Econet Wireless Zimbabwe has urged customers to take immediate steps to protect their WhatsApp accounts as hackers and social-engineering scammers increasingly target mobile users with messages, fake promotions and requests for confidential security details.
The company is advising customers to review the login and security settings on their WhatsApp profiles, enable WhatsApp Passkeys and activate two-step verification. The measures are intended to give users an additional layer of protection and help them recover their accounts if criminals attempt to take them over.
“We urge customers to proactively secure their WhatsApp accounts by selecting the login and security settings on their WhatsApp profile, and enabling WhatsApp Passkeys as well as activating the two-step authentication (or verification) on their account.
“This ensures an added layer of security for their WhatsApp account, so that in the case of an attempt to compromise or hijack their account, the customer can recover it,” the company said.
Econet has been distributing the warning through several channels over the past few days. The guidance has appeared on Facebook, Instagram, X, formerly known as Twitter, and the company’s website. Customers have also received safety messages by SMS.
The campaign comes as scammers use increasingly familiar methods to persuade people to surrender access to their accounts. In one scheme circulating in Zimbabwe, a victim receives a message from a friend or relative whose WhatsApp account may already have been compromised. The sender claims that a verification code was sent to the wrong number and asks the recipient to forward it.
The message can appear harmless, particularly when it comes from a known contact. It may read: “Sorry, I accidentally sent my WhatsApp code to your number. Can you forward it to me?”
Soon afterwards, the target receives a genuine six-digit verification code by SMS. The code is generated because the criminal is trying to register the victim’s telephone number on another device. If the victim forwards the code, the criminal can log into the account, lock out the legitimate user and begin contacting the person’s friends, relatives and business connections.
Once control has been obtained, the compromised account becomes a tool for further fraud. The criminal can impersonate the owner, ask contacts for money, circulate fake investment opportunities or repeat the same verification-code trick against other people. A single compromised account can therefore expose a wider network of users.
The danger is particularly serious in Zimbabwe, where WhatsApp is used for family communication, business dealings and financial transactions. A person who loses access may not only be unable to communicate with contacts, but may also find that criminals are using their identity to request money or obtain more personal information.
Econet’s safety messages tell customers never to share verification codes or security PINs with anyone, regardless of who the person claims to be. Customers are also being urged to check the list of linked devices regularly and remove anything unfamiliar. WhatsApp should be kept updated with the latest software releases and security patches.
The company has also told users to inspect their call-forwarding settings and disable any forwarding they did not authorise. Customers have been warned not to dial unverified codes beginning with an asterisk or double asterisk. They should not scan unknown QR codes, particularly WhatsApp pairing codes displayed on third-party websites or unfamiliar screens, and should log out of WhatsApp Web sessions that are no longer in use.
Other advice focuses on the pressure tactics used by scammers. Messages that create a sense of urgency or demand confidential information should be treated with caution. Suspicious links should not be opened even when they appear to have come from a trusted contact. Requests for money, account information or verification codes should be checked by calling the person directly before any action is taken.
The WhatsApp warning follows a series of scams involving Econet’s mobile-money service, EcoCash. In January, customers were targeted through fake websites and online promotions advertising unusually cheap data bundles and instant loans. Some of the fraudulent offers used Econet branding or claimed to be “Powered by Econet”. Others used names associated with popular services and promised data bundles or loans at prices that appeared difficult to resist.
The scam websites asked users to enter their mobile numbers, EcoCash PINs and one-time passwords sent to their phones. With those details, criminals could attempt to register or access the EcoCash application and take control of the wallet. Money could then be transferred or withdrawn quickly.
The episode prompted a voice note to circulate on WhatsApp warning people not to use EcoCash or keep money in their wallets because the service had supposedly been hacked. Econet and EcoCash rejected that claim. “The EcoCash platform was absolutely NOT hacked,” the company said, while maintaining that EcoCash remained “safe, secure and convenient”. Customers were warned not to disclose their PINs or one-time passwords.
Econet also encouraged customers to update the EcoCash application after reports that scammers were taking advantage of a feature that could allow a customer to log in on a device without an Econet SIM card present. The company said it had introduced security enhancements and continued to run awareness campaigns about fake websites, suspicious links and the sharing of account details.
The same pattern was reported in Bulawayo in April, where residents were targeted with fake offers for free data bundles, gift vouchers and soft loans. The websites demanded registration fees of between US$5 and US$10 before asking for phone numbers, national identity numbers and EcoCash account information. After victims paid, some sites became inaccessible and the promised services or refunds did not arrive.
Bulawayo police spokesperson Inspector Nomalanga Msebele said the fraud cases were increasing and were increasingly targeting people looking for affordable internet access.
“On EcoCash-related fraud cases, we are dealing with criminals who are setting up fake websites that pretend to offer services such as free data bundles, gift vouchers, or even soft loans. These platforms are designed to look genuine, but their aim is to deceive members of the public,” she said.
“They usually demand a so-called registration fee, then proceed to request personal details such as phone numbers, national ID numbers, and EcoCash account information. We want the public to clearly understand that these are not legitimate services.”
Police said some of the websites were near-perfect copies of official company pages. One Bulawayo resident said he had been attracted by an advert promising 30GB of data for US$5. The page carried Econet logos and comments from people claiming to have received the data. After he paid and entered his details, the website stopped opening.
Another resident said she paid US$5 after being promised a loan or other benefits, then was asked for another US$10 to upgrade to a premium package for a larger loan. The website stopped working the following day.
The cases show how the latest WhatsApp warning is connected to a broader fraud environment. Criminals do not always need to break into a telecommunications or payment platform. They can instead copy familiar logos, exploit a trusted relationship, create pressure with a limited-time offer or urgent request, and persuade users to hand over the information that protects an account.
Econet’s advice is for customers to slow down when a message demands immediate action. Users should open security settings directly rather than follow links sent in messages, keep their devices and applications updated, and confirm unusual requests by voice call. They should also treat a verification code as private security information, not as something that can be passed to a friend, company representative or anyone claiming to be assisting with an account.
Customers who notice unfamiliar linked devices, unauthorised call forwarding, unexpected account activity or messages sent from their account should act quickly and contact the relevant service through official channels. The central warning from Econet is simple: a trusted name, familiar logo or message from a known contact does not prove that a request is genuine.
With WhatsApp and mobile-money services now central to everyday communication and payments, protecting the phone number and the security codes linked to it has become essential. Two-step verification, Passkeys, careful checking of linked devices and refusal to share PINs or one-time codes can prevent a deceptive message from becoming a stolen account or an empty wallet.