When Isatu Sesay received a message inviting her to an online church prayer meeting, she did not know it was the start of an experience that would cost her access to the phone number she had used for more than 20 years.
Isatu, who is the Advertising Manager at Concord Times, said the message asked her to click a link to join an online prayer meeting. She noticed something unusual about the link and hesitated. But someone sitting beside her accidentally clicked it on her phone.
“Immediately after that happened, I lost access to my WhatsApp account,” she recalled.
Within minutes, the hacker began sending messages to people in her contact list asking them to send Le5,000. Most ignored the request because they knew it was unusual for her to ask for money in that manner. But one church member believed the request was genuine and transferred the money.
“I told her she should have cross-checked with me before sending the money,” Sesay said. “She insisted the message came from my number and even got angry. She only believed me after I showed her my disclaimer that my account had been hacked.”
Although she later obtained a new number, Sesay says the experience continues to affect both her personal and professional life.
“I had used that number for over 20 years. My clients knew me through it. Losing it affected my work and my personal relationships. I still fear using the old number again because I don’t know if the hackers could regain access.”
Sesay’s experience is not an isolated case. In a Facebook post, the Editor for Politico Newspaper, Mabinty Kamara, recounted how her father was deceived into sending Le1,000 to a scammer after receiving a fraudulent WhatsApp message from someone impersonating a trusted contact who had been hacked. She also described another incident in which she narrowly avoided being defrauded after becoming suspicious when the sender requested a transfer to a different Orange Money number. These accounts reflect a pattern identified in this investigation, where hackers exploit trusted relationships to persuade relatives, friends and colleagues to send money before the fraud is discovered.
This is happening at a time when digital communication is becoming increasingly important in Sierra Leone. According to the World Bank, using data from the International Telecommunication Union (ITU), about 25.1 per cent of Sierra Leone’s population used the internet in 2024. The ITU also reports that 97.2 per cent of the population is covered by at least 3G mobile networks, while 81.6 per cent is covered by 4G/LTE services.
There is no specific figure that tells the number of WhatsApp users in the country, but the increasing availability of mobile internet suggests millions of Sierra Leoneans rely on messaging applications for work, business, education and family communication.
Methods and patterns identified
This investigation is based on a review of 17 publicly documented reports of WhatsApp account takeovers collected using Social Searcher, an open-source social media monitoring and search tool used to identify and analyse publicly available posts from social media platforms and the web. The reports were cross-checked through manual searches on Facebook and TikTok and WhatsApp between 2023 and 2026 (archived here). It also includes interviews with 10 victims and an interview with the National Cybersecurity Coordination Centre (NC3).
| Key finding | Number |
| Cases documented, including interviews | 27 |
| Cases where the method used to scam victims was known | 11 |
| Cases involving money requests | 14 |
| Cases where verification codes were shared | 9 |
| Cases where a link was clicked | 2 |
| Cases with confirmed financial loss | 2 |
| Cases where accounts were recovered | 9 |
| Cases where accounts/numbers were replaced | 5 |
| Cases linked to Orange Mobile Company | 10 |
The review does not represent every WhatsApp hacking incident in Sierra Leone. Instead, it examines publicly available reports and verified interviews to identify common methods used by cybercriminals.
Among the interviewed victims, a common pattern emerged. Several said they were tricked into sharing or entering a verification code, a unique six-digit, one-time code that WhatsApp sends by SMS or voice call to confirm that the person using the app owns the phone number being registered. Others clicked suspicious links disguised as invitations to meetings. In almost every case, the hackers quickly used the stolen WhatsApp accounts to ask friends, relatives and colleagues for money.
One of the victims, Nancy Grace Sewah, said she received a missed call from someone claiming to be from a church prayer group. When she returned the call, she was told to dial a code that had been sent to her phone to join an online prayer meeting.
“Since I belong to many church groups, I did not think it could be a hacker,” she said. “The moment I dialled the code, I lost my account.”
Fortunately, Sewah realised what had happened almost immediately and alerted her contacts before anyone could send money.
Teacher Zainab C. Koroma shared a similar experience. She received a call from someone claiming to be organising a meeting. After following instructions to dial a code, she immediately lost access to her WhatsApp account. Soon afterwards, friends informed her that someone using her account was requesting large sums of money.
“I had used that number for years,” she said. “I eventually changed it because I no longer have confidence in using it.”
For Umaru Sani, the deception involved a fraudulent link. Shortly after clicking it, he lost access to his account.
“The hacker contacted several people in my contact list asking them for financial assistance,” he said. “To make the scam convincing, AI-generated images were circulated showing me in hospital after a serious road accident.”
Although no one is believed to have sent money, Sani said he recovered his account only after receiving assistance from a cybersecurity expert.
Even people with strong knowledge of technology have become victims.
Sheku Putka Kamara, a lecturer in the Faculty of Communication, Media and Information Studies at Fourah Bay College, said his WhatsApp account was compromised despite his professional background.
“I teach people how to avoid these attacks,” he said. “Yet my account was hacked. From 7 p.m. until about 2 a.m. the next morning, I was trying to recover it.”
“From 7pm the day it happened to 2am the other day, I was not normal. I am a person whose entire business is online, everything I do,” he added.
Kamara believes the incident demonstrates that anyone can become a victim.
“If this could happen to me, it means it could happen to anyone. We need more digital literacy and public awareness.”
The review of the reports about the compromised accounts indicates that many victims publicly advised friends not to send money but provided few details about how their accounts had been compromised; a few others did. However, interviews revealed recurring tactics, including requests to enter verification codes, suspicious links and fraudulent phone calls impersonating trusted groups.
Only two confirmed cases of financial loss emerged during this investigation. A church member transferred Le5,000 to a scammer after believing a request sent from Isatu Sesay’s hacked WhatsApp account was genuine. In another case, journalist Mabinty Kamara recounted in a Facebook post that her father was deceived into sending Le1,000 after receiving a fraudulent WhatsApp message from someone impersonating a trusted contact whose account had been compromised.
Orange Money and the Pattern in Numbers
Beyond the methods used to hijack WhatsApp accounts, this investigation also identified another recurring pattern: many of the hackers directed victims’ friends and relatives to send money through Orange Mobile Money accounts.
For instance, recently, on 22 July 2026, two WhatsApp accounts were compromised, one of which is the account of a popular photographer in Freetown, Kerifallah Janneh. The hackers immediately began sending messages to people in their contact lists requesting money to be transferred to two Orange Money numbers: +232 75 039419 and +232 74 619334.
A review of the registration details showed that the two numbers were registered under the names Mamoud Kamara and Salamatu Kargbo, respectively.
The investigation also identified other numbers that victims said contacted them shortly before they lost access to their WhatsApp accounts. These included +47 40673507 (Norway), +61 485855135 (Australia), +240 5477605 (Equatorial Guinea), and +232 76962058, a Sierra Leone Orange number registered under the name Emeline Savage.
We could not independently verify whether the registered owners of the numbers were responsible for the attacks. But the recurrence of both foreign and locally registered numbers suggests that WhatsApp account takeover scams may involve multiple communication channels before victims lose access to their accounts.
The investigation further found that while some victims first received calls from foreign numbers, requests for money were frequently directed to locally registered Orange Money accounts.
Although this investigation does not conclude that one mobile network is responsible for the attacks, the repeated appearance of Orange Money numbers in cases reviewed raises questions about how fraudulently obtained funds are moved and whether additional safeguards could help disrupt such scams.
Efforts were made to obtain responses from the institutions and companies whose work relates to mobile communications and cybersecurity. On May 28, 2026, a WhatsApp message seeking comment was sent to Orange Sierra Leone’s Public Relations Officer, Alfie Barrie. He advised that a formal letter be addressed to the company’s General Secretary. The letter was delivered on 1 June 2026, and several follow-up messages were subsequently sent. Although the company indicated that it would respond, no response had been received by the time of publication.
An email was sent to Meta, the parent company of WhatsApp, on 18 June 2026, seeking its response to questions about WhatsApp account takeovers, security measures and user protection, but no response was received before publication. Similar questions were sent via WhatsApp to Africell Mobile Company’s Spokesperson, Abdul Karim Sesay on 28 May, with follow-up messages on 1 June, 4 June and 22 June. Although he initially acknowledged the request and indicated that a response would be provided, none was received.
The Sierra Leone Police Cyber Unit referred the reporter to the Police Spokesperson, ACP Brima Kamara, who said he had no knowledge of WhatsApp hacking and therefore could not comment. The letter written to Orange and screenshots of some of the messages can be found here.
However, as the story was being finalised, Orange Sierra Leone began sending messages to customers warning that fraudsters were hacking WhatsApp accounts to request money. The message advised customers never to send money based solely on a WhatsApp message without first verifying the request by phone and encouraged them to report suspected fraud through the company’s customer care channels.
Growing public concern
Although there are no publicly available national statistics on WhatsApp account takeovers in Sierra Leone, authorities have acknowledged that the problem is growing. Concerns over the frequent use of Orange Money accounts to receive funds in these WhatsApp scams have also reached Parliament, where lawmakers have raised the issue.
During the parliamentary sitting of 23 July 2026, Opposition Chief Whip Hon. Abdul Karim Kamara said WhatsApp account hacking had become a daily occurrence in Sierra Leone, but argued that the greater concern was the use of registered mobile money accounts to receive money from victims.
He told Parliament that after a friend’s WhatsApp account was hacked, he received a request to send money to an Orange Money account. To verify whether the account existed, he deliberately transferred Le3, after which the system displayed the registered name linked to the number.
“The problem is not the hacking,” he said. “The problem is that the hackers will give you numbers to send money. When you send the money, the account shows a registered name.”
Hon. Kamara also questioned why similar complaints appeared to involve the same mobile network and called for stronger action to protect customers from fraud.
While responding, Speaker of Parliament Hon. Segepoh Solomon Thomas said the matter had become a national concern and announced that Parliament would invite the Minister of Communication, Technology and Innovation together with the leadership of Orange Sierra Leone to explain the growing reports of WhatsApp-related fraud involving Orange Money accounts.
In a Facebook post on the 25th July, BBC journalist Umaru Fofana said that within two weeks he had counted more than 20 people in his telephone contacts whose WhatsApp accounts had been compromised.
In a July 2024 advisory published on its website, the National Cybersecurity Coordination Centre or NC3, warned of a “surge in WhatsApp takeover attacks” and urged users to adopt stronger security measures. And in a report published by AYV Media, the Deputy Minister of Information and Civic Education, Abdel-Aziz Bawoh, said that cybercriminals are increasingly targeting WhatsApp users.
But the lack of national data makes it difficult to fully understand the scale and patterns of these attacks.
The threat has also affected high-profile public figures. In a Facebook post in July 2025, former United Nations diplomat and Chairman of the Presidential Initiative on Climate Change, Renewable Energy and Food Security, Dr Kandeh Kolleh Yumkella, warned the public against scammers impersonating him on social media and messaging platforms. He urged people to ignore messages claiming to be from him and cautioned that fraudsters were asking members of the public to share their WhatsApp numbers and email addresses before promising a video call.
The problem is not unique to Sierra Leone. In August 2025, Meta announced that it had removed 6.8 million WhatsApp accounts linked to organised criminal scam centres during the first six months of the year as part of a wider crackdown on online fraud. The company said many of the scams relied on social engineering tactics to manipulate victims into revealing sensitive information or sending money. Europol has also warned that cybercriminals are increasingly exploiting stolen digital identities and using artificial intelligence to make online scams more convincing.
Cybersecurity experts weigh in
Cybersecurity experts caution that the actual number of financial losses is likely to be higher because many victims either do not report incidents or are unaware that their contacts have been defrauded.
Richmond Redwood-Sawyerr, Director of Cyber Resilience at the National Cybersecurity Coordination Centre, said WhatsApp account takeovers are likely to be far more common than reported.
“We all know someone who has been hacked, and it appears to be very common and escalating,” he says. “WhatsApp account takeovers remain significantly underreported in Sierra Leone.”
According to Redwood-Sawyerr, one of the most common methods involves convincing victims to provide a verification code sent to their phones, allowing attackers to take complete control of the account. Criminals are also increasingly using artificial intelligence to create realistic images and cloned voices to persuade victims’ contacts to send money.
He said that hackers also employ “zero-click” attacks, which require little or no interaction from victims, particularly where devices have not been updated with the latest security patches.
“It is important to note that anyone who uses an electronic device is potentially vulnerable,” he said. “Cyberattacks are borderless.”
He urged users to practise good cyber hygiene by enabling multi-factor authentication, keeping devices updated, avoiding suspicious links and verifying unusual requests before taking action.
The findings from the 27 reported WhatsApp account takeovers reviewed for this investigation are also consistent with advice published by Meta.
On its official Help Centre, WhatsApp warns users never to share verification codes or PINs with anyone and advises victims of account takeover to immediately re-register their phone number using the six-digit verification code sent by SMS. Meta also recommends enabling two-step verification and reviewing linked devices to remove any unauthorised access.
The experiences shared by victims show that hackers do not rely only on technology. They rely on trust. Whether through fake church meetings, emergency requests for money or AI-generated images, they exploit relationships to deceive people.
Cybersecurity experts at NC3 say simple steps such as enabling two-step verification, avoiding suspicious links and never sharing verification codes can help prevent many of these attacks.
For Isatu Sesay, however, the damage went beyond losing a WhatsApp account. “The hackers hack for money,” she said, “but they destroy so many other things about life.”
This report was produced under the 2026 Kwame Karikari Fact-checking and OSINT Fellowship, co-hosted by DUBAWA and the Digital Technology, Artificial Intelligence, and Information Disorder Analysis Centre (DAIDAC), with support from the Centre for Journalism Innovation and Development (CJID).