By 
By Ross Moyo
As social engineering and sim-swap linked WhatsApp hijackings surge across Zimbabwe, Econet says 90 percent of cases are preventable with simple security steps.
Econet Wireless Zimbabwe, the country’s largest mobile network operator with over 10.2 million active subscribers, has issued a fresh, urgent warning to mobile users across the country to secure their WhatsApp accounts as hackers intensify a sophisticated wave of social engineering scams.
The warning comes amid a sharp rise in account hijackings in the last six months, where criminals take over a victim’s WhatsApp account and then use it to defraud their contacts, solicit money, and spread malicious links.
“We once again urge customers to protect themselves by proactively securing their WhatsApp accounts by selecting the login and security settings on their WhatsApp profile, and enabling WhatsApp Passkeys, as well as activating the two-step authentication (or verification) on their account,” an Econet spokesman said.
The company said this way, customers ensure an added layer of security for their WhatsApp account, significantly reducing the risk of their accounts being hijacked, and in the case where a customer’s account has been compromised, they are able to recover it.
Zimbabwe: a WhatsApp nation under attack
Zimbabwe is one of the most WhatsApp-dependent economies in the world. According to Potraz, WhatsApp accounts for over 34 percent of all mobile internet data usage in Zimbabwe. For millions, WhatsApp is not just a messaging app, it is the bank, the marketplace, the newsroom, and the office.
That dominance is exactly what scammers are exploiting.
Cyber-security analysts say the current scam wave has three distinct attack vectors.
First is the verification code theft. A victim receives an sms or call claiming to be from Econet, WhatsApp, or even a friend saying “I mistakenly sent you a 6-digit code, please send it back.” That code is actually the WhatsApp registration code. Once shared, the attacker instantly logs the victim out and takes over the account.
Second is the QR code or linked device hijack. Users are lured to scan a QR code on a fake website promising “Win free data”, “WhatsApp Gold”, or “Check who viewed your profile”. Scanning that QR code is actually authorizing a WhatsApp Web linked device. The attacker can then silently read all messages and send messages as you.
Third is call forwarding diversion, the star 21 scam. Victims are tricked into dialing a code starting with star or double star like star star 21 star or star hash 21 hash under the guise of checking airtime or activating data. In reality, the code forwards all calls to the scammer’s number, allowing them to intercept the voice call verification for WhatsApp.
Once hijacked, the account is weaponized. The attacker messages all contacts: “Ndibatsirei nemari, ndiri mu emergency”, “Please send me 50 usd via InnBucks”, or sends a link saying “Vote for my child in a competition”. Because the message comes from a trusted number, the success rate is extremely high.
Econet’s 10-point security shield
In the recent past Econet has been using multiple channels, including sms, social media, radio, and its YoMix and EcoCash platforms, to share with customers steps that they can follow to strengthen security on their WhatsApp accounts.
The telco has now consolidated them into a 10-point mandatory checklist that every mobile user in Zimbabwe should apply today.
One, enable passkeys and two-step verification. Go to WhatsApp, settings, account, passkeys to create a passkey, and settings, account, two-step verification to set a six-digit pin plus a recovery email address. This is the single most effective protection.
Two, never share codes or pins. Econet, WhatsApp and banks will never ask for your verification code, otp, or two-step pin. Anyone who asks, even if they claim to be from Econet, is a scammer.
Three, audit linked devices. Go to WhatsApp, settings, linked devices. If you see any device you do not recognize, a Windows pc or Chrome browser you never logged in on, tap it and log out immediately.
Four, keep WhatsApp updated. Always run the latest version from Google Play Store or Apple App Store. Updates contain critical security patches that close loopholes used by hackers.
Five, check call forwarding. On your phone dialer, dial hash hash 002 hash to cancel all call forwarding, then check status with star hash 21 hash. If you never set forwarding and it is active, you are under attack.
Six, do not dial unverified ussd codes. Never dial any code starting with star or double star sent to you by an unknown number or on social media.
Seven, do not scan unknown QR codes. Avoid scanning WhatsApp pairing codes on third-party websites, flyers, or unknown displays. And always log out from WhatsApp Web on shared computers.
Eight, beware of urgency. Scammers create panic, “Your account will be blocked”, “Your EcoCash is locked”, “Act now”. Legitimate companies never create that pressure. Pause, breathe, verify.
Nine, avoid suspicious links. Even if a link comes from your mother or boss, if it says http://whatsapp-free-data-2026.com or has spelling errors, do not click. Hover, inspect, and delete.
Ten, verify by voice. If a contact asks for money, account information or verification codes on WhatsApp, call them directly on a normal voice call before taking any action. A 30-second call can save you hundreds of dollars.
What to do if you are already hacked
If you lose access, act fast. Re-install WhatsApp, enter your number, and request the 6-digit sms code. This will log the hacker out. Then immediately enable two-step verification and check linked devices.
If the hacker enabled two-step verification, you will have to wait 7 days to reset without the pin. Alert your family and post on your status: “My account was hacked, ignore any money requests.”
Report the incident to Econet on 121, to WhatsApp via in-app support, and file a report with the Zimbabwe Republic Police Cyber Crime Unit and Potraz.
In a digital economy where one WhatsApp account is linked to EcoCash, bank alerts, and business orders, security is no longer optional. As Econet stressed, enabling passkeys and two-step verification today is the cheapest insurance policy you will ever buy.
Comments