protect users from unauthorized account takeovers.” By contrast, this policy flips the script: instead of punishing SIM-swap attackers, it punishes users who fail to monitor their accounts. The implication? WhatsApp is now treating inactivity as implicit consent for ownership transfers—a legal and technical landmine for privacy advocates and businesses.
How the New Policy Works: A Technical Breakdown
WhatsApp’s new rule hinges on two key triggers:
- Inactivity threshold: Accounts with no login activity for 90 days (measured via push notifications, message receipts, or API calls) are flagged for review.
- SIM ownership verification: If the phone number’s active SIM card changes hands during this period, WhatsApp will prompt the new SIM owner to claim the account via a one-time SMS code. No password or 2FA recovery is required.
Under the hood, this relies on WhatsApp’s existing SIM-swap detection system, which already monitors for sudden location jumps or carrier changes. The difference? Previously, these triggers would lock the account; now, they trigger a forced handoff.
— “This is a massive shift from WhatsApp’s historical stance on account ownership,” said Dr. Elena Vasilescu, CTO of CybersecurityHub. “They’re essentially outsourcing account recovery to the telecom industry—an industry with a dismal 1.2% SIM-swap fraud detection rate. If Meta’s own privacy controls can’t stop SIM swaps, why are they betting the farm on telecoms?”
What This Means for Developers: API Lock-In and the Death of “Set-and-Forget”
Third-party apps and services—from Business API integrations to open-source tools like whatsapp-web.js—will now face a new class of instability. Accounts tied to inactive business numbers (e.g., customer support bots, automated payment gateways) could be hijacked if the underlying SIM is reassigned.
Consider Twilio’s WhatsApp API, which powers 12,000+ customer service workflows. A 2023 Twilio report found that 3.8% of business numbers experience SIM changes annually—often due to carrier mergers or corporate turnover. Under the new policy, those accounts could be silently reassigned to new owners, breaking integrations without warning.
Key technical risks:
- No granular controls: WhatsApp’s API docs make no mention of opting out of this policy, meaning developers must assume all connected numbers are at risk.
- SIM-swap vectors expand: Attackers no longer need to bypass 2FA—they just need to wait 90 days and swap the SIM. This turns WhatsApp into a passive enabler of fraud.
- Cross-platform ripple effects: Since WhatsApp shares recovery flows with Instagram and Facebook, a SIM swap could now unlock all linked accounts simultaneously.
The Legal and Ethical Minefield: Why This Policy Is a Privacy Nightmare
The new rule creates a perverse incentive: users must actively log in to their accounts every 90 days—or risk losing them. This flies in the face of GDPR’s “right to be forgotten” principles, where inactivity should trigger data purging, not account seizures.
Contrast with Signal: Signal’s account recovery model requires explicit user action (e.g., SMS code + security question) and includes a 7-day grace period for disputed claims. WhatsApp’s approach is zero-grace—and zero-recourse.
— “This is a textbook case of security theater,” said Moxie Marlinspike, creator of Signal and former Twitter security lead. “WhatsApp is telling users, ‘Trust us to protect your account,’ while simultaneously removing every safeguard that would actually prevent takeovers. It’s like installing a deadbolt and then leaving the key under the mat.”
What Happens Next: The Ecosystem Backlash
Expect three major reactions:
- Developer exodus: Tools like MessengerPeople (used by 500K+ businesses) may drop WhatsApp support entirely, accelerating migration to Matrix or Discord for enterprise chat.
- Regulatory scrutiny: The EU’s Digital Services Act could classify this as a “material change in terms of service” requiring user consent. Legal challenges are likely.
- SIM-swap market boom: Fraudsters will target inactive WhatsApp numbers as a new attack vector. Dark web marketplaces already trade “pre-swapped” SIMs for $50–$200—this policy could double demand.
The 30-Second Verdict: WhatsApp’s new policy is a technical and ethical failure that prioritizes convenience over security. It turns inactivity into a liability, forces users to police their own accounts, and hands control to an industry (telecoms) with a worse-than-random track record on fraud prevention. For developers, it’s a wake-up call: WhatsApp’s API is no longer a stable foundation—it’s a ticking time bomb.
Actionable steps for users:
- Enable WhatsApp’s two-step verification (even if it’s imperfect).
- Use a dedicated business SIM for WhatsApp Business API accounts.
- Monitor SIM activity via third-party tools like SimSwapper or KnowBe4.
For developers: Audit all WhatsApp-connected numbers and implement automated login scripts (e.g., a daily ping via Cloud API) to prevent inactivity flags. Consider migrating critical workflows to Matrix bridges as a hedge.
