Background

When a phone number is registered on WhatsApp, a six-digit verification code is sent to that number by SMS or voice call, and whoever enters that code controls the account.

Source
Worth Knowing

Econet Wireless Zimbabwe first urged customers to switch on WhatsApp passkeys and two-step verification on 23 September 2026, sending the advice by SMS and across its social media pages.

Source
Worth Knowing

On 12 October 2026 an Econet spokesman said the company was once again urging customers to secure their accounts, adding a warning to switch off any call forwarding they did not set up.

Source
Worth Knowing

On 13 October 2026 ICT Minister Tatenda Mavetera said government was investigating the takeovers through POTRAZ, the ZRP Cyber Crime Division and engagement with Meta and the mobile network operator concerned.

Source
Worth Knowing

The Zimbabwe Republic Police have warned of fraud in which criminals impersonate victims at mobile network operators to get replacement SIM cards, then use them to take over WhatsApp accounts and ask contacts for money.

Source

Reports of hijacked WhatsApp accounts have been doing the rounds in Zimbabwe, The Herald noted this week, and the story is usually the same: the owner is locked out, and someone else is now messaging their customers, family and church groups from their number. For a small business that sells, takes orders and gets paid through WhatsApp Business, that isn't just annoying. It means a stranger has the shop's front counter.

Econet has now spoken about it twice, and on 13 October the government stepped in too. ICT Minister Tatenda Mavetera called the scale of the attack "unprecedented" and said investigators are looking at more than just tricked users. What each of them has said, and what they haven't, matters for anyone running a business on WhatsApp.

What Econet has said

On 23 September, Econet Wireless Zimbabwe asked customers to "proactively secure their WhatsApp accounts," Pindula News reported. The company pointed to hackers and social engineering scams that it said were increasingly targeting mobile users, and sent the advice out by SMS as well as on Facebook, Instagram, X and its website.

On 12 October it went again. An Econet spokesman told The Herald the company was "once again" urging customers to act, with the same core list:

  • Turn on WhatsApp passkeys and two-step verification, with a six-digit PIN and a recovery email.
  • Never share a verification code or security PIN, whoever is asking.
  • Check linked devices and remove any you don't recognise, and log out of unfamiliar WhatsApp Web sessions.
  • Check your call forwarding settings and switch off anything you didn't set up.
  • Don't dial unverified codes that start with * or **.
  • Don't scan unknown QR codes or type WhatsApp pairing codes into third-party sites.
  • Confirm any request for money, account details or codes by calling the person directly.

What Econet has not said is just as important. Neither statement mentions a breach of Econet's own systems, and neither gives a number of affected customers. The company has framed this as scammers tricking users, not as its network being broken into. The Herald's fact check, published the same day, found there is no verified national figure for how widespread the problem is, and noted that a blocked account isn't always a hacked one, since WhatsApp also restricts numbers for breaking its rules.

What the government has said

On 13 October, Minister Mavetera said government was "deeply concerned" about takeovers affecting WhatsApp Business and other Meta platforms, Pindula News reported. The Herald reported that she was speaking on national television, and she posted the video statement on X the next morning.

The key points from her statement, as reported by Pindula, The Herald and 263Chat:

  • Who is investigating. POTRAZ is leading the probe, with the ZRP Cyber Crime Division involved. The ministry is engaging "the concerned mobile network operator", which she did not name, and POTRAZ is engaging Meta, which owns WhatsApp, Facebook and Instagram.
  • What they are looking at. Investigators are examining the possible role of SMS termination partners, the aggregators that carry bulk text messages such as verification codes between platforms and networks, as well as the platforms' own systems. "This remains a line of inquiry, and evidence must establish responsibility," she said.
  • Money and ads. A particular worry is that criminals are using hijacked accounts linked to Meta's advertising services and the payment cards attached to them. Investigators are checking whether financial information was exposed or unauthorised payments went through.
  • Support for victims. The operator has told government it is setting up a 24/7 response line for affected customers, and it is expected to put out a full statement on what it found.

"I had two-step verification on"

Part of what pushed this beyond a routine scam warning is a set of reports that don't fit the usual story. ZiFM Stereo News reported on 12 October that some WhatsApp Business users said they were locked out even though two-factor authentication was switched on. Entrepreneur Kudakwashe Musasiwa told the station he hadn't clicked any suspicious links or shared a code, and still lost his account. He said the problem stopped once he moved his WhatsApp off Econet-linked numbers, though ZiFM noted that this doesn't establish Econet was responsible. Other users described a run of verification codes and new-device requests they ignored, before losing access anyway. Hwange Chronicles also reported users, mostly on Econet numbers, saying they were locked out without clicking anything.

Similar accounts have been shared widely on X and Reddit. None of them has been independently verified, and nobody has yet explained how an account with a two-step PIN could be taken over. But if they hold up, they would mean that some takeovers didn't depend on the owner making a mistake, which is exactly the question the government's investigation is now asking.

That is a shift from where things stood a day earlier. Econet's advice treated the problem as people being tricked into giving up codes. The minister's statement keeps that advice but also puts the delivery chain for those codes, the aggregators and the platforms, under investigation. Nothing has been proven yet, and she was careful to say so.

How the "OTP" part actually works

The code at the centre of all this is the six-digit verification code, a one-time PIN or OTP, that WhatsApp sends when a number is registered on a new phone. Whoever types that code in gets the account. So every one of these attacks is really a way of getting that code off the real owner.

There are three common routes, according to the reporting.

Asking for it. The most common version runs through people you already trust. A friend whose account has already been taken messages you saying they sent their WhatsApp code to your number by mistake and asks you to forward it, Techzim explained in April. A code then arrives on your phone. It is your code, for your account. Forward it and you're locked out, and the scammer moves on to your contacts with the same story.

Redirecting calls. This is why Econet now mentions call forwarding and codes starting with *. Security researchers at CloudSEK showed back in 2022 how it works, BleepingComputer reported: the scammer gets the victim to dial a short code, often while posing as customer support, that quietly forwards all their calls to the scammer's number. The scammer then starts registering WhatsApp on their own phone and asks for the code by voice call instead of SMS. The call goes to them, not to you. The victim never sees a code at all. The scammer can then switch on two-step verification themselves, so the owner can't get back in.

Swapping the SIM. The Zimbabwe Republic Police have warned about criminals who collect victims' personal details, pretend to be them at mobile network operators and get a replacement SIM, The Herald reported. With your number on their SIM, every code comes straight to them.

Why businesses get hit hardest

When a personal account is stolen, the scammer usually asks friends for "emergency" money. When a business account is stolen, they inherit something more valuable: a list of customers who already trust that number and are used to paying it. The Herald pointed out that criminals can impersonate a company, contact its customers and ask for payments in its name.

In Zimbabwe that hits harder than in many places, because so much trade happens inside WhatsApp. Small shops, hair salons, food sellers, car dealers and even churches use it as their storefront, order book and payment desk. A hijacked number can mean customers sending EcoCash or bank transfers to a scammer for orders that never come, and a damaged name that takes much longer to fix than the account itself.

What to do this week

If WhatsApp Business is how you earn, the steps are short:

  1. Turn on two-step verification now. Settings, then Account, then Two-step verification. Set a PIN and add an email. Normally, anyone who gets your code would still need that PIN. Some users say they lost accounts with it switched on, so it may not be a guarantee right now, but it still blocks the most common attacks. Add a passkey too if your phone offers it.
  2. Treat every code as yours alone. No one at Econet, WhatsApp or your bank needs it. A message saying "I sent my code to you by mistake" is the scam.
  3. Check call forwarding. If you've ever dialled a code someone gave you over the phone, check your phone's call settings and switch off forwarding you didn't set up.
  4. Guard the SIM behind the business. Keep the business line in a responsible person's name, don't hand the SIM to staff, and ask Econet what checks protect it against a replacement you didn't request.
  5. Tell customers the rules. Pin a message or status saying you will never ask for codes and never change payment details in chat.
  6. Check your Meta ad account and cards. If your WhatsApp Business is linked to a Facebook or Instagram page that runs ads, look at Meta's ad activity and payment settings for campaigns or charges you didn't make, as the minister advised, and call your bank straight away if you see any.
  7. If it happens, re-register your number on your own phone straight away using the code WhatsApp sends, warn customers on another channel such as Facebook or SMS, and report it to your mobile network operator and the ZRP.

The investigation may yet find a weak link somewhere between WhatsApp, the aggregators and the networks, and that part is out of your hands. Until it reports, assume no single setting makes you untouchable. Switch on the two-step PIN anyway, because it still stops the everyday scams. Keep a second channel ready for warning your customers, and treat the moment someone asks you to read out, forward or redirect a six-digit code as the moment to stop.

Sources

Researched and drafted with the help of AI tools, then fact-checked and edited by our team. How we work.

Share
R
Written by

Rufaro