Fellow entrepreneurs and business owners, over the past few weeks, and especially this weekend, many Zimbabweans have lost access to their WhatsApp accounts. When we asked our followers about their experiences, the responses showed a clear pattern.
WHAT OUR FOLLOWERS REPORTED:
– WhatsApp Business is the main target: Most affected accounts are WhatsApp Business accounts, although some ordinary WhatsApp users have also been targeted. This may be because businesses publicly display their WhatsApp numbers on social media, websites and adverts, making them easy for hackers to collect
– Econet numbers are the most affected: Most victims are on Econet lines, and several followers reported that their NetOne lines received no suspicious codes at all. This may simply be because Econet is the largest network and therefore has the most WhatsApp users
– Unrequested verification codes come first: Victims receive repeated WhatsApp verification codes (OTPs) and messages saying their account is being registered on a new device. Some received these for days or weeks before losing access
– Victims did not share their codes: Apart from a few phishing cases (fake scholarship adverts, prize links and callers asking for codes), most victims never clicked a link and never shared a code
– Codes are not reaching victims: Some users report that WhatsApp SMS and call codes stopped reaching their own phones
This points to something beyond ordinary social engineering. In most cases, the hackers appear to be obtaining the verification codes without the account owner’s involvement. There is suspicion that the hackers are intercepting the WhatsApp SMS verification codes being sent to Econet numbers, though this has not been confirmed by WhatsApp or Econet.
THE DETAIL MOST PEOPLE ARE MISSING:
If your account does not have two-step verification, the damage is far worse than simply being logged out.
STEP 1: The Takeover
– The hacker logs into your account using the stolen verification code
STEP 2: The Lockout
– The hacker switches on two-step verification with a PIN or password that only they know
– They may also add their own recovery email address
STEP 3: Your Recovery Attempt
– You try to log back in using an SMS code
– WhatsApp asks for the two-step verification PIN or password
– You do not know it because the hacker set it
STEP 4: The 7-Day Wait
– You have to wait 7 days before WhatsApp allows you to reset it
– For a business, this means lost orders and missed customer enquiries
– Meanwhile, the hacker may use your account to ask your customers and contacts for money
WHAT HAPPENS IF YOU HAVE TWO-STEP VERIFICATION:
If you have already set up two-step verification with your own PIN or password, the hacker can still cause disruption, but they cannot take over your account.
– The hacker can log you out: If they obtain your SMS verification code, WhatsApp may log you out of your phone
– The hacker cannot fully log in: WhatsApp then asks them for your two-step verification PIN or password, which they do not know
– The hacker cannot reset your PIN or password: The reset link goes to your recovery email address, not theirs
– You can log back in: Verify your number again with an SMS or call code, then enter your own PIN or password to regain access
– Your chats and contacts remain protected: The hacker never reaches your messages, groups or customers
Being logged out is frustrating, but it is a minor inconvenience compared to losing your account for 7 days. This is why two-step verification is so important. To keep this protection strong, make sure your recovery email account is also secure.
PHISHING AND WINNING SCAMS:
Not every hijacked account is the result of intercepted codes. Some of our followers lost their accounts, and their money, to phishing and winning scams. These attacks trick you into handing over your verification code or clicking a link that steals your details.
Common scams reported by our followers:
– Fake prize and competition messages: “Congratulations, you have won” messages for competitions you never entered, with a link to “claim your prize”
– Fake scholarship adverts: Adverts using the names of real universities, offering scholarships through a link
– Fake booking confirmations: Messages asking you to click a link to confirm a hotel reservation you never made
– Fake group or membership codes: A caller claims they sent you a “membership code” for a group you joined and asks you to read it back to them. That code is your WhatsApp verification code
– Fake investors: People posing as investors who say “you will receive an OTP” and ask you to share it
– Hijacked friends asking for money: Once an account is taken over, the hacker messages the owner’s contacts and groups asking for urgent loans or payments
How to protect yourself:
– If you did not enter a competition, you did not win it
– Never click links promising money, prizes, scholarships or bookings you did not request
– No genuine organisation will ever ask you for your WhatsApp verification code
– If a friend asks for money on WhatsApp, call them on a normal phone call to confirm before sending anything
– If an offer sounds too good to be true, it is a scam
PROTECT YOURSELF – GOLDEN RULES:
RULE #1: Turn On Two-Step Verification
Go to Settings > Account > Two-step verification and set it up. New activations now require a password, as WhatsApp is moving from 6-digit PINs to passwords. Older activations may still use a 6-digit PIN. Either way, choose one that you will remember and that no one else can guess.
RULE #2: Add a Recovery Email Address
This allows you to reset your PIN or password quickly instead of waiting 7 days.
RULE #3: Check Your Linked Devices
Go to Settings > Linked devices and log out of any device you do not recognise. A hacker on a linked device can read your messages without logging you out.
RULE #4: Ignore Unrequested Codes
If you receive a WhatsApp code or a new-device registration prompt that you did not request, ignore it. If the prompt appears inside the WhatsApp app, dismiss it. Do not enter the code anywhere and never share it with anyone, including people claiming to be from WhatsApp, Econet, a bank or a group admin.
RULE #5: Keep Your Phone Connected to the Internet
When your phone is online, WhatsApp can send verification prompts through the app instead of by SMS, which makes the code harder to intercept.
THE GOLDEN PRINCIPLE:
“Set your own two-step verification PIN or password before a hacker sets one for you.”
IF YOUR ACCOUNT HAS BEEN HIJACKED:
1. Re-register immediately – Open WhatsApp, tap Log back in, then Continue, and enter your full international phone number if prompted. Enter the 6-digit code you receive by SMS, or request it by phone call if the SMS does not arrive. Once you enter the code, all devices logged into your account, including the hacker’s, are automatically logged out
2. Warn your customers and contacts – Use another number or your social media pages to tell people not to send money or respond to requests from your account
3. Wait out the 7 days if necessary – If the hacker set a PIN or password, request the reset after 7 days, then set up your own two-step verification and recovery email straight away
4. Report to WhatsApp only as a last resort – Always try to recover your account using the steps above first. WhatsApp warns that if you report a compromised account you are trying to recover, it might ban the account, and you could lose access to your account and data
REMEMBER:
– Unrequested codes = someone is trying to register your account
– No two-step verification = hacker can lock you out for 7 days
– Recovery email = faster recovery
– Unknown linked device = someone may be reading your messages
– Requests for codes = always a scam
Two-step verification will not stop every attack, but it is the difference between being logged out for a few minutes and losing your account for a week. If you use WhatsApp, set it up today.
With respect for your daily grind,
ZimLedger Admin
ZimLedger
ZimLedger is the all in one business and finance platform for Zimbabwe. It generates quotes, invoices, payslips and financial statements, manages business ledgers, tracks income and expenses, and builds shopping lists. ZimLedger offers a simple yet powerful solution tailored to local needs. Whether you are budgeting in ZiG or USD, managing business accounts, converting Ecocash statements, or tracking household expenses, ZimLedger empowers you to stay organised, make informed financial decisions, and grow your wealth—right from your phone or computer.
