If your business WhatsApp number gets hijacked, your customers pay for it
By André Bergan, 2026-10-19
Your business number is on every quote you've sent, every invoice, every WhatsApp group with suppliers. If someone else gets control of it for even an hour, they can message your customers pretending to be you and ask them for money. This is happening in South Africa right now, and it costs a criminal almost nothing to try.
How it actually happens
The usual route is a SIM swap. Someone convinces your network, or tricks you directly, into moving your number onto a SIM they control, often by getting you to hand over a one time code you thought was for something else. Once they have the number, WhatsApp treats whoever holds it as you. Your contacts, your chat history on their side, all of it looks exactly like you logged in on a new phone, because as far as the network is concerned, you did.
It's a real and growing problem here. The industry group COMRiC, the Communication Risk Information Centre, puts telecoms linked fraud in South Africa at around R5.3 billion a year, and says nearly 60% of mobile banking fraud is now linked to SIM swaps (IOL). That doesn't mean every SIM swap request is fraud, most aren't: networks processed 3,600 requests in the first four months of 2025, and only 3% turned out to be fraudulent once checked properly (Engineering News). But that small share is doing a lot of damage.
What it looks like when it happens to you
A Sowetan report in August described exactly this. A hijacked number was used to ask one of the victim's own contacts for R2,500, and it worked, because the message came from a number the contact already trusted (Sowetan).
A cybersecurity expert quoted in a separate Sowetan piece on the same story says the clearest sign is being logged out of WhatsApp with no warning. Other signs worth watching for: a contact tells you they got a strange message from you, your profile picture or settings change without you touching anything, or you get a notification that your account was registered on a new device (Sowetan).
If it happens
Try to log back into WhatsApp with your own number straight away. Get there first and it usually boots the attacker out. If you can't get back in and you suspect your SIM has been swapped, phone your network immediately rather than trying to sort it out inside the app. Then tell your customers and suppliers, by phone, not WhatsApp, not to act on anything your number asks for until you've said so yourself.
What to do today, before it happens
Three things, about ten minutes in total.
- Turn on WhatsApp's two step verification. Settings, Account, Two step verification, Enable. Pick a 6 digit PIN you haven't used anywhere else. WhatsApp will ask for it before anyone can register your number on a new device, even if they already have your SIM.
- Never give that PIN or a one time code to anyone, however they ask. No legitimate company, including your own network, will ever request it from you.
- Watch for the quieter version of this scam: a link or a "competition" that asks you to type in a verification code to enter or claim a prize. That code is what pairs a stranger's browser directly to your account, often with no logout and no new device warning to tip you off.
Regulators and the networks have spent much of this year trying to close the gap that makes a SIM swap possible in the first place, tightening how a new SIM gets matched to an ID before it's issued (IOL). Until that's sorted properly, the PIN sitting in your own WhatsApp settings right now is doing more to protect you than any regulation will this year.
None of this is about AI. It's just the number everything else in your business runs through, your calls, your quotes, your customers. One thing I can tell you for certain about Hannah: she never asks a customer for an ID number, banking details or anything else sensitive, on a call or on WhatsApp (heyhannah.ai). If a message like that ever comes from your business number, it isn't you, and it isn't us either.