WhatsApp Account Takeovers Surge in Zimbabwe Amid SIM Swaps and Social Engineering Scams
HARARE — Zimbabweans are increasingly losing access to their WhatsApp accounts through account takeovers, fraud and SIM swapping, prompting fresh warnings from Econet Wireless Zimbabwe and the Zimbabwe Republic Police, according to a report published Monday by The Herald.
While no official national figures quantify the scale of the problem, circulating user reports describe small businesses cut off from customers and individuals discovering impostors messaging their contacts.
Econet issued a security alert on September 23, 2026, urging customers to enable passkeys and two-step verification amid rising mobile scams. Police have separately cautioned against fraud involving unauthorised SIM replacements that allow criminals to seize control of WhatsApp accounts.
In typical cases, attackers obtain personal details, impersonate victims at mobile network outlets to secure replacement SIMs, then access linked WhatsApp accounts and solicit money from contacts.
Another frequent method involves tricking users into sharing the six-digit verification code sent during registration attempts.
Criminals may also use malicious apps or compromise linked devices.
Business accounts are especially attractive targets because impostors can contact clients and request payments under the company’s name.
Not every blocked or inaccessible account indicates a hack. WhatsApp may restrict accounts for suspected terms violations, and access problems can stem from registration or SIM issues.
Authorities and the mobile operator recommend enabling two-step verification via Settings > Account > Two-step verification, setting up a passkey where available, adding a recovery email, never sharing registration codes or PINs, regularly reviewing linked devices and logging out unfamiliar sessions, downloading only official WhatsApp apps, and using a strong phone screen lock.
Business owners should restrict access to company accounts and independently verify unusual payment requests.
If an account is compromised, users should re-register the number promptly with the SMS or call verification code, review linked devices, and alert contacts through alternative channels.
The report underscores that convenience must not override basic security practices.