Zimbabwean business owners are reporting suspicious account takeovers, including cases where users say they never shared verification codes.

WhatsApp Business has become an important tool for Zimbabwean entrepreneurs, from online shops and retailers to service providers who use the platform to communicate with customers and receive orders. But recent reports of account takeovers are raising concerns about the security of business accounts.

Some affected users say they lost control of their accounts without sharing their one-time passwords (OTPs). Others describe sudden changes to account recovery details and unusual AI bot activity after an account has been compromised.

The reports raise questions about how attackers are gaining access and what happens to a business when its main customer communication channel falls into the wrong hands.

For a small business that relies on WhatsApp to receive orders, confirm payments and maintain customer relationships, losing an account can disrupt operations and expose customers to fraud.

Business accounts face a different kind of risk

A compromised personal WhatsApp account can be used to impersonate an individual and ask friends for money. A compromised business account can have a much wider impact.

An attacker may be able to contact existing customers, impersonate the business, request payments to fraudulent accounts or send malicious links to people who trust the brand.

Customers may have little reason to suspect anything is wrong. If they have been communicating with a shop through the same WhatsApp number for months, an unexpected payment request may appear legitimate.

The danger is particularly significant for Zimbabwean businesses that advertise products on Facebook, direct customers to WhatsApp and complete most of their sales conversations there.

An attacker who gains control of such an account could exploit an established customer base without needing to build trust from scratch.

Users say some accounts are being hacked without sharing OTPs

The familiar WhatsApp scam involves convincing a victim to share the six-digit verification code sent when someone attempts to register their phone number on another device.

However, some users reporting recent incidents say they did not share an OTP with anyone.

That does not necessarily mean WhatsApp's security has been bypassed. Account takeovers can happen through several routes, including unauthorised linked devices, SIM swap fraud, malicious applications or access to a device that was already trusted.

The distinction matters because a business owner who believes that keeping verification codes private is enough may overlook other ways an account can be compromised.

Business owners should check their linked devices, review unexpected security notifications and investigate unexplained changes to their accounts rather than assuming every incident follows the same method.

Changed recovery details raise concerns

Another worrying detail in some account takeover reports is the apparent speed with which attackers change account recovery information.

When an attacker gains sufficient access, changes to security settings can make it harder for the legitimate owner to recover the account. A business owner may discover that the email address or verification settings associated with the account have changed.

The exact sequence matters. A changed recovery email does not, by itself, establish how the attacker gained access, and a compromised email account may create additional recovery problems.

Businesses should secure both their WhatsApp accounts and the email addresses associated with their recovery options.

Reports of AI bots add another layer of concern

Some users have also described unusual automated activity after an account takeover, including reports of AI bots being attached to compromised accounts.

However, if an unknown device or automated system has been linked to a business account, the owner needs to establish what access it has and whether it is sending messages without permission.

An attacker with access to a business account could use automation to contact customers at scale, making suspicious messages appear to come directly from the business.

What Zimbabwean businesses should do now

Business owners should start by checking Linked devices in WhatsApp. Any unfamiliar session should be logged out immediately.

They should also enable two-step verification, configure a recovery email where available and set up a passkey if the feature is supported on their account and device.

Keep WhatsApp Business updated through the official app store. Avoid unofficial versions and applications that promise extra features but may expose account credentials.

Be cautious when scanning QR codes or entering device-linking codes. A website promising votes, prizes or business verification should never be allowed to connect a device to your account unless you initiated the process and understand what you are authorising.

If your phone suddenly loses mobile network service, contact your mobile operator to check for possible SIM swap fraud.

Businesses should also establish a backup communication channel. A second phone number, a website displaying official contact details or another verified social media account can help customers confirm payment instructions if the primary WhatsApp account becomes unavailable.

Most importantly, customers should be told never to trust an unexpected change in payment details without independently confirming it.

What to do if your business account is taken over

If you lose access to WhatsApp Business, attempt to register your number again through the official application and follow the account recovery instructions.

If the attacker has changed security settings, follow WhatsApp's official recovery process rather than paying strangers who claim they can restore the account.

Contact your mobile operator if you suspect a SIM swap. Notify customers through another channel that the business account may be compromised, and warn them not to send money or follow suspicious links.

If customers have lost money, preserve messages, transaction references and other evidence, then report the incident to the relevant financial service provider and the police.

Businesses cannot afford to ignore the warning signs

WhatsApp Business is more than a messaging application for many Zimbabwean entrepreneurs. It is their shopfront, customer service desk and sales channel.

The recent reports of unexplained account takeovers deserve closer investigation, especially where users describe changed recovery details or unusual automated activity.

For now, business owners should review their security settings and linked devices before an incident occurs. Customers should also verify unexpected payment requests through a separate channel.

If the reported incidents share a common method, establishing that pattern will be important for helping businesses protect themselves. Until then, the safest approach is to treat unexpected account activity seriously without assuming that every case has the same cause.