Zimbabweans Warned Over WhatsApp Account Takeovers: How to Protect Yourself

Warnings about WhatsApp account takeovers have brought renewed attention to the problem, with Econet Wireless Zimbabwe urging users to strengthen their security and the Zimbabwe Republic Police previously documenting cases involving fraudulent SIM replacements.

A report published by The Herald on 12 October 2026 highlighted concerns about compromised accounts and criminals impersonating legitimate users. However, there is no verified national figure establishing how many Zimbabweans have had their WhatsApp accounts taken over.

The threat is nevertheless well documented. In an official statement issued in October 2025, police described a suspected fraud scheme in which criminals allegedly gathered victims' personal information, impersonated them to mobile network operators and obtained replacement SIM cards.

Once a replacement SIM was activated, the legitimate customer's mobile service could be disconnected. Investigators said the suspects then accessed accounts and used compromised WhatsApp identities to request money from contacts.

Such attacks exploit trust as much as technology. A message requesting urgent financial assistance can appear to come from someone the recipient knows personally.

How Criminals Take Over WhatsApp Accounts

One common method involves tricking a user into revealing a six-digit WhatsApp registration code.

A criminal may contact someone pretending to be a friend, customer, company representative or technical support agent. The victim may be told that a code was sent accidentally, or that sharing it is necessary to resolve a problem.

In reality, the code may be intended to register the victim's WhatsApp number on another device.

Other scams use convincing links and fabricated competitions. In one documented example, victims were asked to vote for a friend in an online contest before being directed into an account-takeover process.

A different risk arises when someone is persuaded to link an unfamiliar computer or phone to their WhatsApp account. The legitimate user may remain logged in while another person gains access through a linked session.

SIM-swap fraud creates another route of attack. By obtaining control of a victim's telephone number, criminals may be able to receive registration messages intended for the rightful owner.

These methods are not identical, but they share a common feature: attackers exploit a person's identity, trust or access to a telephone number.

Five Steps That Can Protect Your Account

The first precaution is to activate WhatsApp's two-step verification feature. Open WhatsApp, go to Settings, select Account and look for Two-step verification. Follow the instructions to enable the protection offered by your version of the application.

WhatsApp is updating some accounts from a six-digit security PIN to a password-based system, so the options displayed may differ between devices.

Second, create a passkey where the feature is available. A passkey uses the phone's security system, such as a fingerprint, facial recognition or screen lock, to help verify the account holder's identity.

Third, never disclose a WhatsApp registration code, security PIN or password. Not even a person claiming to be a friend or WhatsApp employee should be given these credentials.

Fourth, inspect linked devices regularly. On Android, open WhatsApp's menu and select Linked devices. On an iPhone, look for Linked Devices in WhatsApp settings. Log out of any session you do not recognise.

Finally, keep WhatsApp and the phone's operating system updated, use the official application and remain cautious about unfamiliar links.

Users should also protect the email address associated with their account and contact their mobile operator immediately if their SIM unexpectedly stops working.

No individual security measure guarantees complete protection. Several layers of defence are more effective than relying on a single setting.

What to Do If Your WhatsApp Has Already Been Hacked

Anyone who unexpectedly loses access to WhatsApp should act promptly.

WhatsApp's official recovery guidance instructs users to log back in, enter their telephone number and verify it using the six-digit registration code received through SMS or a telephone call.

When the rightful owner successfully re-registers the account, other devices using that account are logged out.

If an unfamiliar two-step verification PIN has been enabled, the user may have to wait up to seven days to regain full access. WhatsApp says entering the registration code still removes the other person from the account.

After recovering access, users should review linked devices, strengthen their security settings and notify contacts that suspicious messages may have been sent in their name.

Where a SIM swap is suspected, the mobile network operator should be contacted immediately to restore control of the number. Suspected fraud or financial losses should also be reported to the police and the relevant financial service provider.

Friends and relatives receiving unusual requests for money should verify them through a separate telephone call or another trusted communication channel before sending funds.

WhatsApp uses end-to-end encryption to protect personal communications, but encryption does not prevent a criminal from impersonating an account holder or persuading someone to disclose access credentials.

For Zimbabwean families and businesses, the most effective response begins before an account is compromised.

A few minutes spent reviewing security settings today could prevent days of disruption, financial loss and damage to relationships tomorrow.