Zimbabwe Probes Wave of WhatsApp Business Account Takeovers

The Zimbabwean government says it is investigating reports that WhatsApp Business accounts were taken over by people who should not have had access to them. According to the Herald, the probe was announced on national television and covers whether users' financial information was compromised. The reports surfaced on 13 and 14 October 2026, and some business owners said they never shared their verification codes.

The minister said the scale of the incidents was unprecedented. According to allAfrica, Mavetera described the reported attack as requiring a coordinated response to protect citizens and businesses. The investigation brings together the ministry, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the Cyber Crime Division of the police, the affected mobile network operator and Meta, the company that owns WhatsApp. Reports on the probe say investigators are looking at SMS verification messages and at SMS termination partners, which carry messages between networks and are often called aggregators.

What the probe is looking at

The government has not assigned responsibility. Mavetera has said that evidence must establish where the fault lies. Reporting from 263Chat quotes her saying that the government was engaging Meta to help establish what happened and to support account protection and recovery.

Authorities are also concerned about accounts linked to Meta's advertising services and the payment arrangements attached to them. According to the Herald, officials are examining whether those links allowed unauthorised transactions. No verified national total of affected accounts has been published, according to Ghanamma, so the number of businesses hit is not yet known.

Why this matters for businesses that automate work

Many businesses in Zimbabwe use WhatsApp as a sales counter. Sellers post products, take orders and ask customers to pay. When an account is taken over, the person in control can write to customers with a familiar name, number and photo. A request for an urgent transfer may look genuine because it comes from a known contact.

Automation raises the stakes. A business that sends order confirmations, payment reminders or stock updates through a WhatsApp Business account has a process that trusts that account. If someone else controls the login, the automated messages can carry their instructions too. The automation does not make the account more secure. It can make a takeover reach customers faster.

What changes in practice for a business that automates work

Start with the login. Two-step verification adds a PIN that a stolen code alone cannot satisfy. Officials have also urged users to review account access, linked devices, advertising activity and payment transactions. Do this review on a fixed schedule and write down who does it.

Next, separate approval from messaging. If an automated system sends a payment request, a person should confirm the amount and the recipient through a second channel, such as a phone call to a known number. This is the step officials have asked users to take before making any payment. An automated system can prepare the request. A person should still approve the money moving.

Keep a list of which accounts, numbers and payment links each automated process uses. In a takeover, that list tells you what to suspend first. A business with five staff can keep it in a single document. A group with thousands of staff will need an owner for each account and a named person who can revoke access.

Finally, agree a script for customers. If an account is compromised, a short message from a second channel should tell customers not to pay any request from the old number until confirmed. Several of the advice items in circulation point the same way: a user who suspects a compromise should contact the bank where money is involved, follow the platform's recovery steps and report the matter to the police and the mobile operator.

Limits of automation here

Automation cannot stop a person from giving away a verification code. It also cannot tell whether a payment request was sent by the owner or by an attacker. If a business sends payments from a messaging channel with no human check, a takeover can turn into a loss in one afternoon. For some small traders who take a handful of orders a week, a manual process with a phone call may be safer than a fully automated one. Automation is worth the effort once the volume of messages makes manual checks impractical, and only after the account has two-step verification and a named approver.

What to watch next

Three things will shape the next steps. The first is the statement the mobile network operator was expected to issue, which officials said would give the government's account of its role. The second is what Meta reports about the accounts, including any change to account recovery. The third is whether the police or the regulator publish a verified count of affected accounts or any charges. Until those arrive, the government says it will keep sharing verified information as the investigation moves forward.