Zimbabwe government launches massive investigation after hacking of thousands of Whatsapp accounts across Zimbabwe

Authorities are examining how users lost access to accounts and whether personal or financial information was exposed. No verified national total of affected accounts has been released.

Zimbabwe’s government has launched a multi-agency investigation into reported WhatsApp Business account takeovers, as businesses and individuals describe losing control of accounts used to communicate with customers, colleagues and family.

Information and Communication Technology, Postal and Courier Services Minister Tatenda Mavetera said the reports called for a coordinated response. The inquiry is examining how the accounts were accessed and whether personal details, advertising services or payment arrangements connected to the platform were affected.

“The scale of the reported attacks is unprecedented and requires a coordinated response to protect our citizens and businesses,” Mavetera said.

The investigation brings together the ministry, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the Zimbabwe Republic Police Cyber Crime Division, an affected mobile network operator and Meta, which owns WhatsApp. The government is engaging the operator and Meta while investigators examine how the reported account compromises took place.

Authorities are looking at the handling of SMS verification messages, including the possible role of SMS termination partners, commonly known as aggregators, as well as the systems used by the platforms. Investigators are also examining whether accounts linked to Meta advertising services and payment arrangements were involved, and whether unauthorised activity exposed financial information or led to transactions.

“Investigations are examining all relevant angles, including the potential role of SMS termination partners, commonly known as aggregators, and the platform systems which are concerned,” Mavetera said.

The minister said the cause had not been established. “This remains a line of inquiry and evidence must establish responsibility,” she said. Authorities have not confirmed that a mobile network or Meta system was breached. A comprehensive statement from the affected operator is expected, while the government’s engagement with Meta is continuing.

There is also no verified national figure showing how many accounts have been taken over. Reports from users describe losses of access, but the scale of the problem cannot yet be measured from a confirmed public total. The investigation is focused on finding out what happened, how accounts were accessed and what information or services may have been affected.

For many small businesses and informal traders, WhatsApp is an everyday route to customers. Sellers use it to display products, answer questions, take orders and arrange payments. When a business account is taken over, the person controlling it may be able to pose as the owner and contact customers using a familiar name and number.

That can turn an account compromise into a financial risk for people who have never met the attacker. A message asking for an urgent payment may look as though it has come from a trusted trader, relative or colleague. Customers may also be left uncertain about whether previous instructions, payment details or offers sent from the account were genuine.

The immediate concern for investigators is whether the reported takeovers involved access to linked business tools, advertising accounts or payment arrangements. Mavetera has urged users and businesses to review linked devices, advertising activity and transactions for anything they do not recognise. Anyone who finds a suspicious charge should contact their bank or relevant financial service provider promptly.

SIM replacement fraud has featured in earlier police warnings

The current investigation comes after the Zimbabwe Republic Police described a separate fraud case involving SIM replacements and WhatsApp account takeovers. In a press statement dated October 21, 2025, police said they were seeking a person in connection with several cases involving fraudulent SIM replacements and reported losses of USD 17,009.50 and ZWG 30,665,912.30.

Police said the suspect allegedly obtained victims’ personal information and used it to impersonate them when contacting mobile service providers to request replacement SIM cards. Once a replacement SIM was activated, the victims’ phone service was disconnected. The police statement said access was then gained to personal information and financial services, while WhatsApp accounts were used to ask victims’ contacts for money.

That earlier case is distinct from the investigation now under way. It nevertheless shows why the authorities are examining how mobile-number authentication and account recovery are handled. A SIM replacement can place calls and messages intended for the legitimate number holder into another person’s hands, while a successful account takeover can give criminals a way to approach the victim’s contacts under a trusted identity.

Account takeovers can also begin with a trick rather than a technical breach. A user may be persuaded to reveal the six-digit WhatsApp registration code sent by SMS or phone call, or to approve an unfamiliar linked device. Criminals may pose as a friend, customer or support representative and claim that the code is needed to fix an account problem. The code can instead allow them to register the victim’s number on another device.

Econet Wireless Zimbabwe has urged customers to strengthen their accounts by enabling two-step verification or a passkey where available, keeping WhatsApp updated, protecting the phone with a screen lock and checking linked devices. The operator also advises users to keep verification codes private and confirm unusual requests by calling the person through another channel.

WhatsApp users can check Linked devices in the application’s settings and log out of any session they do not recognise. They should never disclose their registration code, PIN or password, including to a person claiming to represent the platform. Business owners can reduce exposure by limiting account access to staff who need it and agreeing a separate method to verify unusual requests for money or changes to payment details.

Anyone who has unexpectedly lost access can follow WhatsApp’s official compromised-account recovery instructions. The process involves registering the same phone number again and entering the six-digit code received by SMS or phone call. WhatsApp says re-registering logs other devices out. If an unfamiliar two-step verification PIN has been set and the user does not know it, the recovery guidance says they may need to wait 7 days before trying again.

After regaining access, users should review linked devices and security settings, then warn contacts through another channel that messages sent during the takeover may not have come from them. Anyone who suspects a SIM replacement should contact their mobile operator immediately. Suspected fraud should also be reported to police, while any affected bank or payment provider should be notified about suspicious transactions.

The government has urged Zimbabweans not to share passwords, PINs or verification codes and to check requests for money independently before paying. The inquiry continues as authorities seek to establish how the reported takeovers happened and whether business or personal financial information was exposed.