Comment by walrus01

Are you sure it was actually via whatsapp, and not just a six digit code sent via regular SMS to the phone number on record for her account? It's possible whatsapp on her phone has simply hijacked the SMS client functionality and set itself as the default.