Identity theft happens when someone uses your personal details without permission to obtain money, open an account, register a SIM card, impersonate you, or access services in your name. In Zambia, stolen information may include a National Registration Card number, mobile phone details, bank credentials, a tax number, employment records, or mobile money PINs.
The effects can spread quickly. A criminal who gains control of a phone number may intercept one-time passwords, while a person using a copied NRC may attempt to borrow money, register a business, or create an account that later becomes associated with you. Acting early can limit losses and create a clear record that you reported the fraud.
This guide provides general information for people in Zambia dealing with impersonation, account takeover, SIM swap fraud, mobile money theft, or misuse of official documents. For wider guidance on personal finance, scams, and practical issues, Je-Phiri's guidance can provide useful background, but serious financial, legal, or medical matters may require advice from the relevant professional or authority.
Identity fraud is sometimes discovered through a direct financial loss, but unusual activity may appear first. You could receive a bank notification for a transaction you did not make, a mobile money message showing an unfamiliar transfer, or a loan reminder for an application you never submitted. Other signs include unexpected password-reset messages, failed login alerts, or calls from institutions discussing an account you do not recognise.
A sudden loss of mobile network service is especially important when it happens without a known network problem. It may indicate that somebody requested a replacement SIM card or transferred your number to another SIM. Be alert if friends say they received strange messages from your number, or if you stop receiving banking verification codes.
Physical documents can also be misused. Missing NRC copies, passport pages, payslips, bank statements, employment letters, and signed forms may help a fraudster appear credible. Keep a written timeline showing when you noticed each warning sign, what information may have been exposed, and which organisations you contacted.
Do not dismiss a small unauthorised transaction. Criminals sometimes test whether an account is active before attempting larger withdrawals, purchases, or transfers. A small loss can therefore be an early opportunity to stop further misuse.
Use a trusted phone or computer to contact your bank, mobile money provider, and other affected services. Ask them to freeze, restrict, or review suspicious transactions and to block compromised cards, online banking access, wallets, or beneficiaries. Do not rely solely on replying to a suspicious SMS or calling a number provided in an unexpected message.
If your phone number may have been taken over, contact your mobile network operator through an official shop, verified call centre, or published contact channel. Ask whether a SIM replacement, number port, or account change occurred. Request a replacement SIM only after the operator verifies your identity, and ask what safeguards can be placed on future changes.
Change passwords beginning with your email account, because email often controls password resets for other services. Use separate passwords for banking, email, social media, and shopping accounts. Enable multi-factor authentication where available, preferably through an authenticator application rather than SMS when that option is supported.
Never share a PIN, password, one-time password, card security code, or mobile money approval code with someone claiming to be a bank employee, police officer, network agent, or government official. A legitimate organisation may verify your identity, but it should not ask you to disclose confidential authentication codes.
Report unauthorised activity to the affected bank or financial service as soon as possible. Give the date, amount, account or wallet involved, transaction reference, recipient details, and the time you first noticed the problem. Ask for a complaint or case reference number and keep the name of the staff member who received the report.
Follow up in writing where possible. A branch visit, email, or formal complaint creates a record that can help if the matter is later disputed. Ask the institution to investigate how the transaction was authorised, whether access credentials were changed, and whether any pending transfers, cards, loans, or beneficiaries should be stopped.
Save screenshots, SMS messages, emails, call logs, account statements, receipts, and social media conversations. Keep original files rather than editing them. Record the numbers used by suspected fraudsters and note whether you gave out any information, clicked a link, installed an application, or visited a particular agent.
| Situation | Immediate action | Evidence to retain |
|---|---|---|
| Unauthorised bank transfer or card payment | Ask the bank to block access or card use and open a fraud case | Statement, transaction reference, alerts, complaint number |
| Mobile money theft | Contact the network provider and request wallet restrictions or investigation | SMS confirmation, sender number, wallet number, time and amount |
| Suspected SIM swap | Report the loss of service and verify recent SIM changes | Network messages, dates of service interruption, replacement details |
| Loan or account opened in your name | Notify the lender in writing and dispute the application | Loan notices, NRC details used, account numbers, correspondence |
| Stolen identity documents | Report the theft and ask the issuing authority about replacement | Police report, copy of missing document, replacement application |
Avoid deleting suspicious messages before you have backed them up. If a device may contain malware, photograph important information from another device and seek technical assistance before resetting it. A full reset can remove useful evidence, although securing your accounts remains more important if the device is actively compromised.
Make a report to the Zambia Police Service, particularly when money was stolen, documents were forged, threats were made, or an account was opened using your details. Take your NRC or other identification, transaction records, screenshots, phone numbers, and the complaint references from banks or network operators. Request a police report or occurrence reference and keep it safely.
Where the incident involves electronic communications, online fraud, a malicious website, or misuse of a digital platform, you may also report it through the appropriate cybercrime or communications channels. The Zambia Information and Communications Technology Authority, commonly known as ZICTA, has roles connected with communications regulation and cyber-related public complaints. Check its current official reporting instructions before submitting sensitive information.
If an organisation collected or exposed your personal information improperly, consider contacting the Office of the Data Protection Commissioner. Zambia’s data protection framework gives individuals rights concerning personal data and places responsibilities on organisations that process it. Ask the organisation what information was involved, when the incident occurred, and what steps it has taken to contain the exposure.
Use official websites and verified contact details when reporting. Scammers sometimes exploit victims a second time by promising to recover lost funds for an upfront payment. Police, banks, regulators, and network providers will not require you to send money to a stranger’s personal number in order to “unlock” your account.
If a lender, bank, employer, insurer, or service provider has created a record using your identity, dispute it formally. Explain that you did not apply for or authorise the account, attach the police reference and supporting documents, and request that the record be marked as disputed while an investigation takes place.
Ask for written confirmation when an account is closed, a loan is cancelled, a transaction is reversed, or an incorrect record is amended. Keep copies of every letter and email. If the institution does not resolve the complaint, escalate through its internal complaints process and then consider the relevant regulator or consumer protection channel.
Check your bank statements and mobile money history regularly for several months. Review salary deductions, loan reminders, card activity, email login alerts, and social media sessions. If credit-reporting services operate in relation to your accounts, ask how to obtain and review your credit information for unfamiliar applications or enquiries.
Replace compromised documents according to the issuing authority’s process. A police report may be required for a lost or stolen NRC, passport, driver’s licence, or other document. Do not circulate a full scan of your replacement document unnecessarily; when a copy is required, ask why it is needed and whether sensitive details can be masked.
Reduce the amount of personal information shared publicly. Avoid posting clear images of your NRC, passport, payslip, bank card, travel document, or appointment letter on social media. Be cautious with online forms that request several identifiers when the organisation’s identity and purpose are unclear.
Treat urgent messages with suspicion, especially those claiming that your account will be closed, your parcel is held, or your mobile line will be disconnected. Open the official application or type the organisation’s known web address yourself instead of clicking an unsolicited link. Fraudsters often use familiar logos, copied names, and convincing Zambian phone numbers.
Secure your phone with a strong screen lock and keep its operating system and banking applications updated. Review installed applications and remove those you do not recognise. Do not allow another person to register a SIM, mobile wallet, or banking service on your behalf unless the provider’s formal process clearly permits it and you understand the risks.
When making photocopies of identification, write the intended purpose and date on the copy where appropriate, without covering information the receiving organisation must verify. Store original documents securely and limit access to account statements, PIN mailers, tax records, and employment files.
Recovering from impersonation can take time, especially when several institutions are involved. A calm written record helps you explain the same facts consistently and makes it easier to track which organisation is responsible for each action.
Start with the account or phone number that could cause the greatest immediate loss, then work through the remaining services. Keep following up using official channels until access is secured, fraudulent records are disputed, and the relevant authorities have received your report. Acting today can prevent a stolen detail from becoming a larger financial and legal problem.