Econet Wireless Zimbabwe is urging customers to lock down their WhatsApp accounts as scammers target mobile users with tricks that can lead to stolen accounts, fraudulent messages and demands for money from friends, relatives and customers.
The company’s warning comes as the Zimbabwe Republic Police has described a SIM-replacement fraud in which a suspect allegedly used stolen personal details to take control of victims’ phone numbers, mobile-money wallets, bank accounts and WhatsApp profiles. The police said the victims’ contacts were then approached for cash using the compromised accounts.
Econet has urged users to enable WhatsApp Passkeys and two-step verification, keep their registration codes private and regularly check which devices are linked to their accounts. It has also warned people not to scan unknown QR codes, dial unverified service codes or click suspicious links, even when a message appears to come from someone they know.
“We once again urge customers to protect themselves by proactively securing their WhatsApp accounts by selecting the login and security settings on their WhatsApp profile, and enabling WhatsApp Passkeys, as well as activating the two-step authentication (or verification) on their account,” an Econet spokesman said.
The company says these measures add protection and can help customers recover an account if it is compromised. But the advice is arriving amid growing concern among Zimbabweans who have reported losing access to accounts or seeing impostors contact people in their name. Econet and police have not published a verified national count of affected WhatsApp users, so the scale of the problem across the country is not established.
How a stolen account can turn into a money demand
In one of the most direct routes to a WhatsApp account, a scammer tries to register someone else’s phone number on a device they control. WhatsApp sends a six-digit registration code to that number. If the account holder is persuaded to disclose it, the criminal can complete the registration and take over the account.
The request may be wrapped in a convincing story. A message can claim that a code was sent by mistake, that a friend needs urgent help, or that the person is speaking to a network operator or a platform representative. The aim is to make the target act quickly and hand over information that should remain private.
A second route involves SIM swapping, also called SIM replacement fraud. A criminal who has collected enough personal information may impersonate a phone’s owner when contacting a mobile network and request a replacement SIM card. If the request succeeds, the genuine customer’s service may stop working while the replacement SIM receives calls and text messages intended for that number.
In a press statement dated 21 October 2025, police said they were seeking a suspect in connection with several fraudulent SIM replacements and hacking cases. The statement put the amounts involved in those cases at US$17,009.50 and ZWG 30 665 912.30. Police said the suspect had allegedly gathered victims’ names and phone numbers through methods including phishing, data breaches or public records, then used social engineering to get past security questions when dealing with mobile providers.
According to the police account, after a SIM replacement was approved, victims’ phones lost service and the suspect gained access to personal data. The suspect allegedly withdrew money from mobile wallets and bank accounts through digital banking, then took control of victims’ WhatsApp accounts and asked their contacts for cash.
That case shows how an account takeover can extend beyond WhatsApp. When a fraudster controls a phone number, they may try to use it to receive verification messages or to impersonate the owner across services. And when a WhatsApp profile is taken over, the criminal can exploit the trust built into existing chats, groups and business relationships.
Small businesses can be particularly exposed to disruption. A fraudster using a company’s identity can approach customers who are accustomed to receiving invoices, payment details or delivery updates by message. Individuals face a similar risk when a request for emergency help appears to come from a friend or relative. A familiar name and photograph are not proof that the person sending the message is the account holder.
The security steps Econet is asking customers to take
Econet’s guidance begins with two-step verification. Users can find it in WhatsApp’s account settings and set a six-digit PIN. A recovery email should also be added where available, so that the account holder has another way to regain access if they forget the PIN. WhatsApp Passkeys link sign-in to the phone’s security system, such as a fingerprint, face recognition or screen lock, where the feature is available.
Users should never share the six-digit registration code or their security PIN, regardless of who asks for it. A genuine contact, mobile operator or WhatsApp representative should not need the registration code sent to the user’s phone. Anyone who receives a code they did not request should treat it as a warning and should not pass it on.
The linked-devices page also deserves regular checks. It shows active sessions connected to an account, including WhatsApp Web sessions. Any device the user does not recognise should be logged out. People using a shared or public computer should take care not to leave a session open, and should avoid scanning pairing QR codes displayed on unfamiliar websites or screens.
Econet has also advised customers to keep WhatsApp updated, use a strong phone screen lock and check that call-forwarding settings have not been changed without permission. It warns against dialling unverified codes beginning with * or **. Suspicious links and messages that create urgency should be treated cautiously, including when they arrive from a familiar account that may itself have been compromised.
Requests for money or sensitive information should be checked through a separate channel. Calling the person directly is safer than replying to the message or using a phone number supplied in it. Businesses can reduce risk by limiting the number of people who can access company accounts and independently confirming unusual payment instructions before transferring funds.
What to do if an account is taken over
WhatsApp’s account-recovery guidance says a user who still controls their phone number should re-register the account using the six-digit code received by text message or phone call. Entering that code logs other devices out of the account. If the user is asked for a two-step verification PIN they do not know, WhatsApp says they may have to wait seven days before trying again; other users of the account are logged out once the registration code is entered.
After regaining access, the owner should check linked devices, turn on the available security features and tell friends, relatives, colleagues and customers through another channel that the account was compromised. That warning matters because an impostor may continue using old chats or group memberships to ask contacts for money.
If the phone suddenly loses mobile service without a clear reason, the owner should contact their network provider promptly through an official channel and check whether an unauthorised SIM replacement or call-forwarding change has taken place. They should also review financial accounts for activity they did not authorise and alert their bank or mobile-money provider if necessary.
Econet has been sharing its security reminders across customer communication channels, while the police case demonstrates the potential financial consequences when phone-number security and account access are both compromised. The basic precautions are straightforward: protect the registration code, add a second layer of verification, remove unknown linked devices and verify urgent requests before sending money. A few minutes spent checking settings can make it harder for a scammer to turn a trusted WhatsApp account into a tool for fraud.