Fraud in 2030 Starts Now: What the Econet WhatsApp Business Hijackings Reveal in the Age of AI vs AI

Based on a presentation at the Mornipac Summer Cyber and AI Summit (theme: AI vs AI), October 2026. Companion to the Fraud in 2030 briefing report and deck.

By Josephine Dhliwayo

NYANGA – IN October 2026 Zimbabwean businesses began losing WhatsApp Business accounts at a scale the ICT Minister called unprecedented. The cause is still unconfirmed. The risks it exposes are not.

OVERVIEW

One incident, five shifts

In the past ten days, Zimbabwean entrepreneurs, a sitting MP and ordinary users have reported losing WhatsApp accounts, many of them on Econet numbers³. In statements reported on 14 October, the ICT Minister, Tatenda Mavetera, called the scale of the reported attack “unprecedented” and said evidence must establish responsibility^{1, 2}. That caution deserves respect: no attack method has been confirmed and no root cause published^{1, 4}.

This article reads the incident through the five shifts in the Fraud in 2030 briefing: from crafted to industrial fraud, from human-operated to agent-operated crime, from “is it real?” to “is it them?”, a quantum deadline for the trust layer, and from arrests to chokepoints. As in the briefing, evidence sourced to October 2026 is kept apart from assessment. Statements about 2030 are labelled and carry no invented statistics.

What is known, and what is not

Reports describe repeated, unrequested verification codes and “new device” prompts, then lockouts, including for users with two-step verification on^{3, 4}. Attackers who get in typically set their own PIN, locking the owner out for seven days⁴. Investigators are examining SMS aggregators and the platforms’ own systems, and checking whether accounts tied to Meta advertising and payment arrangements were compromised; the police Cyber Crime Division is involved¹. Not yet public: the number of accounts taken, any financial loss, and the entry point. Everything below about mechanism is a hypothesis, not a finding.

THREAT EVOLUTION

NXG fraud meets the SIM

The briefing defines NXG fraud by six traits, among them synthetic presence, identity-layer attacks and fraud as a service. Four routes into an account, none confirmed, map onto them.

• Social engineering. The “forward code” trick: a one-time PIN arrives, then a message from a compromised contact asks the victim to pass it on⁵.

• Duplicate SIM. In a January 2026 case reported by Zimbabwe Now, two Harare men allegedly took control of a company’s WhatsApp Business account using a duplicate Econet SIM⁵. INTERPOL warns of synthetic identities used to register SIM cards⁷.
• Diverted codes. Commentators suggest unauthorised call forwarding could redirect voice verification; neither this nor code interception is established^{3, 4}. Aggregators are a stated line of inquiry¹.
• Device linking. In the GhostPairing campaign, victims who entered a pairing code on a fake page made the attacker’s browser a hidden companion device, with no password stolen⁶.

A business account raises the stakes. It lends a criminal a brand’s customer list, payment instructions and, if linked, Meta advertising and payment methods, which is why the Minister asked about advertising exposure¹. Meta’s internal estimates, reported by Reuters, put high-risk scam ads at up to 15 billion a day, and a hijacked Facebook account was among those used to run crypto scams¹⁴. A compromised business account is both a fraud channel and fraud infrastructure.

Autonomous crime: the next operator

The incident looks manual. The direction of travel is not. Anthropic disclosed a state-linked campaign in November 2025 in which AI performed 80 to 90 per cent of tactical work¹⁸. In July 2026 Sysdig documented JADEPUFFER, which researchers believe is the first ransomware operation documented as run end to end by an AI agent; it entered through a known Langflow flaw²⁰. INTERPOL now attributes 55 per cent of reported African cybercrime to AI⁷.

IDENTITY AND TRUST

Digital identity: the number is not the person

Zimbabwe’s WhatsApp economy treats a phone number as identity and an SMS code as proof. The briefing replaces “looks like them” with cryptographic and device-bound signals. Entrust’s 2026 report found deepfakes behind about one in five biometric fraud attempts and a 40 per cent rise in injection attacks, so a voice note or video call is no longer proof¹⁶. Passkeys are among the defences Zimbabwe Now recommends⁵; telecom signals, such as SIM-swap and device-swap checks before money moves, extend the layer. Risk then shifts to enrolment and recovery: the SIM replacement counter and the seven-day reset⁴ become the front line.

Quantum: a deadline for the trust layer

Quantum computers are not an Econet-style fraud tool today. They matter because the TLS links between operators, aggregators and platforms, and the signatures that secure them, rely on public-key cryptography. NIST’s draft IR 8547 proposes deprecating 112-bit-strength RSA and elliptic-curve algorithms after 2030 and disallowing remaining quantum-vulnerable algorithms after 2035²¹. Google’s Craig Gidney estimates RSA-2048 could be factored with fewer than one million noisy qubits, against about 20 million in 2019²². That is an estimate, not a demonstrated attack, and the NIST dates are a draft.

POLICING AND POLICY

From WhatsApp to wallet: the crypto and FATF linkage

Fraud is complete only when value moves out of reach. FATF, INTERPOL and the Egmont Group found that cyber-enabled fraud proceeds move quickly across borders¹⁰. FATF’s seventh targeted update (16 July 2026) says most identified on-chain illicit activity now involves stablecoins and that AI misuse in virtual-asset crime is growing at scale; 83 per cent of surveyed jurisdictions have passed Travel Rule laws, but many have yet to supervise them effectively⁸. Its March 2026 report, citing Chainalysis, puts stablecoins at 84 per cent of illicit virtual-asset volume in 2025 and urges freeze-and-burn capabilities and fast cooperation channels⁹. Chainalysis reports a roughly 1,400 per cent rise in impersonation scams in 2025, and scams using AI are 4.5 times more profitable¹¹. A takeover that yields urgent “help me” payments is the front end of that model.

Zimbabwe’s regulatory answer arrived in June. S.I. 99 of 2026 requires virtual asset service providers to register with the Financial Intelligence Unit, apply the Travel Rule, verify ownership of destination wallets above US$1,000 and report suspicious transactions¹². I am not suggesting that proceeds from this incident reached crypto; that is unknown. The structural point is that the regime reaches registered providers, while wallet-to-wallet transfers and offshore platforms sit at its edge, the gaps FATF flags^{8, 9}.

Policing and liability: from arrests to chokepoints

INTERPOL’s African Cyberthreat Assessment 2026 finds losses more than doubling from US$192 million to US$484 million, and singles out the lack of real-time data sharing between banks, telecoms and law enforcement⁷. Operations work: four of them produced over 1,500 arrests and more than US$100 million recovered⁷. But Europol’s IOCTA 2026 describes a “velocity gap” that traditional policing cannot bridge¹⁷. The briefing’s answer is to police chokepoints, not individuals: SIM replacement outlets, aggregators, platforms and virtual asset providers.

The government’s commitment is public. Opening the Cyber Fraud and AI Summit on 21 October, Minister Mavetera called cybersecurity “a national development priority and a leadership responsibility”, and said the Ministry’s task is to support an environment where citizens “participate safely in the digital economy”²⁴. The Minister singled out telecommunications: operators and financial service providers “must work together to strengthen identity verification, SIM replacement and account recovery procedures”²⁴. Five priorities followed, among them timely threat-information sharing, tested incident response and stronger security for digital identities and payments, with the summit asked to end with “clear actions, identified institutional responsibilities and realistic timeframes”²⁴.

Liability is the other lever. Singapore’s Shared Responsibility Framework, in force since 16 December 2024, makes a telco bear the loss in full when a bank met its duties but the telco did not; those duties include connecting only to authorised aggregators and blocking spoofed sender IDs²³. It covers phishing, not account takeovers, but the principle fits the Zimbabwean inquiry into aggregators.

Domestic law adds a duty. POTRAZ is the data protection authority; controllers must be licensed, appoint a data protection officer and, on one law-firm summary, report breaches to POTRAZ within 24 hours¹³. A hijacked business account full of customer chats is plausibly a personal data breach, so firms should assess their notification duty now.

OUTLOOK

AI against AI

IBM’s 2025 breach study found that extensive AI and automation in security cut average breach costs by about US$1.9 million and shortened the lifecycle by 80 days, yet 97 per cent of organisations with AI-related breaches lacked AI access controls¹⁵. Defensive AI has concrete jobs here: scoring bursts of verification requests to one number (victims describe codes arriving for days or weeks⁴), risk-rating SIM replacements on business numbers, correlating signals across operator, aggregator and platform, and pairing blockchain analytics with shared indicators. All of it depends on the data sharing INTERPOL says is missing⁷. Models trained on yesterday’s patterns also lag adaptive campaigns, so controls must be risk-based, not blanket.

Three scenarios for 2030

The briefing’s scenarios are thinking tools, not predictions, and carry no probabilities. Applied to Zimbabwean business messaging:

Signposts to watch: the AI-enabled share of reported fraud, WhatsApp Business hijacks reported to police and POTRAZ, aggregator and SIM-replacement rules, S.I. 99 supervision, and post-quantum migration plans. On current evidence A and B are the live paths; C is a choice to start now.

Action agenda, 2026 to 2030

• Regulators and FIUs. Fast-freeze and SIM-swap block powers with safeguards; shared-liability rules that include telcos and platforms; aggregator supervision; a post-quantum roadmap for finance.
• Operators, banks and aggregators. Alert on verification bursts; apply in-person checks and a cooling-off period to SIM replacements on business numbers; check SIM and device swaps before releasing money; publish the root cause when known.
• Enterprises. Two-step verification with a recovery email; weekly Linked Devices review; limited admin roles; voice-call confirmation of payment requests; an audit of Meta Business Manager payment methods; chat logs treated as personal data.

Conclusion

The Econet incident is not yet a case study in a particular exploit. It is a case study in dependency: a number trusted as identity, a code trusted as proof, a chat trusted as a payment channel and a wallet trusted as an exit. Attackers use AI to move along that chain faster than institutions share information. The defence is the same chain, instrumented end to end and acting on shared signals. In a contest of AI against AI, the side that shares data faster is better placed to win.

Limits of this analysis. Evidence is current to 22 October 2026. Statements about the incident are drawn from press reports and ministerial comments; its cause has not been officially confirmed. Figures from different sources use different methods and should not be added together. Statements labelled 2030 assessment are the author’s judgement, not forecasts of fact.

REFERENCES

[1] The Herald (Zimbabwe), “Govt probes WhatsApp business breaches”, 14 Oct 2026. heraldonline.co.zw/govt-probes-whatsapp-business-breaches/

[2] CAJ News Africa, “Zimbabwe probes unprecedented WhatsApp breaches”, 15 Oct 2026. cajnewsafrica.com/2026/10/15/zimbabwe-probes-unprecedented-whatsapp-breaches/

[3] Bulawayo24 News (via ZiFM Stereo), “Zimbabwe MP loses WhatsApp account amid hacking reports”, 13 Oct 2026. bulawayo24.com/index-id-news-sc-local-byo-267636.html

[4] ZimLedger, “Warning: Hackers are hijacking WhatsApp accounts in Zimbabwe”, 13 Oct 2026. zimledger.co.zw/blog/warning-hackers-are-hijacking-whatsapp-accounts-in-zimbabwe-here-is-what-to-do-to-protect-yourself/

[5] Zimbabwe Now, “The anatomy of WhatsApp Business hacking in Zimbabwe and how to secure your account”, 12 Oct 2026. zimbabwenow.co.zw/articles/24237/the-anatomy-of-whatsapp-business-hacking-in-zimbabwe-and-how-to-secure-your-account

[6] Malwarebytes, “The ghosts of WhatsApp: How GhostPairing hijacks accounts” (research by Gen Digital), 18 Dec 2025. malwarebytes.com/blog/news/2025/12/the-ghosts-of-whatsapp-how-ghostpairing-hijacks-accounts

[7] INTERPOL, African Cyberthreat Assessment Report 2026 (news release), 3 Aug 2026. interpol.int/en/News-and-Events/News/2026/INTERPOL-report-finds-AI-linked-to-more-than-half-of-cybercrime-in-Africa

[8] FATF, Seventh targeted update on virtual assets and VASPs, 16 Jul 2026. fatf-gafi.org/en/news/targeted-updated-va-vasps-2026.html

[9] FATF, Targeted report on stablecoins and unhosted wallets, 3 Mar 2026. fatf-gafi.org/en/publications/Virtualassets/targeted-report-stablecoins-unhosted-wallets.html

[10] FATF, INTERPOL and Egmont Group, Illicit financial flows from cyber-enabled fraud, 9 Nov 2023. fatf-gafi.org/en/publications/Methodsandtrends/illicit-financial-flows-cyber-enabled-fraud.html

[11] Cointelegraph, coverage of the Chainalysis 2026 crypto scams report (impersonation scams and AI). cointelegraph.com/news/crypto-scams-2025-ai-impersonation-fraud-chainalysis

[12] MMM Law, “Zimbabwe regulates virtual asset service providers: key implications of S.I. 99 of 2026”. mmmlawfirm.co.zw/zimbabwe-regulates-virtual-asset-service-providers-key-implications-of-s-i-99-of-2026-for-businesses-investors-and-fintech-operators/

[13] DLA Piper Africa, “A quick-start guide to Zimbabwe’s data protection regulations”, 2024. dlapiperafrica.com/en/zimbabwe/insights/2024/A-Quick-Start-Guide-to-Zimbabwes-Data-Protection-Regulations

[14] Fortune, “Former Meta integrity chief says new report reveals ‘disappointing’ ad fraud epidemic” (summarising Reuters), 15 Dec 2025. fortune.com/2025/12/15/former-meta-integrity-chief-ad-fraud-epidemic-china-scams

[15] Help Net Security, “Average global data breach cost now $4.44 million” (on IBM Cost of a Data Breach 2025), 4 Aug 2025. helpnetsecurity.com/2025/08/04/ibm-cost-data-breach-report-2025

[16] Entrust, 2026 Identity Fraud Report (press release), 18 Nov 2025. businesswire.com/news/home/20251118135338/en/Deepfakes-Social-Engineering-and-Injection-Attacks-on-the-Rise-Entrust2026-Identity-Fraud-Report-Reveals-Surging-Attacks-and-Diversifying-Tactics

[17] Europol, Internet Organised Crime Threat Assessment (IOCTA) 2026 (published 28 Apr 2026), as summarised by CybelAngel; see also eucrim.eu/news/iocta-2026. cybelangel.com/blog/europol-iocta-2026-report/

[18] Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, Nov 2025. assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf

[19] Surfshark, Deepfake fraud statistics, published 14 Jul 2026. surfshark.com/research/deepfake-fraud-statistics

[20] BleepingComputer, report on Sysdig’s JADEPUFFER research, 4 Jul 2026. bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack

[21] PostQuantum.com, on NIST IR 8547 initial public draft, “Transition to Post-Quantum Cryptography Standards”. postquantum.com/security-pqc/nist-ir-8547-ipd/

[22] The Quantum Insider, “Google researcher lowers quantum bar to crack RSA encryption” (Gidney), 24 May 2025. thequantuminsider.com/2025/05/24/google-researcher-lowers-quantum-bar-to-crack-rsa-encryption/

[23] Herbert Smith Freehills Kramer, “Financial institutions and telcos required to share responsibility for phishing scams in Singapore”, 2024. hsfkramer.com/notes/cybersecurity/2024-posts/financial-institutions-and-telcos-required-to-share-responsibility-for-phishing-scams-in-singapore

[24] Hon. T. A. Mavetera, Minister of ICT and Courier Services, opening address at the 2026 Cyber Fraud and AI Summit (theme: “AI Versus AI: The New Battlefield of Cyber Fraud”), Nyanga, 21 Oct 2026 (speech text).