Mobile Money Fraud and SIM Swap in Zimbabwe (2026): How the Scams Actually Work

Why 2026 was the year this got serious

The Zimbabwe Republic Police issued a formal warning on 20 January 2026 about a surge in mobile money fraud specifically targeting EcoCash users. The scale is not theoretical: a syndicate of 11 people from Chitungwiza defrauded 31 EcoCash users of roughly US$61,000 through a phishing scheme built around fake "free data bundle" links that tricked victims into sharing their one-time PINs and EcoCash PINs. A separate SIM-swap case involved a married couple and younger accomplices moving ZiG223,000.

Mobile money is how most Zimbabwean households actually move money, which makes it the highest-value target in the country. Understanding the two dominant mechanisms is the practical defence.

Mechanism one: phishing for your PIN or OTP

This is the simpler and more common attack. You receive a message — SMS, WhatsApp, or a social media post — offering something plausible: free data, a bundle promotion, a refund, a prize, or a warning that your account will be suspended. It carries a link, or asks you to confirm details.

The goal is always the same: get you to reveal your PIN or a one-time PIN (OTP). Once they have it, they transact as you.

The defence is a single rule with no exceptions: your PIN and any OTP are never to be shared with anyone, for any reason, including someone who says they are from EcoCash, your bank, or the police. A genuine provider does not need your PIN, because they can already see your account. Anyone asking for it is, by that fact alone, an attacker.

Mechanism two: SIM swap, which does not need your PIN at all

This one is more dangerous because it bypasses the thing you were told to protect. In a SIM swap, the attacker gets your phone number reissued to a SIM in their possession — through social engineering of an agent, stolen handsets, or forged identification.

Once they control your number, they receive your OTPs. Every "we've sent a code to your phone" security step now protects them instead of you. That is enough to take over mobile money accounts and, in many cases, reach bank accounts that use SMS verification. Reporting describes accounts being cloned and taken over "in a matter of seconds."

The same route is used to hijack WhatsApp accounts, which are then used to message your contacts asking for money — one of the most effective scams running in Zimbabwe precisely because the request appears to come from someone the victim genuinely knows.

The warning sign almost everyone ignores

If your phone suddenly loses network service for no reason, treat it as an emergency, not an inconvenience.

A SIM swap makes your own SIM stop working — that is the first and often only signal you get. Most people assume a network problem, wait, and by the time they investigate, the money is gone. If your handset shows no service while others around you have signal, contact your mobile operator immediately from another phone, and tell them you suspect a SIM swap.

Practical protection, in order of value

1. Never share a PIN or OTP. No legitimate caller will ever need it. This alone defeats the phishing attack entirely;
2. Do not click links promising bundles, prizes or refunds. Go to the provider's own app, USSD code or shop instead. The Chitungwiza case ran on exactly this bait;
3. Treat sudden loss of network as a possible SIM swap and act within minutes, not hours;
4. Ask your operator what SIM-swap protections are available on your line — additional verification requirements, or a notification when a swap is requested;
5. Verify by voice before sending money to anyone, even a contact you know, if the request came by message. A WhatsApp account can be hijacked; a familiar voice on a call you initiated to a number you already had is much harder to fake;
6. Keep the amount held in mobile money proportionate to what you actually need to transact. A wallet is a payment tool, not a savings account — see is your money safe in a Zimbabwean bank for where protected savings actually belong;
7. Use a different PIN for mobile money than for anything else, and change it if you have ever entered it on a page you reached from a link.

If it has already happened

Move fast — the window in which anything can be recovered is short:

1. Contact your mobile money provider and your bank immediately to freeze the account. Do this before anything else, including gathering evidence;
2. Contact your mobile operator if you suspect a SIM swap, to recover control of the number;
3. Report to the police and get a report reference. This matters both for any recovery and for your own record;
4. Preserve the evidence — screenshots of the messages, the number that contacted you, transaction references, times. Do not delete the messages;
5. Warn your contacts if your WhatsApp or number may have been taken over, because the next stage of the attack is usually aimed at them, using your identity.

Why the "free data bundle" bait works

It is worth being direct about this rather than treating victims as careless. The bait works because it is small, plausible and ordinary. Nobody is suspicious of a data promotion in a country where data costs are a real household expense. The attackers are not exploiting stupidity — they are exploiting a completely reasonable interest in something cheap, combined with a mechanism most people have never had explained to them.

That is why the rule has to be mechanical rather than judgement-based: never enter a PIN or OTP anywhere you arrived at from a link, ever, regardless of how legitimate the offer looks.

The regulatory backdrop

Mobile money in Zimbabwe operates under Reserve Bank regulation covering money transmission, mobile banking and mobile money interoperability, and EcoCash has been working with the police and POTRAZ on public education. That regulatory activity matters, but none of it protects an account whose PIN the holder handed over. The defence that actually works is the individual habit, which is why it is worth teaching to everyone in the household — particularly older relatives, who are disproportionately targeted.

For the wider pattern behind all of this — urgency, an unfamiliar account, and pressure not to check with anyone else — see our guide to spotting an investment scam, and how to check whether a lender is licensed before sending money to anyone offering credit.

If you take mobile money in a business

A trader, tuck-shop or small service business accepting mobile money faces a different set of attacks, and the losses are often larger because the volumes are:

• The reversed or fake payment notification. A customer shows you an SMS or screenshot confirming payment and walks out with the goods. The message is fabricated or edited. Confirm the money in your own account balance, on your own device, before releasing anything — never on the strength of a message shown to you on someone else's phone;
• Overpayment and refund. A "customer" pays more than the price, then asks for the difference back. The original payment is later reversed or was never real, and your refund is the actual theft;
• Staff access. Where employees transact on the business line, one PIN shared among several people means no accountability at all. Give each person their own access where the platform allows it, and reconcile daily rather than monthly;
• The number is the account. A business line that is SIM-swapped is a business bank account handed over. Treat the security of the business number as seriously as the cash float.

See our guide to taking payments as a small business in Zimbabwe for the wider setup, including the fiscalisation and record-keeping side that also protects you here — a business that reconciles properly notices a fraudulent transaction in days rather than months.

Frequently asked questions

Will EcoCash or my bank ever ask for my PIN? No. Neither will the police. Anyone asking is an attacker, without exception — this is the one rule that needs no judgement call.

Can I get my money back after a mobile money fraud? Recovery is difficult and not guaranteed, which is why speed matters. Report to the provider, your bank and the police immediately rather than waiting to see if the money reappears.

Is a SIM swap my mobile operator's fault? Responsibility depends on how the swap was authorised. Report it to the operator immediately and in writing, keep the reference, and raise a formal complaint if you believe their verification failed.

How do I protect an elderly relative who uses mobile money? Teach the single rule — never share a PIN or OTP, never enter one from a link — and agree that they will call you before acting on any message asking for money or account details. A pre-agreed check-in habit is more effective than trying to teach every scam variant.

Should I keep my savings in mobile money? Mobile money is designed as a payment tool. Savings you cannot afford to lose belong somewhere with deposit protection — see is your money safe in a Zimbabwean bank for what that actually covers.

Last reviewed: August 2026. General information, not security or financial advice. Case details cited reflect reported incidents and police statements; confirm current protections and reporting procedures directly with your provider and the police.