A friend of mine (Bob) received a suspicious Whatsapp message today, seemingly from a former colleague (Alice), who claimed to have "forwarded [to Bob] an SMS with a code in it by mistake", and who was asking to send it back.
Bob unfortunately sent the (6 digit) code (received over SMS, in a message written in Spanish, although Bob's account uses a UK number, and his Whatsapp is normally in English) back to Alice over Whatsapp, after which Bob's Whatsapp app seemed to go through the number verification process again.
I received the usual "XXX's security code changed. Tap for more info" notification twice within a few minutes in my Whatsapp conversation with Bob. We have verified that the codes match (only after the second notification).
While it is clear that my friend should not have replied with this code, I do not understand exactly what happened here:
Did someone try to login to Bob's Whatsapp account? Is it possible to "move" a Whatsapp account to a new phone simply by inputing the target phone number at the verification stage?
What phone number do Whatsapp number verification SMSes normally come from?
What is the possible damage resulting from this? Would the attacker (Alice) be able to send messages "from Bob's account"?
What cleanup measure should Bob take to limit the damage/recover his account/kick out Alice?