Zimbabwe Government: Probe Launched Into WhatsApp Account Takeovers

The Government of Zimbabwe recently launched an investigation into an unprecedented wave of WhatsApp Business account takeovers reported in recent weeks, with Minister of Information Communication Technology, Postal and Courier Services Tatenda Mavetera confirming the probe.

The investigation involves a coordinated effort between the Ministry, the relevant mobile network operator, the Zimbabwe Republic Police's cybercrime division, and Meta, the parent company of WhatsApp. The primary concern is that criminals might be exploiting compromised accounts connected to Meta's advertising services and associated payment arrangements, potentially leading to financial fraud or unauthorized transactions. Investigators are examining various potential causes, including the involvement of SMS termination partners, commonly known as aggregators, and vulnerabilities within the affected platforms' systems. Minister Mavetera emphasized that the investigation is ongoing, and evidence is still being gathered to establish responsibility, with active engagement with Meta to support account protection and recovery efforts.

This government-led probe signifies a critical development in Zimbabwe's approach to cybersecurity and digital commerce, highlighting the increasing vulnerability of businesses and individuals to sophisticated cyber threats. The involvement of multiple state actors and an international tech giant like Meta underscores the complex, multi-jurisdictional nature of modern cybercrime and the necessity for collaborative responses. For practitioners, this signals a heightened regulatory focus on digital security and data protection, potentially leading to new guidelines, enforcement actions, or amendments to existing legislation, such as the Cyber and Data Protection Act [Chapter 11:22], to better safeguard digital assets and consumer financial information.

The legal context of this investigation primarily falls under the ambit of cybercrime legislation, particularly provisions related to unauthorized access to computer systems, data breaches, and online fraud, which are addressed by the Cyber and Data Protection Act. The Zimbabwe Republic Police's cybercrime division's involvement indicates a criminal investigation, while the Ministry of ICT's role points to regulatory oversight and policy development aimed at protecting the digital economy. Key parties include the Government of Zimbabwe, represented by Minister Tatenda Mavetera, the Ministry of Information Communication Technology, Postal and Courier Services, the Zimbabwe Republic Police's cybercrime division, Meta, and the affected mobile network operators and SMS aggregators under scrutiny.

Attorneys should proactively advise businesses and individuals in Zimbabwe to immediately enhance their digital security practices, particularly for WhatsApp Business accounts. This includes implementing robust two-factor authentication, regularly reviewing linked devices, and diligently monitoring advertising activity and payment transactions for any suspicious behavior. Legal professionals must closely monitor the progress and findings of this investigation for any forthcoming regulatory changes, new compliance requirements, or official advisories from the Ministry of ICT or other relevant authorities. This incident serves as a stark reminder of the paramount importance of robust cybersecurity measures and continuous vigilance against evolving digital threats in the rapidly expanding digital landscape.