What just happened
Over the past few weeks, Zimbabwean businesses have been waking up to a nightmare: their WhatsApp Business account is gone. The number still works, but the chats, customer list and catalogue are on someone else's phone, and that person is messaging customers as the business.
It is serious enough that the government has stepped in. On 13 October, ICT Minister Tatenda Mavetera announced an investigation with the affected mobile network operator, the police cybercrime unit and Meta, calling the scale "unprecedented." Investigators are still working out how it happened, including whether linked Facebook advertising and payment accounts were also exposed.
For a big company, this is an IT incident. For a small business that runs on WhatsApp, it can feel like the shop burned down overnight:
- Years of customer chats, gone.
- Quotes, orders and proof of payment, gone.
- Customers receiving messages "from you" asking them to send money to a new account.
- No way to warn them because the main way they know how to reach you is the account you have lost.
How accounts get taken
The exact cause of this latest wave is still under investigation. Some victims say they never shared any code, so do not assume it only happens to careless people. These are the main routes local reports describe:
- The "wrong code" trick. You receive a six-digit WhatsApp code by SMS. Seconds later, a friend or customer whose account is already hijacked says they sent the code to you by mistake and asks you to forward it. Forward it, and your account is theirs.
- SIM swap. Someone convinces a mobile operator outlet to issue a duplicate of your SIM. Your phone suddenly loses signal while their phone starts receiving your codes.
- Fake links and apps. Investment, job-offer or giveaway links install malware that can read your SMS codes.
- Linked devices you forgot about. A WhatsApp Web session on an old laptop, or a QR code scanned "to join a group," quietly gives someone else access.
Once attackers are in, the damage spreads. They message every contact and group, ask for codes or urgent payments, and repeat the scam from your trusted name.
Lock it down today in 10 minutes
- Turn on two-step verification. Go to WhatsApp, Settings, Account, then Two-step verification. Choose a six-digit PIN that is not 123456 or your birthday, and add a recovery email.
- Add a passkey if your phone supports it under Settings, Account, then Passkeys. This lets you sign in with your fingerprint or face instead of a code.
- Check Linked devices. Log out anything you do not recognise and repeat this check weekly.
- Never forward a verification code. Do not send it to a friend, "WhatsApp support" or your own staff. WhatsApp will never ask for it in a chat.
- Watch your signal. If your phone suddenly shows "No service" for no reason, call your network operator immediately and ask whether a SIM swap has been requested.
- Update from official stores only. Do not install "WhatsApp Gold" or modified versions.
- Lock down Facebook and Instagram too. Turn on two-factor authentication and remove old administrators from your business pages because advertising and payment accounts may be linked.
- Agree on a rule with customers. Tell them: "We will never change our payment details by WhatsApp message. Always call to confirm."
If it happens to you
- Re-register your number in WhatsApp immediately. Request and enter the SMS code. This removes the attacker from your account.
- If WhatsApp asks for a PIN you did not set, the attacker enabled two-step verification. You may have to wait seven days before you can regain access without it, but the attacker is logged out during that time.
- Call your network operator to rule out or reverse a SIM swap.
- Warn customers through every other channel: email, Facebook, Instagram, your website and SMS. Tell them: "Our WhatsApp has been compromised. Do not send money or codes to it."
- Do not pay anyone who promises to recover the account. That is usually a second scam.
- If money was lost, keep screenshots and report the incident to your bank or mobile money provider and the ZRP.
- Once you regain access, check Linked devices, enable two-step verification and review your Meta advertising and payment settings.
Warning customers is where many businesses get stuck. If WhatsApp was the only way customers knew how to reach you, you have no independent channel from which to alert them.
Do not run your whole business on one app
WhatsApp is brilliant for quick conversations, and nobody is saying you should quit it. The lesson from this wave is simpler: do not let a single app on a single SIM card be your only line to customers.
A business email on your own domain, such as hello@yourbusiness.co.zw, is the steady channel underneath everything else:
- It is tied to your domain, not your SIM card. A SIM swap cannot take it.
- You control the address. If a password is compromised, your email provider can reset it and you keep the same address.
- Your records stay put. Quotes, invoices and agreements remain in a mailbox you can open from any device.
- Staff get their own logins. Sales and accounts teams can use separate passwords instead of sharing one WhatsApp number.
- Customers can verify it. An email from your company domain is easy to compare with your official website.
- It is your emergency broadcast channel. If WhatsApp is unavailable or hijacked, you can still email customers to warn them.
Email is not hack-proof either. Use a strong, unique password, do not share mailbox logins, and treat suspicious links with the same caution.
How to use WhatsApp and email together
Tell customers once, clearly: "Our official contact is hello@yourbusiness.co.zw. Payment details only ever come from our email."
Protect the trust you have built
You can rebuild a WhatsApp account. It is much harder to rebuild trust after customers have been scammed in your name.
Take ten minutes today to secure your accounts. Then give your business a home that no SIM swap can steal.
Give your business an independent contact channel
Lemon Hosting sets up professional email on your own domain for Zimbabwean businesses from US$5/month, and we handle the technical setup.
Sources
- Zimbabwe: Govt Launches Probe Into Unprecedented WhatsApp Account Takeovers, 263Chat via allAfrica, 13 October 2026
- WhatsApp Business Accounts Under Attack in Zimbabwe, TechNews Zimbabwe, 13 October 2026
- The Anatomy of WhatsApp Business Hacking in Zimbabwe, Zimbabwe Now
- Govt probes WhatsApp business breaches, Zimbabwe Situation, 14 October 2026
- Protecting WhatsApp accounts, UK Ministry of Justice security guidance