Who's is short for who is or who has. (This is a 100% rule - it has no other uses.)
Whose is a bit more complicated. It sits before a noun to state (or ask) to whom it belongs. For example: A king whose crown is too big. Whose crown is this? Who's and Whose The terms whose and who's sound identical, but they perform very different roles in English. Whose Whose is the possessive form of who. It means belonging to whom. Whose usually sits before a noun. Conscience is a mother-in-law whose visit never ends. (Whose is before the noun visit. Whose in this example is a relative pronoun.) Whose bike was expensive? (Whose is before the noun bike. Whose in this example is an interrogative pronoun.) Carl knows the girl whose phone was stolen. (Whose is before the noun phone. Whose in this example is a relative pronoun.) Who's Who's is a contraction of either who is or who has. It has no other uses. Who's coming to fix the bed? (who is) Who's eaten the last muffin? (who has) I met the inspector who's delivering tomorrow's briefing. (who is)
Who's been stealing the biscuits?
Who's = who is or who has If you cannot substitute The Who's in your sentence with either who is or who has, then it is wrong.