Your phone loses signal. A verification code pops up that you never asked for. Then WhatsApp kicks you out. By the time you figure out what happened, someone wearing your digital face has already texted your closest contacts asking for money.
This is not a hypothetical. This is happening right now, to journalists, government spokespeople, and ordinary people who thought they were too smart to get played. WhatsApp account hijacking has become one of the most efficient and emotionally devastating scams running in southern Africa — and the criminals behind it are getting sharper, faster, and more ruthless by the day.
Hannes Bezuidenhout, a financial crime compliance and fraud prevention expert at Sumsub — a global verification platform that helps businesses fight fraud and comply with anti-money laundering laws — puts it bluntly. “Fraudsters have become much more sophisticated. They no longer rely on a single technique but combine phishing, social engineering, leaked credentials and SIM swap attacks to increase their chances of success.” And as these methods become easier to automate, he warns, hijacking campaigns can now target an unprecedented number of people at the same time. This is not a lone wolf operation. This is an industry.
Consider what happened to Marc Strydom, a digital sports reporter at the Sunday Times. Criminals hacked the WhatsApp account of his colleague, Sowetan photographer Antonio Muchave, and used it to send Strydom a message that read: “Hey man, how are you doing? I have a problem with my card. Can you lend me money? I will bring it back in a day when the card is sorted out.” Strydom did not hesitate. He sent R1,500 via CashSend. Two hours later, the scammers came back for R800 more. He sent that too. It was only when they asked for a third payment that something clicked. He called Muchave’s manager. The account had been hijacked. The money was gone.
“Me and my wife had people trying to scam us six times in the past few weeks without success, and this time I let my guard down — and it’s because it was from someone I know,” Strydom said. That is the brutal genius of this scam. It does not rely on a stranger cold-calling you with a suspicious accent. It weaponises your trust in real people you already have a relationship with. The criminals got Strydom’s name right. They knew Muchave was his colleague. The message was casual, a single line, exactly the kind of thing a real person would send. The money Strydom lost came off his credit card. That is not just embarrassing — it is a real financial wound.
Muchave himself only found out what was happening when his son called him from the Mozambican border, alarmed that people were reaching out asking why Muchave was requesting money. By then, the damage was done.
The same week, Singabakho Nxumalo, spokesperson for the Department of Correctional Services, got hit. The attackers performed a SIM swap — a technique where criminals convince a mobile network to transfer your phone number to a SIM card they control. “When I checked my phone, it did not have coverage; I couldn’t even access my WhatsApp,” Nxumalo said. A colleague tipped him off after receiving a fraudulent request for R2,500. Nxumalo had to physically go to a Vodacom store the next day to recover his number. He also filed a police report. That is a full day of your life, your reputation, and your peace of mind — stolen.
Then there is Cliff Shiko, a reporter at JacarandaFM, who was on a flight from Johannesburg to Upington when the scammers struck. He had his phone on flight mode. When he landed and turned it back on, the network was dead. He assumed it was poor coverage in Upington. It was not. Someone had executed a SIM swap while he was in the air, completely unreachable. When WhatsApp kicked him out and demanded re-verification, he could not receive the code. At the service provider’s store, he got the confirmation: SIM swap. When he finally recovered his number, four people had texted saying they had missed his call — calls he never made, on a day he had no network.
The Council for Scientific and Industrial Research identifies three primary methods criminals use to seize your account: verification code scams, where they trick you into forwarding a six-digit code that grants them full access to your WhatsApp; device-linking scams, where they manipulate you into scanning a QR code that mirrors your account onto their device; and SIM swap fraud, where they impersonate you to your mobile carrier and redirect your number entirely. Each method is different. The outcome is the same — you lose control, and someone you trust loses money.
In October, TransUnion reported that between 57% and 68% of South Africans had been targeted by digital scams — including WhatsApp, SMS, and phishing attacks — over the previous twelve months. Read that again. More than half the country. This is not a niche cybercrime problem for tech-illiterate people. This is a mass-scale assault on everyday life, and the official response has been nowhere near adequate. Filing a police report after a SIM swap is the kind of thing that makes you feel like you did something, while knowing full well that nothing will come of it.
Here is the truth that official narratives will not say loudly enough: the mobile networks that allow SIM swaps to happen without robust identity verification are part of this problem. The platforms that do not offer stronger default protections are part of this problem. And the culture of silence — where victims feel ashamed rather than outraged — keeps the scammers winning. Strydom lost money he did not have spare. Nxumalo lost a day and his sense of security. Shiko landed in a strange city to find his identity had been borrowed without permission. These are not statistics. These are real people, and the criminals who did this to them are still out there, automated and scaling up, looking for the next name on your contact list to exploit. The question is not whether they will try you. The question is whether you will be ready when they do.
