Zimbabwean businesses are scrambling to secure their WhatsApp accounts after a wave of reported takeover attempts and lockouts appeared to concentrate on WhatsApp Business profiles using Econet numbers.

The reports have moved beyond scattered complaints. On 14 October, ICT Minister Tatenda Mavetera said Government had opened a coordinated investigation involving the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the Zimbabwe Republic Police Cyber Crime Division, the mobile network operator concerned and Meta, which owns WhatsApp.

Mavetera described the reported scale as unprecedented and said investigators were examining multiple possible points of failure, including SMS termination partners, often called aggregators, as well as the systems operated by the platforms involved. Econet has separately repeated its warning that customers should enable WhatsApp passkeys and two-step verification.

What has not been established is just as important. There is no verified national count of affected accounts, and neither Econet, Meta nor the authorities has publicly confirmed that Econet’s network was breached or that criminals intercepted verification codes. Those claims are circulating widely online, but remain theories while the investigation continues.

What users are reporting

Recent reports from Zimbabwean business owners describe a recurring pattern: unexpected WhatsApp registration codes, notifications that a number is being registered on another device, temporary loss of SMS or call verification, and in some cases complete loss of access to the account.

ZimLedger, which gathered responses from its business-focused audience, said most of the incidents reported to it involved WhatsApp Business accounts and Econet numbers. Some users told the publication that they had not shared a code or clicked a suspicious link before losing access. That testimony is significant, but it is not yet technical proof of how the accounts were compromised.

WhatsApp Business accounts are attractive targets because their numbers are public. They appear on shop signs, social profiles, websites, invoices and adverts. A hijacked business profile also comes with an established identity and trusted customer relationships, giving a criminal a convincing route to request deposits, change payment details or distribute fraudulent links.

The consequences can extend beyond the messaging app. The Government says investigators are checking whether accounts connected to Meta advertising tools exposed payment information or produced unauthorised transactions. Businesses have been advised to review linked Meta accounts, advertising activity and payment records immediately.

Several attack routes are possible

A WhatsApp takeover normally begins when another device successfully registers the victim’s phone number. WhatsApp sends a six-digit registration code by SMS or phone call to confirm control of that number. If an attacker obtains the code and the account has no additional verification layer, the legitimate phone can be logged out.

The familiar route is social engineering. A criminal poses as a friend, employee, network operator or WhatsApp representative and persuades the victim to reveal a registration code. Another route uses a fraudulent replacement SIM, giving the attacker control of calls and text messages sent to the victim’s number. Zimbabwe has dealt with that method before: in January, two Harare men appeared in court over the alleged takeover of a company’s WhatsApp Business presence using a duplicate Econet SIM.

Linked-device fraud is another risk. A user who scans an unfamiliar WhatsApp pairing QR code can unknowingly grant an attacker ongoing access without immediately being logged out. Call-forwarding tricks may also divert voice verification if a victim is persuaded to activate forwarding.

None of these established techniques, however, fully proves what is driving the current cluster of reports. The possibility of an issue involving SMS aggregators is now an official line of inquiry, not a confirmed finding. The same applies to online claims of a fresh subscriber-data leak or a WhatsApp vulnerability. Until POTRAZ, Econet or Meta publishes evidence, attributing the wave to one cause would be premature.

Why two-step verification matters

WhatsApp’s registration code and its two-step verification credential perform different jobs. The first confirms access to the phone number. Two-step verification adds a separate PIN or password that must also be supplied when an existing account is registered again.

This distinction matters if an SMS code is stolen or diverted. A criminal may get past the phone-number check, but a two-step credential set by the legitimate owner creates another barrier. Users should add a secure recovery email too, and protect that email account with its own strong password and multi-factor authentication.

A passkey adds another layer by linking WhatsApp sign-in to the phone’s fingerprint, face recognition or screen lock. WhatsApp also recommends checking linked devices, using only the official app, keeping it updated and enabling device-level app lock where available.

No single setting is absolute protection, but layered security makes an opportunistic takeover much harder and improves the owner’s recovery options.

What businesses should do now

  • Enable two-step verification: Open WhatsApp Settings, select Account and turn on two-step verification. Use a PIN or password that is not reused elsewhere and add a recovery email.

  • Create a passkey: Where the option is available, create one under the account security settings so sign-in is tied to the device’s biometric or screen-lock protection.

  • Audit linked devices: Log out any browser, computer or phone that the business does not recognise. Repeat the check regularly.

  • Review Meta and payment activity: Check connected Facebook and Instagram profiles, advertising accounts, saved cards and recent transactions for unfamiliar changes.

  • Control who holds the number: Record which employee controls the SIM, recovery email and security credentials. A public business number should not have casually shared administrator access.

  • Never disclose registration codes: Econet, WhatsApp, a bank or a genuine colleague should not ask for the six-digit code sent to the phone.

  • Verify payment requests out of band: Customers and staff should confirm changes to bank, EcoCash or payment details through a known voice number or another established channel.

An unsolicited registration code is a warning that someone may be trying to register the number. Do not share it, approve an unexpected prompt, scan an unfamiliar pairing code or follow instructions to dial an unverified service code. Businesses should also prepare a backup communication channel before an incident, rather than trying to create one after customers are already receiving fraudulent messages.

If the account has already been taken

WhatsApp’s official recovery process starts by logging back in with the affected number and entering the six-digit code received by SMS or phone call. Successful re-registration automatically logs other devices out of the account.

If the attacker enabled a two-step PIN that the owner does not know, WhatsApp says the user may have to wait seven days before trying again. A verified recovery email can shorten parts of the reset process. The company warns that changing unrelated passwords does not remove someone who has already taken over the WhatsApp account; re-registration is the step that removes them.

At the same time, the business should warn customers and suppliers through its website, social pages, email and an alternative phone number. Tell them to ignore requests for money or changed payment instructions from the compromised profile. Review linked devices and financial activity, contact the bank immediately if a card or payment account may be exposed, and report the incident to Econet, the police and the relevant platform through official channels.

The investigation now needs answers

Econet’s security advice is useful, but the volume and character of the reports demand more than a user-awareness campaign. Businesses need to know whether the incidents are primarily phishing, fraudulent SIM replacement, compromised forwarding, abuse of an SMS delivery partner, a platform defect or a mixture of methods.

Government says the operator concerned is establishing a 24-hour response mechanism and that verified findings will be communicated. Meta’s participation will be central because only the company can fully examine account-registration events and activity inside WhatsApp.

Until those findings arrive, the responsible conclusion is limited but urgent: a real wave of reported account disruption is affecting Zimbabwean users, business accounts and Econet numbers appear prominently in those reports, and the underlying cause has not yet been proven. Secure the account now, preserve screenshots and timestamps if anything unusual happens, and treat any familiar-looking request for money as unverified until confirmed elsewhere.