How Do EcoCash Scams Work in Zimbabwe? How Is Money Stolen? How Can You Stay Safe?

A fraudulent payment does not always begin with someone breaking into a wallet. Sometimes the wallet holder is persuaded to hand over a security code. Sometimes a shopkeeper releases goods after seeing a fabricated payment confirmation. In other cases, a customer makes a real payment for a service that never existed.

These are distinct mechanisms, with different points at which the deception can be interrupted. The Kopje Journal & Review's Main Desk audit examines them through Zimbabwean cases and the public response to mobile-money fraud. Its central finding is that protecting a payment system involves more than warning customers to be careful. Providers must investigate disputed transactions, regulators must establish whether their interventions work, and reports of recovered property must be distinguished from money returned to victims.

This article preserves the original audit's 2024–2026 reporting scope. Case allegations and institutional statements are attributed as they were in the source reporting; it does not claim to supply later court outcomes or a newly measured national loss total.

A genuine code can serve a false request

In the February 2026 Harare case examined in the audit, prosecutors alleged that 31 complainants lost US$61,387 through a free-data scheme. Customers were allegedly directed to fraudulent pages carrying familiar branding, entered personal details including telephone numbers, and then received calls requesting one-time passwords. The suspects allegedly used the codes to access wallets and transfer funds into accounts they controlled.

The important distinction is between the authenticity of a code and the legitimacy of the person asking for it. A genuine code may be generated because somebody else has initiated an access attempt. Passing it to that person can authorise an action the customer did not intend.

The allegations describe deception of customers and misuse of credentials. They do not, by themselves, establish a breach of EcoCash's central system. Nor do the allegations establish the accused persons' guilt. Those boundaries matter because a description of the mechanism should not become a claim about either a company's infrastructure or a criminal verdict that the evidence does not support.

A convincing screen is not a received payment

Merchant fraud can operate without taking over the shopkeeper's wallet. The buyer presents what appears to be a completed payment, and the merchant accepts the display instead of checking the receiving account.

The audit traces one such case to Mbudzi Business Centre in Masvingo, where two men used false EcoCash confirmations to obtain groceries in November 2024. They later pleaded guilty to three fraud counts at Masvingo Magistrates Court. Police recovered the groceries.

The recovery changes how the case should be described. The shops initially lost control of their stock, but the published account does not establish a permanent loss of those goods. A story about theft becomes misleading if it omits a documented recovery. Equally, recovered groceries do not make the initial deception harmless: they show why the payment check must happen before stock leaves the business.

The practical safeguard follows directly from the mechanism. A merchant should confirm the incoming transaction in the merchant's own wallet. The customer's screenshot or handset display is evidence of what the customer is showing, not independent confirmation that the merchant has been paid.

Small fees can conceal a different scam

The source audit also describes April 2026 reports from Bulawayo involving EcoCash-branded offers for data, loans or vouchers. Residents reported paying US$5 to US$10 in registration fees before the websites became inaccessible and the promised service failed to arrive.

Here the victim may have initiated a genuine payment. The fraud concerns the promised benefit rather than necessarily involving stolen wallet access. Keeping that distinction clear helps explain why a single warning cannot cover every case. Protecting a security code addresses one route; verifying an unfamiliar offer before paying addresses another.

The documented examples identify several exposed groups: wallet holders, merchants and people responding to online promotions. They do not establish which age, income group or location experiences the highest incidence of fraud. Such a ranking would require evidence beyond these cases.

Three kinds of numbers, three different questions

The source audit records ICT Minister Tatenda Mavetera's April 2026 estimate that national mobile-money fraud exceeded US$30 million annually. It is an attributed government estimate covering mobile money nationally. It is not an audited EcoCash-only loss figure. The remarks examined in the audit did not supply an auditable calculation, provider breakdown or precise measurement year.

Police-recorded crime measures something different. ZIMSTAT's first-quarter 2026 figures cited in the audit include 3,241 fraud offences and 3,342 offences in the broader fraud, deception and corruption category. Those are offence counts across the country, not sums stolen through EcoCash. They also cannot count incidents that were never reported.

The scale of legitimate payments answers a third question. The Reserve Bank's second-quarter 2026 figures, cited in the audit, recorded approximately 236.7 million mobile-money transactions and roughly 11.2 million active subscriptions. Transaction values were reported in Zimbabwe Gold, including US-dollar activity converted at prevailing interbank rates. Subscriptions are not necessarily unique people, and transaction volume is not a fraud count.

These measures should not be blended into a seemingly precise estimate of EcoCash losses. The available evidence establishes substantial payment activity, recorded offences and a public government estimate. It does not establish a provider-specific annual loss rate or the share of mobile-money transactions that were fraudulent.

Identity checks address the receiving end

Fraud prevention also concerns the accounts into which money is moved. The audit reports that the Reserve Bank's February 2026 Monetary Policy Statement identified registrations involving multiple SIM cards under different identities, including identities of deceased people. Operators were required to screen wallets with the Civil Registry Department and submit evidence of completion by 30 June.

The account did not end with the deadline. In September, the governor said operators had completed the exercise, supplied documentation and been integrated with the Civil Registry for customer checks. The audit treats this as a reported implementation milestone.

It is not the same as evidence that scams stopped. The account did not quantify the number of fictitious wallets removed or establish a subsequent reduction in fraud. Identification can improve traceability while leaving customers vulnerable to a deceptive call or merchants vulnerable to a false payment display. The effect of an intervention must be measured separately from its announced completion.

Recovery, refund and responsibility

In the February investigation, police reported recovering phones, SIM cards, cash and property with an estimated value of approximately US$22,000. That was an estimate of recovered assets. It was not a verified amount reimbursed to the 31 complainants.

Seizure, conviction and restitution are separate outcomes. Property recovered during an investigation may be important evidence or a potential source of recovery, but a report of seizure does not prove that a victim has received money. The source audit did not establish reimbursement to the complainants.

EcoCash's published terms place duties on customers to protect credentials and report compromised phones or SIM cards promptly. They also address wallet restrictions and limits on liability, while retaining an exception concerning losses directly caused by gross negligence or wilful default. Those terms state a contractual position. They are neither an automatic promise of repayment nor a final court decision about responsibility in a particular dispute.

The unresolved accountability question is therefore concrete: what proportion of disputed losses is prevented, investigated, recovered and ultimately returned? Announced security improvements and recovered assets cannot substitute for those outcomes.

What a customer or merchant can do

The immediate response should match the risk. Stop responding to unsolicited requests for codes and reach the service independently through the official app, established service menu or verified customer-care route. Do not give a caller a PIN or one-time password, including when the caller claims to be support staff. Do not approve an access attempt that you did not initiate.

If a code has been disclosed or a phone or SIM compromised, contact EcoCash promptly and ask for the wallet to be secured and the disputed activity investigated. The company's official customer-care number is 114. A merchant should inspect the receiving wallet before releasing goods, rather than rely on the buyer's confirmation.

Preserve messages, caller details, transaction references and amounts. Report suspected theft to police and keep the case reference. Separately obtain a provider complaint reference and request a written investigation outcome. If the provider complaint remains unresolved, use the Reserve Bank's official consumer-protection channels, checking current details directly on its website. Do not disclose security codes when reporting, and be wary of anyone demanding advance payment to recover stolen money.

These steps preserve evidence and improve the chance of a useful investigation. They do not guarantee reimbursement.

Verdict

The recurring weakness across these cases is a decision made on unverified trust: a familiar logo, a convincing caller, a displayed payment or an attractive offer. Customers and merchants can interrupt those mechanisms, but responsibility does not end with them. A credible protection system also needs traceable receiving wallets, effective dispute handling and evidence about money actually returned.

KJR's finding is therefore a shared-accountability one. Protect the code, verify the payment and preserve the record. Then ask the institutions responsible for the payment system to demonstrate outcomes, rather than treat a completed screening exercise or a seizure announcement as the end of the story.

Sources and scope

This standalone article is adapted from KJR's revised full Main Desk narration retained on 16 October 2026 and its published description. The replacement original video was published at 00:27:55 UTC on 17 October 2026 (YouTube metadata: 16 October 2026 at 17:27:55 UTC−07:00). It replaces the withdrawn faulty upload and does not use the companion Short as its source.

• Original full KJR audit: https://www.youtube.com/watch?v=p1d9ARRb2Gg
• EcoCash customer terms, including reporting and customer-care provisions: https://ecocash.co.zw/terms-and-conditions/
• EcoCash official FAQs: https://ecocash.co.zw/faqs/
• Reserve Bank National Payment Systems quarterly reports: https://www.rbz.co.zw/index.php/index.php/publications-notices/publications/nps-quarterly-report
• Reserve Bank official website and current consumer-protection contact routes: https://www.rbz.co.zw/

The court cases, ministerial estimate and 2026 regulatory chronology above are attributed to the evidence reported in KJR's source audit. This adaptation does not claim fresh court-file inspection or an independent nationwide fraud census. No later disposition is inferred from the passage of time.