Zimbabwe gives telecoms 30 days to tackle WhatsApp hacking

Government has given telecommunications operators, regulators, law enforcement agencies and digital platform providers 30 days to establish a coordinated response to WhatsApp account hacking and digital fraud amid growing concerns over the impact of cybercrime on businesses and individuals.

Information Communication Technology, Postal and Courier Services Minister Tatenda Mavetera issued the ultimatum on Wednesday during the National Cybersecurity Conference and Expo in Harare, calling for a joint protocol to speed up the reporting, investigation and recovery of compromised accounts.

The conference was organised by Business Times in partnership with the ministry.

The directive follows a wave of WhatsApp Business account takeovers that have affected businesses and individuals, exposing vulnerabilities in digital platforms increasingly used for customer engagement, marketing and commercial transactions.

Mavetera said the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), telecommunications operators, law enforcement agencies and platform providers must agree on a coordinated mechanism for handling reported incidents within the stipulated 30 days.

The proposed protocol will establish clear reporting channels, urgent referral mechanisms, procedures for preserving digital evidence and practical assistance for recovering compromised accounts. It will also strengthen safeguards around SIM-card replacements and introduce clear channels for referring suspected financial fraud cases.

She said the success of the initiative would be measured by how quickly victims received assistance and compromised accounts were recovered, rather than simply having reporting procedures in place.

Mavetera warned that WhatsApp account takeovers posed serious economic and social risks, particularly for small businesses that depend on the platform to reach customers and conduct transactions.

"For an entrepreneur, a WhatsApp Business account may be a shopfront and the principal link to customers. A compromised personal account can expose families and friends to impersonation and fraudulent requests for money. These incidents threaten livelihoods, privacy and public trust," she said.

The minister said suspected hacking incidents required coordinated investigations, practical assistance for victims and communication based on verified findings.

She added that technical evidence should establish how accounts were compromised and identify the corrective measures required to prevent similar incidents.

The 30-day deadline comes as Zimbabwe awaits Cabinet approval of its National Cyber Security Strategy, which is expected to provide a national framework for strengthening cyber resilience, protecting critical digital infrastructure and improving the country's capacity to respond to emerging threats.

Mavetera said the strategy was in the final stages of approval through Cabinet committee processes but emphasised that cybersecurity responsibilities should continue to be implemented while the policy awaited formal adoption.

POTRAZ director-general Gift Machengete also highlighted the importance of protecting personal and institutional data, saying cybersecurity safeguards must extend to citizens, businesses, government systems and critical infrastructure.

He called for stronger enforcement of requirements governing the lawful processing of personal information, protection of data-subject rights, information security and cross-border data transfers.

Machengete said data protection was central to national cybersecurity and sovereignty, particularly as information increasingly moved across digital platforms and international borders.

He further urged organisations to comply with statutory requirements for reporting and responding to data breaches, warning that institutions needed to understand and observe the applicable reporting timelines.