For thousands of Zimbabwean businesses, WhatsApp is the shop counter, the customer service desk and the order book all in one. That is exactly why criminals are targeting it. In recent weeks, business owners across the country have reported losing control of their WhatsApp Business accounts, and government has opened an investigation, with the ZRP Cyber Crime Division involved.
What is happening?
The classic WhatsApp scam tricks you into sharing the six-digit code WhatsApp sends when someone tries to register your number on a new phone. That still happens. But some of the recent victims say they never shared a code at all.
That does not necessarily mean WhatsApp itself has been broken. Accounts can also be taken over through:
- SIM swap fraud, where criminals impersonate you to get a replacement SIM for your number
- Unauthorised linked devices, such as a WhatsApp Web session you did not set up
- Malicious apps or unofficial “modded” versions of WhatsApp
- Fake links and QR codes that quietly connect a hacker’s device to your account
Some owners have also reported that attackers quickly changed their recovery details, making it harder to get the account back. Investigators are also examining the SMS systems used to deliver verification codes.
Why business accounts are a bigger target
When a personal account is hijacked, the scammer messages friends asking for money. When a business account is hijacked, the scammer inherits your customers. They can send fake invoices, ask for payments to a different EcoCash or bank account, or share malicious links, all from a number your customers already trust.
8 steps to lock down your account today
- Check Linked Devices. Open WhatsApp, go to Settings, then Linked Devices. Log out of any session you do not recognise.
- Turn on two-step verification. This adds a PIN that is required whenever your number is registered on a new phone. Use a PIN that is not your birthday or 1234.
- Add a recovery email, and secure it. If the email account is weak, it becomes the back door. Give it a strong password and two-factor authentication.
- Set up a passkey if your phone and account support it.
- Only use the official app. Download WhatsApp Business from Google Play or the App Store. Avoid versions that promise extra features.
- Never share codes or scan unknown QR codes. No genuine competition, vote or “business verification” needs your WhatsApp code.
- Watch for sudden loss of network. If your phone shows “No Service” for no reason, call your mobile operator immediately. It could be a SIM swap in progress.
- Tell customers how you take payment. Publish your official payment details and make it clear you will never change them by message.
Have a backup channel
The businesses that recover fastest from a hijacking are the ones that do not rely on a single number. A website listing your official contacts and payment details gives customers somewhere to check when something feels off. A professional email address and active social pages give you other ways to warn them.
If it happens to you
- Try to re-register your number in the official app and follow WhatsApp’s recovery steps
- Contact your mobile operator if you suspect a SIM swap
- Warn customers through your other channels not to send money or click links
- Keep screenshots and transaction references, then report to the police and the relevant payment provider
- Never pay a stranger who claims they can recover your account
Protect your brand beyond WhatsApp
WhatsApp is a great sales tool, but it should not be your only home online. A website you control is the one place customers can always verify who you are.
Need a website or professional email to back up your WhatsApp business? Chat to all.tech on WhatsApp or email info@alltech.co.zw.
