NEWS | Who is hijacking Zimbabwe’s WhatsApp accounts? Nightmare as serving MP and entrepreneurs lose access HARARE – A serving Zimbabwean MP has lost control of his WhatsApp account as entrepreneurs and other users report being locked out of their accounts, raising fresh questions about the security of a platform increasingly used to run businesses, handle customer communications and share sensitive information. “Just lost my Econet WhatsApp in the morning,” Charlton Hwende wrote on X, disclosing that his account was linked to the mobile network. He said an Econet employee who assisted him told him she had also lost her number the previous month. The reports have put WhatsApp Business users under particular scrutiny, with some saying they were locked out despite having two-factor authentication enabled. Entrepreneur Kudakwashe Musasiwa said he had not clicked suspicious links or shared verification codes yet still lost access to his account. Musasiwa said the problem stopped after he moved his WhatsApp operations away from Econet-linked numbers. His account has intensified questions about the possible relationship between mobile network services and WhatsApp security, although it does not establish that Econet was responsible for the breach. Other users have described receiving repeated verification codes, ignoring requests to authorise new devices, and subsequently losing access to their accounts. One WhatsApp business user said attempts to recover the account through WhatsApp support had not restored access. But how are the accounts being compromised? Engineer and musician Hillzy suggested that unauthorised call forwarding could be diverting WhatsApp verification calls to attackers. ICT commentator KloudCoder raised concerns about the security of one-time passwords and called on the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) to address the reports. Neither explanation has been independently established. The potential consequences are significant. A hijacked account can allow criminals to impersonate its owner, approach customers under a trusted identity, and solicit money from unsuspecting contacts. For businesses that depend on WhatsApp to manage transactions and customer relationships, losing control of an account can also disrupt operations and expose sensitive information. The risks have also reached workplace communications. ZiFM Stereo News experienced an apparent account takeover involving an internal WhatsApp group, where an unfamiliar profile using a United States number and a colleague’s identity details gained access before being removed. The incidents raise pressing questions for Econet, other mobile network operators, WhatsApp, POTRAZ, and law enforcement. Are the reported takeovers connected? Could weaknesses in account verification or telecommunications services be exploited? What investigations are under way, and what protection is available to customers whose accounts have been compromised? With a serving legislator among those affected, the reports demand a clear technical explanation. Establishing how the accounts were taken over, whether the incidents share a common cause, and whether any security failures occurred will be critical to protecting users from further account losses, impersonation, and financial fraud. Reporting by Anesu Masamvu