Your phone loses signal. Minutes later, your WhatsApp stops working. By the time you have borrowed a phone to figure out what is happening, someone is already messaging your family, your friends and your clients from your account, asking for urgent payments.
This is what WhatsApp fraud looks like in South Africa in 2026. It is no longer just dodgy links and lottery messages. The dominant threat today is account hijacking, increasingly driven by SIM swap fraud, and the numbers explain why. Digital banking fraud in South Africa surged 86% in SABRIC’s latest reporting, with losses of around R1.9 billion, while telecoms-linked fraud costs the country an estimated R5.3 billion a year. Roughly 60% of reported mobile fraud cases now involve a SIM swap.
At DaVinci Forensics & Cybersecurity, hijacked WhatsApp accounts, impersonation schemes and advance-fee fraud make up a growing share of our investigation caseload. Here is what is actually happening in 2026, and how to stay off the victim list.
The Big One: WhatsApp Hijacking via SIM Swap
How it works
A SIM swap happens when a criminal convinces (or pays) a mobile network to transfer your number onto a SIM card they control. From that moment, every call, SMS and OTP meant for you arrives on their device.
They do not need to trick you into sharing a verification code. They simply install WhatsApp, enter your number, and receive the verification SMS themselves. Your account, with your name, your profile photo, and in many cases your chat history via unprotected backups, is now theirs.
Then the real fraud begins:
- Your contacts are messaged directly with urgent requests for money, airtime or “a quick EFT”. Because the messages come from your genuine account, people pay.
- Banking OTPs are intercepted, allowing criminals who have already phished your internet banking credentials to move money out of your accounts.
- Business accounts are weaponised. Clients receive “updated banking details” from a director’s real WhatsApp number. We investigate exactly this pattern in commercial impersonation and advance-fee fraud cases.
Why South Africa is so exposed
Two structural problems make South Africans easy targets. First, the RICA framework does not require networks to properly verify the true owner of a number during a SIM swap request, and telecoms experts rank South Africa’s customer registration process among the weakest globally. Second, years of catastrophic data breaches (Experian: around 24 million people; TransUnion; multiple credit bureaus) mean criminals already hold the ID numbers and personal details needed to pass themselves off as you.
Assume your data is already leaked. A caller knowing your ID number, address or account details is not proof of legitimacy. It is the baseline criminals start from.
The warning sign almost everyone misses
Sudden, unexplained loss of signal, especially when people around you still have coverage, is the signature of a SIM swap in progress. Do not wait and hope it comes back. Call your network provider and your bank immediately from another phone. The first hour decides how much you lose.
How to prevent it
- Set a SIM swap or port-out PIN with your mobile network. Vodacom, MTN, Cell C and Telkom all offer additional verification on SIM swap requests, yet most people never activate it.
- Enable WhatsApp two-step verification (Settings, Account, Two-step verification). This adds a PIN that a SIM swapper does not have, blocking the hijack even after they have captured your number.
- Move banking 2FA off SMS where possible. Use app-based authentication instead of OTPs delivered to a number that can be stolen.
The Other Scams Doing Damage in 2026
The “Hi Mom / Hi Dad” scam, now with AI voice notes
“Hi Mom, this is my new number. My phone broke. Can you send R2,000 urgently?”
The classic family emergency scam has been upgraded. SABRIC has warned throughout 2025 and 2026 that criminals are using AI-generated, deepfaked voice notes that convincingly mimic a family member’s voice. The message does not just read like your child. It sounds like them.
Rule: Call the person on their known, saved number before sending anything. A real emergency survives a two-minute phone call.
Verification code theft (the manual hijack)
Where SIM swaps are not used, criminals still hijack accounts the old-fashioned way. They trigger a WhatsApp registration for your number, then pose as a friend, courier or “WhatsApp support” and ask you to forward the six-digit code “sent by mistake”. Share it, and your account is gone.
Rule: That code is the key to your account. Never share it, with anyone, for any reason.
Fake job offers and task scams
Unsolicited recruiter messages offer remote work, “task-based” earnings or positions at known brands, followed by a registration, training or admin fee of R500 to R3,000 before you can “start”. The job never existed. These are advance-fee fraud operations, structurally identical to the commercial impersonation networks we dismantle in our investigations. It is the same playbook, aimed at job seekers.
Rule: Legitimate employers never charge you to work for them.
Bank “fraud department” impersonation
A WhatsApp message flags “suspicious activity”, then a polished caller from the “fraud department” pressures you to move money to a “safe account” or read out the OTP your bank just sent. That OTP is authorising their transaction on your account.
Rules: Banks never ask for OTPs and never ask you to move money. A bank raising fraud via WhatsApp is itself the red flag. Hang up and phone the number on the back of your card.
Investment and crypto groups
WhatsApp and Telegram “trading” groups promising guaranteed returns continue to strip South Africans of hundreds of millions. The FSCA has flagged schemes such as Arbitrawallet/NTC Global Trade Fund (around R492 million taken from roughly 2,000 investors), and in January 2026 the Hawks dismantled a 31-person Johannesburg syndicate behind a global investment scam exceeding R1 billion. Invitations often arrive from hijacked accounts of real friends.
Rule: Verify every provider against the FSCA register. Guaranteed high returns do not exist.
Municipal, SARS and SASSA impersonation
The City of Cape Town recently warned of fraudsters threatening businesses with electricity disconnection via WhatsApp, quoting the customer’s correct account number and demanding payment into a private bank account. Tax season brings fake SARS “rebate verification” messages, while grant recipients are targeted for ID and banking details to redirect SASSA and NSFAS payments.
Rules: Municipalities do not issue disconnection notices via WhatsApp. SARS, SASSA and NSFAS never request banking details there. Verify any payment demand through official channels first. One Cape Town business avoided losing over R1 million by doing exactly that.
Your 2026 WhatsApp Protection Checklist
- Enable two-step verification on WhatsApp (the single most important setting).
- Set a SIM swap or port-out PIN with your mobile network.
- Never share verification codes or OTPs, with anyone.
- Verify unusual requests on a second channel. Phone the real person or organisation.
- Treat sudden signal loss as an attack. Call your network and bank immediately.
- Do not click links in unsolicited messages, even from known contacts.
- Restrict your profile photo, status and “last seen” to contacts only. Cloned profiles are built from what you leave public.
- Keep WhatsApp updated and enable biometric app lock.
Been Hijacked? Do This Now
- Call your bank. Flag, freeze and attempt recall on any transactions.
- Call your mobile network. Reverse the SIM swap and secure your number with a PIN.
- Reclaim your WhatsApp account. Reinstall, verify with your number (once your SIM is restored), and immediately enable two-step verification.
- Warn your contacts via another channel before more of them pay the scammer.
- Open a SAPS case and get a case number.
- Preserve everything. Do not delete chats. Numbers, screenshots, bank accounts, voice notes and payment references are forensic evidence, and they are traceable.
When to Call in Forensic Investigators
Individual reports rarely stop an organised fraud network. When the losses are significant, when your business or clients were targeted through your identity, or when the same syndicate keeps resurfacing under new numbers and domains, professional investigation changes the outcome.
DaVinci Forensics & Cybersecurity investigates WhatsApp hijacking, SIM-swap-enabled fraud, impersonation networks and advance-fee schemes across South Africa. Our work includes forensic preservation of chat and transaction evidence, OSINT tracing of the numbers, domains and accounts behind the scam, money-flow analysis, and court-ready expert reporting for civil recovery and criminal prosecution.
If you or your business has been targeted, contact DaVinci Forensics for a confidential consultation. The earlier we are involved, the more evidence survives.
FAQ: WhatsApp Scams in South Africa
How do criminals hijack WhatsApp accounts in South Africa? Two main routes: SIM swap fraud, where your number is transferred to the criminal’s SIM (they then receive your verification SMS directly), or social engineering, where you are tricked into forwarding your six-digit verification code. Two-step verification blocks both.
What are the signs of a SIM swap attack? Sudden loss of network signal when others nearby have coverage, WhatsApp deactivating unexpectedly, your banking app logging out, or OTP and transaction notifications you did not initiate. Contact your network and bank immediately.
Will WhatsApp, my bank or SARS ever ask for my OTP or verification code? Never. Any request for a code or OTP, no matter how legitimate it looks, is a scam.
Can money lost in a WhatsApp scam be recovered? Sometimes, if you act within hours. Banks can attempt recalls, and forensic investigation can trace funds and identify the accounts and people behind the scheme. Preserve all evidence and do not delete the chats.
How do I report a WhatsApp scam in South Africa? Report the number in-app (open the chat, then Report), open a SAPS case, notify your bank if money or banking details are involved, and report investment scams to the FSCA. For significant or business-targeted fraud, engage a digital forensics firm to preserve evidence properly.
