Zimbabwean businesses are losing control of their WhatsApp Business accounts, and nobody has yet explained how. The government confirmed on 13 October that it is investigating a wave of takeovers, working with the police, the mobile network operator involved and Meta, which owns WhatsApp.

This matters more in Zimbabwe than in most markets. For many small businesses, WhatsApp Business is the shopfront, the order book and the payment confirmation channel in one app. When a criminal takes the account, they take the customer relationships with it, and can use that trust to ask customers for money.

The official advice so far tells users to protect themselves. That is useful, but it skips the bigger question. Some victims say they never shared a code. If that is true, the weakness may not sit with the users at all.

What victims and officials are saying

The pattern reported by victims is consistent. A phone receives repeated WhatsApp verification codes it never requested, along with messages saying the account is being registered on a new device. Then the owner is locked out. Without two-step verification, WhatsApp can make the rightful owner wait seven days before resetting the account, ZimLedger reported, based on reports from its followers. Most affected accounts are WhatsApp Business accounts, though ordinary users have also been hit.

Some reports go further. Business owners say they never shared their verification codes. Others found their account recovery details had changed, or saw unusual automated bot activity after the takeover.

ICT Minister Tatenda Mavetera said the investigation involves the relevant mobile network operator, the police cybercrime division and Meta, allAfrica reported. The government’s concern extends to advertising services and payment arrangements linked to the hijacked accounts. She urged businesses to check account access, linked devices, advertising activity and payment transactions, and told anyone affected to contact their bank immediately.

The probe reaches further than the public advice suggests. Investigators are examining platform systems, SMS termination partners, advertising accounts and payment arrangements. The telecoms regulator POTRAZ is also engaging Meta. The ministry says that operator is setting up a round-the-clock helpline for affected customers. Victims reportedly include a serving member of Parliament, News Directory 3 reported.

No one has published a verified count of affected accounts and there is no national figure establishing how widespread the problem is.

Three possible ways in

A WhatsApp account is tied to a phone number. Whoever receives the six-digit code sent to that number can register the account on a new phone. That leaves three broad routes for an attacker.

Tricking the owner. The oldest scam is still widespread. A message arrives from a contact whose account was already hijacked, saying they sent a code to your number by mistake. Moments later, a genuine WhatsApp code arrives by SMS. Anyone who forwards it hands over their account, and the chain continues through their contacts.

Stealing the number. Police have described a SIM-replacement fraud in which a suspect allegedly used stolen personal details to take over victims’ phone numbers, then their mobile money wallets, bank accounts and WhatsApp profiles. Victims’ phones lost service once the replacement SIM was approved. A SIM swap gives the attacker every SMS code, not only WhatsApp’s.

Intercepting the code. This is the possibility users fear most and the one least supported by evidence so far. ZimLedger’s follower reports say most victims are on Econet lines and suspect SMS codes sent to Econet numbers are being intercepted. Neither WhatsApp nor Econet has confirmed this. ZimLedger itself notes another explanation: Econet is the country’s largest network, so it would carry the most victims under any attack method. Still, the investigation’s reported focus on SMS termination partners, the companies that deliver bulk messages such as verification codes onto local networks, shows officials are treating the delivery route as a live line of inquiry.

The operator has repeatedly urged customers to secure their accounts. It issued a security alert on 23 September recommending passkeys and two-step verification, and repeated the call this week. However, as of 15 October, published reports carry no operator statement that directly addresses the interception suspicion.

Not just Zimbabwe

Zimbabwe is not alone this season. In Malaysia, the communications regulator MCMC received 92 complaints about hacked and blocked WhatsApp accounts, formally asked Meta for an explanation on 25 September and held joint talks with the company on 28 September, The Vibes reported. The regulator also made a point worth borrowing: a hijacked account and a blocked account are different problems, because accounts abused for spam or fraud can end up banned by the platform, punishing the original owner twice.

Other warnings point to different methods. On 1 October, the Royal Cayman Islands Police Service warned that criminals were using stolen verification codes to take over accounts. Separately, Kaspersky researchers reported in June a malware campaign spread through WhatsApp Desktop and WhatsApp Web in 11 countries and territories, using script files disguised as documents to install remote-access tools on Windows computers, iHarare reported. The Herald noted there is no confirmed evidence of a single worldwide takeover operation.

Account takeovers on Meta’s platforms are a long-running complaint. In March 2024, a coalition of US state attorneys general wrote to Meta about a sharp rise in takeovers and lockouts on Facebook and Instagram, asking for figures, causes and staffing for its response teams, California’s attorney general said. Meta has also gone to court against takeover operators: in 2022 it sued companies behind apps that tricked more than a million WhatsApp users into compromising their own accounts, Law Street Media reported.

A parallel wave in another country does not prove a shared cause. It does mean Zimbabwe’s investigators should be asking Meta whether the same patterns appear elsewhere.

Our view: advice is not an explanation

Every statement so far, from government, Econet and police, has told users to protect themselves. The advice is sound and people should follow it. But it puts the whole burden on the victim before anyone has established the cause. If codes are being obtained without the owner’s involvement, no amount of user caution fixes that, and telling people to switch on two-step verification answers the wrong question.

The bot activity some victims describe is a warning about the next phase. Hijacked business accounts come with ready-made customer lists and years of trust. Automated tools now let a criminal message hundreds of a business’s customers in its own voice, around the clock, at almost no cost. The longer the cause stays unknown, the more that trust gets spent.

These are the questions that need public answers:

1. Meta: How many Zimbabwean accounts have been taken over since September? Through which registration and recovery routes? Were recovery emails changed through a weakness in WhatsApp’s own systems? Did hijacked accounts run adverts billed to the owners’ cards?
2. Econet: Has it audited the delivery path of WhatsApp verification SMS on its network, including the third-party messaging routes that carry such codes? How many SIM replacements were requested in the same period, and how are they verified? Will it publish its findings either way?
3. Government: When will the investigation report, and will the findings be published? Will affected businesses get a channel to escalate recoveries with Meta faster than seven days?
4. Police: Have any arrests been made in this wave, and where should victims report so that cases are counted in one place?

A clear answer, even one that clears the network, would do more for public trust than another round of security tips.

What businesses should do now

Until the cause is known, layer your defences so a stolen SMS code alone is not enough:

• Turn on two-step verification with a six-digit PIN, and add a recovery email you secure separately. Without it, a hijacker can lock you out for days.
• Enable passkeys so logins on your own phone rely on your fingerprint, face or screen lock rather than an SMS code.
• Check linked devices weekly and remove anything you don’t recognise.
• Never share a code or PIN with anyone, including people claiming to be WhatsApp, your network, a bank or a group admin.
• Tell customers how you take payment. Publish your official payment details and tell customers you will never change them by chat. Ask them to call you before paying any new account.
• Watch your money trail. Check ad spend and card charges linked to your Meta accounts, and alert your bank at the first sign of trouble.
• If you are hit, re-register your number as soon as you can, report the case to the police and your network, and file a report through WhatsApp’s official support channel. Then warn customers on every other channel you have.

If your account was taken without you sharing a code, document it: dates, screenshots of the codes you received and any changes to recovery details. That evidence is what investigators need to find the real cause.