Zimbabwean Businessmen Are Losing Their WhatsApp Numbers to a Fast-Evolving Scam
Story By Godknows Mwayera
A troubling pattern has emerged across Zimbabwe’s business community.
Entrepreneurs and company representatives wake up to find they’ve been silently logged out of their own WhatsApp accounts. Someone else is already messaging their clients, suppliers and family — using their name, their photo and their contact list.
By the time the real owner notices, the damage is often done. Money has been requested, deals have been “confirmed,” and years of business trust have been weaponised in a matter of hours.
How a Single Message Can Cost You Your Number
The scam usually starts quietly.
A message arrives, sometimes from a contact whose own account has already been hijacked, claiming that a verification code was sent to the wrong number by mistake. It asks the victim to forward it back.
Moments later, a genuine-looking six-digit code lands from WhatsApp’s own systems. Trusting the earlier message, most people forward the code without a second thought.
That single action hands a stranger full control of the account.
Behind the scenes, the attacker is simply registering the victim’s number on a new device. WhatsApp sends that code to the real owner as a safeguard — one that only works if the owner keeps it private.
Once the code is shared, the attacker logs in, the real owner gets logged out automatically, and every group, client chat and business contact now belongs to someone else.
Why This Hits Businessmen Especially Hard
A hijacked number isn’t just a personal inconvenience for a businessman. It’s a direct line into every WhatsApp Business group, supplier chat and customer relationship he’s built.
In one case that reached the Harare Magistrates’ Court, two men were charged with unauthorised access to a computer network after allegedly hacking five WhatsApp Business groups belonging to a Harare company and seizing administrative control.
Investigators traced the rogue messages back to the company’s own WhatsApp Business account, linked to a genuine Econet number.
The company’s administrator tried to delete the unauthorised messages and remove the intruding number, but couldn’t — the attackers had already taken over as group admins.
One of the accused had also obtained a duplicate SIM card of the company’s line to help carry out the hijack.
This detail matters: it shows the scam has moved beyond simple code-forwarding tricks into more deliberate methods of intercepting a victim’s line.
From “Send Me the Code” to Fake Links
The original version of this scam was almost embarrassingly simple: a stranger claiming to have “accidentally” sent their code to your number, asking you to send it back.
That line still circulates, but the fraud has since grown a second, more deceptive layer — one that doesn’t even need to ask for a code directly.
Instead of requesting the six digits outright, many scammers now send a link, often disguised as a message from “WhatsApp Support,” a bank, or a government body, warning that the account is at risk and must be “verified” immediately.
The link opens a fake page built to look exactly like a real WhatsApp or banking login screen.
Anyone who enters their number and code there hands it straight to the scammer, without ever consciously “sharing” anything with a person.
This is a meaningful shift: the earlier trick relied on a victim being talked into an action; the newer one relies on a victim trusting a familiar-looking page enough to type information into it themselves.
It’s a technique worth understanding on its own, because it explains why some victims insist they “never told anyone” their code, yet still lost their account.
They didn’t hand it to a person — they typed it into a screen designed to look like WhatsApp itself.
Layered on top of both tactics is impersonation.
Many attackers now study a hijacked business’s tone, product range and typical client conversations before posing as the owner, or pose as trusted officials from a bank, a regulator, or the network provider itself, asking “customers” to confirm payment details or resend codes for a supposed account audit.
This shift, from a clumsy stranger’s plea to an authoritative, official-sounding voice or a convincingly branded page, is what makes the newer wave of attacks so much harder to spot.
Local Numbers, Foreign Operators
The people running these scams aren’t always in Zimbabwe.
Investigators and researchers tracking the fraud have linked coordinated networks, some based outside the country, to similar WhatsApp-hijacking operations across the region.
These networks often rely on locally registered Zimbabwean SIM cards, obtained through duplicate SIM requests, mobile money agents, or informal resale, to make their messages feel local.
A message from a Zimbabwean number, written in the target’s own name and referencing local currency and local banks, is far more convincing than one from an unfamiliar foreign source.
That local layer has become a deliberate part of the playbook.
When Recovery Becomes Its Own Ordeal
The frustration doesn’t always end once the hijacking is discovered.
Several affected businesspeople who approached Econet shops to reclaim their lines say they were told recovery could take up to a week.
This delay likely reflects standard SIM-verification and fraud-prevention procedures rather than indifference, but it leaves the account exposed in the meantime.
Every extra day a hijacked number stays active in someone else’s hands is another day scammers can message contacts, extract payments, or gather information for further attacks.
The initial mistake, whether it’s forwarding a code or tapping a fake link, often takes seconds.
The resulting exposure can stretch on for days — arguably the most damaging part of the entire scam.
What Econet and Security Experts Recommend
Econet has been urging subscribers to secure their WhatsApp accounts before an attack happens, not after.
Two-step verification sits at the centre of that advice: it adds a second PIN on top of the SMS code, making it far harder for anyone to take over the account even after obtaining the six-digit code — or after a phishing link has captured it.
Subscribers should also register a recovery email alongside that PIN, so the account stays recoverable even if the phone number itself is compromised.
Adding a passkey, where available, provides an extra layer of device-level security.
Checking the linked-devices menu periodically matters too, since a scammer with temporary access can sometimes leave a session running even after losing control of the main account.
And any link claiming to come from “WhatsApp,” a bank, or a network provider deserves the same suspicion as a stranger asking for a code directly — the destination matters just as much as the request itself.
The Bottom Line
No legitimate contact, official or company will ever need a customer to read out, forward, or type a verification code into an unexpected link.
That rule holds regardless of whether the message comes from a familiar name, a local number, a convincing web page, or someone claiming institutional authority.
For businessmen whose WhatsApp accounts function as a second office, a front door and a client book all in one, protecting that six-digit code like a banking PIN isn’t optional anymore.
It’s the difference between an ordinary Tuesday and losing a business relationship built over years — in the space of a single chat.
