MTN Mobile Money and Airtel Money are central to everyday payments in Zambia, from market purchases to rent, school fees and family support. A compromised wallet can therefore create immediate cash-flow trouble, especially when a stolen phone also exposes the SIM, one-time codes and linked bank accounts.
“Hacked” can describe several different attacks: malware, a stolen PIN, a SIM swap, or a fraudster convincing an agent or customer to approve a payment. The correct response starts the same way: stop further activity, preserve evidence and use official provider and banking channels. For Australians with a Zambian wallet, a remittance account or family links in Lusaka, both sides of the transaction may need to act.
If money is moving from the wallet, call the provider’s official fraud or support number immediately. Ask for the wallet and linked accounts to be suspended or locked, including outgoing payments, cash-in and cash-out facilities, linked cards and pending authorisations. A temporary block is more useful than waiting until the remaining balance reaches zero.
Use a trusted device to access the official app or dial the provider’s known USSD menu. Avoid links and phone numbers supplied through suspicious messages. If the phone is missing, contact the mobile carrier separately to block the SIM and prevent number transfers or porting. Changing only the wallet PIN will not stop someone using a replacement SIM.
Tell every linked bank or remittance provider what has happened. Ask the bank to flag unusual beneficiaries and outgoing transfers connected to the exposed account. A genuine mobile-money agent never needs your PIN, password or one-time code, even when claiming to be arranging a reversal or checking a “failed” transaction.
From a clean device, change the mobile-money password and PIN, revoke unknown sessions and enable multi-factor authentication where available. Do not reuse the wallet password for email, banking or social media. If malware may be present, preserve the information needed for an investigation before restoring the phone or deleting suspicious applications.
Review payees, standing instructions, linked bank accounts, cards, merchant permissions and recent login activity. Remove unknown recipients and remove or suspend unfamiliar payment connections. Ask the provider which services remain linked if you cannot see the full list, because an app password reset may not terminate access through USSD menus or authorised agents.
The phone number itself may also need securing. Change the carrier account password, establish a porting or transfer lock and protect the associated email account. A password reset message may arrive while the original phone is in someone else’s hands, so read messages carefully before approving any change to a number, address or recovery email.
Take screenshots of unauthorised transactions, account balances, beneficiary names, confirmation messages, transaction references, dates and times. Save relevant SMS messages, emails and call logs without editing them. Record the phone number involved, the device used and whether the phone was lost, stolen or left unattended. Do not publish these materials on social media.
Write a simple chronology separating what you directly observed from what you suspect. For example, record that an unknown transaction of a stated amount appeared at a stated time and that your SIM was replaced the previous day. Avoid describing a disputed payment as “hacked” if nobody has confirmed that a system intrusion occurred; the facts will support an investigation more effectively.
Keep the original evidence in a secure folder and make an encrypted backup where practical. Give copies to the wallet provider, police or another official investigator rather than surrendering your only phone or original identification. Keep every case number, receipt, reference number and written response, since these details may be needed when tracing the money or disputing a linked bank transaction.
Contact the wallet operator and mobile carrier as separate organisations. Obtain provider contact details from its official website, application or printed statement rather than from an unsolicited SMS. Ask the fraud team to open a case, document which transactions are disputed and explain whether a recall, internal trace or security hold has been requested.
For an incident in Zambia, use the relevant fraud-reporting channels of the Zambia Police, including an anti-online fraud unit where available, or report through a local police station. Device compromise and suspected cyber intrusion may also need to be reported to Cyber Security and ICT Services, commonly known as C-sZ. Bank of Zambia’s official channels are relevant where regulated bank accounts or payment systems are involved.
Give every authority the same clear account of events. Follow official instructions about document submission, provide copies unless originals are specifically required, and retain proof that each report was filed. Reporting does not guarantee a refund, but it creates the official trail needed for tracing, sanctions against compromised accounts and any later legal claim.
Ask the wallet provider to trace the destination of each disputed payment and request a recall or reversal, particularly when a transfer is still pending. Provide the transaction reference, recipient name, timestamp, amount and the phone number used. When money has already reached another wallet, a successful recovery may depend on the receiving provider cooperating, so the originating provider should open the trace promptly.
A completed international transfer is usually harder to reverse than a pending domestic card payment. If an Australian bank or remittance company sent the money, report it there as well, since that institution may hold records the Zambian provider cannot access. Exchange-rate differences, weekends and the time needed to contact overseas institutions can reduce the practical value of a disputed amount.
Business owners should also request a payee audit and identify where approval controls failed. Readers running cross-border businesses can use an industry body such as Bourgogne Industries as one external reference when reviewing segregation of duties, device security and staff escalation procedures; the Zambian provider and regulator remain the authoritative sources for the wallet itself.
A SIM swap can be part of an identity takeover rather than a simple theft. Ask the carrier to explain what changed, block further porting and secure the account. If the exposed information included a national ID, passport or other identity document, notify the issuing authority, police and financial institutions so they can place appropriate warnings against the affected identifiers.
After an incident becomes known, recovery scams often follow. Fraudsters may claim they can trace the money, hack the recipient or access a reserve account, but they may demand an upfront fee, remote access to your phone, a one-time code or a transfer to a supposed “safe” wallet. Verify every offer through the provider’s official contact details and do not allow an agent to take control of your device.
Stolen money may have been intended for housing repairs, household needs or a business deposit. Resist taking on debt during the shock of the loss. A careful review of home improvement loans can help separate affordable borrowing from another financial emergency, while an independent credit counsellor can assess existing obligations before another agreement is signed.
For readers in Melbourne or Sydney, contact the Australian bank and actual mobile carrier—Telstra, Optus, Vodafone or another provider—straight away, and use ReportCyber for cybercrime reporting. Australian banks may be able to recall a pending domestic transfer or block a card, but a completed transfer into a Zambian wallet follows another system and may not carry the same protections. PayID, BPAY and buy-now-pay-later accounts must also be checked because locking the wallet does not automatically lock those services.
Language matters when relatives in Lusaka and Australia coordinate a response. Australian customers often call phone-based payment apps “mobile wallets”, while “mobile money” is the usual Zambian term, so identify both the operator and service. A code word can confirm a genuine family call, and written notes should avoid Australian shorthand such as “sorted it”, which may suggest the loss has been resolved when the funds are still missing.
Keep the Zambia and Australia workstreams on one incident sheet without combining sensitive PINs, passwords or one-time codes. The following sequence gives each person a clear role while avoiding duplicated or conflicting reports:
The lesson to remember is that speed limits further losses, accurate evidence improves the possibility of recovery, and official channels remain safer than anyone promising a secret recovery method.