Ngoni Dapira

EVERY year, new scams emerge and more people fall victim to scammers. Before it was pyramid schemes like the Capital Base Savings and Credit Co-operative saga in Mutare that were used, but now impersonation scams on social media is the new rip-off.

In our present-day digital era, social media scams are now a growing concern as most people now network and do business on various social media platforms. Scams involving impersonation are escalating, with scammers often posing as high profile persons to defraud victims.

In Zimbabwe, the man-of-the-moment, Wicknell Chivhayo, a flamboyant businessman and socialite who is often known to post his lavish lifestyle and philanthropic deeds on social media, is currently being used as the biggest scam through deepfake videos and fake Facebook accounts designed to gain the trust of fans and followers to rip-off money from them. But exactly how many people have been caught or exposed? This is the million dollar question as this cybercrime looms on social media, especially on Facebook and Telegram.

Easterntimeszim investigated this matter and posted on one suspected Facebook account that uses the profile name ‘Sir Wicknell’ and username ‘Wicknell Chivhayo’. The Facebook page is so convincing and well updated that it is very difficult to detect it as a fake account. To begin with the account has 505K followers and most posts on average constantly range from 4K to 10K likes and over 200K views. 1k stands for a kilo, meaning 1000 people. According to Facebook yardsticks, for small accounts, a post might be considered viral if it snags around 10 000 (10K) or more likes. For larger accounts or brands, viral status is often linked to widespread reach and trending status in the millions.

This reporter commented on a post on 29 May of a handover ceremony of a Toyota Land Cruiser 300 series to renowned ZBC veteran reporter Reuben Barwe which was gifted by Chivhayo. I immediately received a reply with a message,” Inbox me PA WHATS APP ZVINO +26378458901,” basically instructing me to inbox on the Econet number on Whats App.  I followed up on the order and sent a message on Whats App to the number. We chatted and all was well until the Sir Wicknell scammer said he was going to help with money on condition I buy a US$100 ticket to join a Sir Wicknell Membership winning promotion.

“Congratulations to you if you really need my help, what if I bless you with $30 000, a truck, 2 acres of land for farming and a luxurious car, will you be happy,” was the hook, line and sinker statement.

After the US$100 ticket offer this reporter responded that he was cash strapped. It was the desperate attempts by the scammer to convince me that immediately sent red flags that this was a scammer and not the real Chivhayo, who is known to give unconditionally.

“So are you going to take some time to get back to me… The reason why am asking I do not have much tickets on ground so you have to be quick. I just have only 8 tickets now,” said the scammer in the Whats App message.

I eventually ignored the rest of the posts until the scammer went quiet.

The following day as a follow up on the same account this reporter commented on a Father’s Day post celebrating President Emmerson Mnangagwa as the father of the nation. The comment asked publicly if he knew there was scam through that Facebook account, selectively conniving fans to pay for membership to get gifted.

“Sir Wicknell how are u (you). I am a journalist and inquiring on a matter where someone is running a parallel account with your name and requesting for $100 to buy a Wicknell membership ticket then stand a chance to be blessed with cash and cars. Are you aware of this?” read the comment on the post.

Immediately there was a reply with a message,” Inbox me PA WHATS APP ZVINO +263780270456.” This was a different number from the previous one. Both cellphone numbers are Econet but not registered  on Ecocash, so the identity of the scammers cannot be shown.

Curious again, this reporter messaged the Whats App number and introduced myself and how I had received the previous inbox message on Facebook. The scammer immediately responded and introduced himself as Sir Wicknell in text format, then immediately made a 34 seconds deepfake video of Chivhayo and his wife Lulu Muteke Chivhayo at the airport as proof it was the real Chivhayo calling. As a techno savvy reporter that knows how deepfake videos work on a live video call, I played along. After the 34 seconds video call where the scammer claims its proof he is the real Chivhayo the video call abruptly cut and the scammer went back to texting on Whats App.

“I hope you saw me dear,” was his next message. This reporter continued to play along and asked again on the fake account issue demanding for $100 from fans to be gifted. “Alright dear. I don’t do that PLS (please) don’t fall a victim,” responded the scammer.

After sending details of the other scammer he went on to divert the issue and said, “So are you ready to receive my blessings today so I can make you happy today and put a smile on your face…Do you have Ecocash?”

Playing along he asked me to send my Ecocash pin code to confirm a US$20 000 payment. I did so knowing very well there was no money in my account. The scammer would request for the OTP (One-Time Password) codes sent on my phone.  We did it about three times, probably it was bad network, until he accessed the account probably and realized the Ecocash account was empty.

“Alright dear you have to make a deposit of $60 in your Ecocash account to activate your account so that $20 000 will be successfully paid in your account,” said the scammer. For over four hours the scammer followed up trying to convince me to deposit $60, but I kept lying that I was still looking for the money. This reporter then went to change passwords and block the hacked account at Econet immediately after the experiment.

According to the 2024 Global State of Scams Report from the Global Anti-Scam Alliance (GASA) and Feedzai, scams are still a constant threat that costs consumers worldwide over US$1 trillion. This emphasizes the need for greater consumer protections and financial recovery measures.

The report further states that worldwide, an estimated $608 million people each year fall victim to a scam. In the United States, the most common type of scam is identity theft. 67% of the US scam victim reports come from women, but men lose more money on average.

“Nearly half of scams are over within the first 24 hours of contact whilst only 4% of victims were able to fully recover their money,” reads the report.

An Information Technology analyst Nyasha Dhliwayo said with the advent of new technologies cybercriminals are becoming harder to find. He however said it is critical that people know more about cybercrimes and scammers by learning to spot red flags and report them to the police.

Dhliwayo added that impersonation scams are also now a threat given the high unemployment of youths. He said fake ‘get-rich-quick’ investment schemes via legitimate-looking groups on the messaging app Telegram are now on the increase.

“Telegram – a cloud-based messaging app that lets users send messages, photos, and files is being used for those fake investment schemes. Crucially, the platform is known for its emphasis on privacy, with ‘secret chats’, self-destructing messages, and the option to delete messages with no trace. Scammers offering fake investment schemes on the app, usually promising high returns and little risk, love to use Telegram,” said Dhliwayo.

Christopher Musonza co-founder and researcher at FungAI Africa, an organization dedicated to advancing ethical AI (Artificial Intelligence) governance, digital rights and online security across the continent said while the fundamental nature of scamming hasn’t changed, the methods, scale and sophistication have dramatically evolved with the digital era, making it a rapidly growing trend and a much more pervasive threat.

“Scamming has always existed. Fraud and deception are as old as human civilization. From con artists at market stalls to pyramid schemes, people have always tried to exploit others for financial gain. The underlying psychological principles of scamming remain constant. The digital era has just amplified and transformed it. It has provided scammers with unprecedented tools and reach,” said Musonza.

He added that the anonymity and global reach of the internet allows scammers to operate from anywhere in the world and target victims globally with relative anonymity, making them harder to trace.

“Scale and Automation, AI and other technologies enable scammers to automate and scale their operations, sending out millions of phishing emails or creating thousands of fake profiles with minimal effort.  Deepfakes, AI-generated voices and highly convincing fake websites make scams much harder to detect than traditional scams,” he said.

Mutare lawyer Blessward Mungure of Mukombe and Associates said he has fallen victim to Ecocash scammers who impersonate relatives he knows after hacking their accounts.

“Cybercrimes are now a growing concern and our police and legal systems are still weak to deal with such cases. We need to look into this seriously as country because it’s the reality of the day in the digital era,” said Mungure.

Manicaland police spokesperson Assistant Inspector Wiseman Chinyoka said he did not have reported cases of impersonation scams but admitted he is aware of scams.

“I will look into it and find out more to see if it is a growing concern statistically from reports filed to the police,” said Ast Inp Chinyoka.

Musonza added that while the police is making strides in enhancing its capacity to combat specialized crimes, including cybercrime, there is still a significant global challenge in consistently catching these perpetrators due to the evolving nature of the crimes and their often international scope.

“Public Awareness is therefore important. Many victims may not know how or where to report cybercrime, or they may feel embarrassed, leading to under-reporting. This makes it harder for police to get a full picture of the problem,” said Musonza.

 

Tips on how to detect impersonation scams by FungAI Africa:

Qn: Is it safe to share your bank PIN code or mobile money PIN code even if the person has no physical access to your phone or bank cards?

Absolutely NOT. It is never safe to share your bank PIN code or mobile money PIN code with anyone, regardless of whether they have physical access to your phone or cards.

• Your PIN is Your Signature: Your PIN is essentially your digital signature for financial transactions. Giving it away is like handing someone the keys to your bank account or mobile money wallet.
• Remote Access: Scammers are sophisticated. They can use various social engineering tactics or even malware to gain remote access to your accounts once they have your PIN. They don’t need your physical card or phone if they have your credentials.
• “Authorised Scams”: Many scams are “authorised”, meaning the victim unknowingly approves the transaction by providing their PIN. Banks or mobile money providers will almost never be able to recover funds in such cases because you “authorized” the payment.
• Legitimate Entities Never Ask: Your bank, mobile money provider, or any legitimate institution will never ask you for your full PIN code over the phone, email, or text message.

Qn: How does the OTP code work in hacking when scammers send to victims pretending to be sending money?

OTP (One-Time Password) scams are a common and effective tactic used by scammers. Here’s how it generally works when they pretend to be sending money:

1. The Bait: The scammer contacts the victim (often via text message or a call) claiming they’ve “accidentally” sent money to the victim’s mobile money account or bank account. They’ll sound distressed and urgent, asking for the money back. Alternatively, they might claim they want to send money and need the victim to “confirm” a transaction.
2. The Fake Transaction/Verification: To “reverse” the accidental transfer or to “confirm” the supposed incoming money, the scammer instructs the victim to enter a code that the victim has just received via SMS. This SMS is the OTP.
3. The Deception: The crucial part is that the OTP the victim receives is not for an incoming transfer. Instead, it’s an OTP for a transaction that the scammer is initiating from the victim’s account. This could be:

• A withdrawal: The scammer is trying to withdraw money from the victim’s account. The OTP is the authorisation for this withdrawal.
• A bill payment: The scammer is trying to pay a bill using the victim’s funds.
• Linking an account: The scammer is trying to link the victim’s mobile money or bank account to a new device or service under their control.
• Password Reset: They might be attempting a password reset on one of your accounts, and the OTP is the verification code.

1. The Theft: When the unsuspecting victim, pressured and misled, provides the OTP to the scammer, they are essentially authorising the scammer’s transaction. The scammer then completes the fraudulent transaction, stealing the money from the victim’s account.

Key takeaway: An OTP is always for your action or for your account security. If you receive an OTP you didn’t request, or if someone asks you for an OTP, it’s a huge red flag.

Qn: What should one do after accounts are hacked?

Acting quickly after an account is hacked can minimize damage. Here’s what to do:

• Change Passwords Immediately: If you still have access, change your password for the compromised account and any other accounts that use the same or similar passwords. Use a strong, unique password.
• Enable Two-Factor Authentication (2FA): If not already enabled, set up 2FA on all your accounts.
• Notify Your Bank/Mobile Money Provider: If financial accounts are involved, contact your bank or mobile money provider immediately to report the unauthorized activity. They can help freeze accounts or reverse fraudulent transactions.
• Scan Your Devices for Malware: Run a full scan using reputable antivirus or anti-malware software on all your devices (computer, phone) to ensure no malicious software was installed that allowed the hack.
• Notify Your Contacts: Inform your friends, family, and followers that your account was hacked. This prevents the scammer from impersonating you to them and spreading further scams.
• Review Account Activity: Check for any unauthorized changes, such as new email forwarding rules, sent messages you didn’t send, or altered profile information.
• Report the Hack:
  • To the Platform: Report the compromised account to the social media platform, email provider, or financial institution. They have procedures to help recover accounts and investigate.
  • To Law Enforcement: Report the incident to the police. While recovery might be difficult, it creates a record and helps law enforcement track trends.
• Monitor Your Financial Statements and Credit Report: Keep a close eye on your bank statements, credit card statements, and mobile money transactions for any suspicious activity. Consider checking your credit report for any unauthorized accounts opened in your name.
• Consider a New Email Address: If your primary email account was compromised, it might be safer to create a new, secure email address for sensitive communications and financial accounts.