An urgent WhatsApp request from a familiar contact used to mean a relative needed help. These days, it may mean a stranger has borrowed their identity — with every intention of borrowing your money permanently!
Zimbabwe’s investigation into reported WhatsApp Business account takeovers has highlighted a wider international problem, with criminals exploiting the messaging service to impersonate users, solicit money and even spread malicious software.
Reports from Malaysia, the Cayman Islands and several other countries have prompted investigations and security warnings, although there is no confirmed evidence linking the incidents to a single coordinated global attack.
In Zimbabwe, ICT, Postal and Courier Services Minister Tatenda Mavetera says the Government is investigating reported account takeovers and possible security breaches involving Meta platforms or intermediary aggregators, including whether users’ financial information has been compromised.
Her ministry is engaging Meta, the affected mobile operator and the Zimbabwe Republic Police’s Cyber Crime Division. Investigators are examining platform systems, SMS termination partners, advertising accounts and payment arrangements. Responsibility, she said, would be established through evidence.
For its part, Econet Wireless, the biggest mobile operator in the country, along with the police, have separately been warning the customers and the public about criminals hijacking WhatsApp accounts and impersonating their owners to request money from friends, relatives and business associates.
The familiar profile picture remains. But the person behind it may have changed.
Police said some cases involved fraudulently obtained SIM cards used to access victims’ accounts. Econet has urged customers to enable two-step verification and passkeys, protect verification codes and review linked devices.
No verified national figures currently establish how many Zimbabwean users have been affected. But the attacks are not confined to Zimbabwe.
In Malaysia, the Communications and Multimedia Commission opened investigations last month following complaints about hacked, suspended or inaccessible WhatsApp accounts.
National news agency Bernama reported that the regulator had received 92 complaints by September 30 and requested a comprehensive explanation from Meta. Cases were also referred to the company for investigation.
In the Cayman Islands, police warned on October 1 that fraudsters were stealing the six-digit verification codes used to register WhatsApp accounts. Once inside, criminals posed as account holders and appealed to their contacts for urgent financial assistance. Police urged residents never to disclose verification codes, even to anyone claiming to represent WhatsApp.
A verification code is effectively a key to your account. Handing it to a stranger is unlikely to end with a thank-you note.
A separate campaign uncovered by cybersecurity company Kaspersky showed how criminals were distributing malicious files through WhatsApp Desktop and WhatsApp Web.
Research published on June 22 identified affected users in Brazil, India, Singapore, the United Kingdom, Mexico, Spain, Taiwan, Australia, Russia, Vietnam and Malaysia. Malaysia recorded the highest number of observed victims.
These incidents involve different methods.
Zimbabwean and Cayman Islands warnings concern account hijacking and impersonation; Malaysia’s September inquiry covered compromised and inaccessible accounts; the June malware campaign targeted computers through attachments.
Their common ingredient is trust: a recognisable name, a familiar photograph or a document arriving from an apparently known contact.
For Zimbabwean users, the precautions are straightforward: secure accounts, keep verification codes private, avoid suspicious attachments and independently confirm requests for money.
Before responding to an urgent appeal, call the person using a known number. A brief conversation may save both your money and an awkward discussion about a loan your relative never requested.
Cooperation among technology companies, mobile operators, regulators and law enforcement agencies remains essential. So does public awareness, particularly for people who depend on WhatsApp for business and family communication.
The humour ends where the losses begin. A familiar account is no guarantee of a familiar sender.
