SIM swap and account takeover: protecting the number your clients message
How a brokerage loses its WhatsApp number to a SIM swap, a phished code or a linked device — the settings that stop it, and what POPIA requires afterwards.
Registry papers, a display name clients recognise, two-step verification: what Meta checks before a brokerage number can scale, and what the badge is worth.
The connection part usually goes fine. A principal spends twenty minutes in the WhatsApp wizard, the number registers, a test message lands, everyone moves on. Then the awkward questions start. Why do clients still see a bare phone number instead of the firm's name? Why is the account stuck at a low sending tier while the renewal run is waiting? And why did the display name request come back rejected with no explanation? All three trace back to the same place: Meta's business verification, and the two separate approvals that sit on top of it.
Brokerages lose weeks here because they treat verification as one switch. On the WhatsApp Business Account it is three distinct gates, each with its own reviewers and its own failure modes.
Business verification is Meta confirming that the legal entity behind your business portfolio exists, that the name you typed matches an official record, and that the address and phone number you gave belong to it. It is the gate that matters commercially: it is what lets a portfolio move past the starter limits, add more sender numbers and use billing features properly. Nothing about it is client-facing.
Display name approval is a separate review of the name that will appear above your messages. It can be rejected while the business itself is verified, and it is the one brokerages most often get wrong.
Official Business Account status — the blue checkmark next to the name in a contact view — is the third gate and the only optional one. Meta lists five conditions together: the business complies with the WhatsApp Business Messaging Policy, the number has been registered on the platform for at least 30 days, the business portfolio that owns the number has been verified through business verification, two-step verification is enabled on the number, and the display name has been approved. On top of those, Meta only awards the badge to businesses it considers notable, meaning a substantial presence in news coverage from publications with sizeable audiences. A twelve-person brokerage in Pretoria or Accra rarely clears that bar, and that is fine.
Meta does not publish a per-country document list, but the review is testing three simple things. Assemble the paperwork against those three, in the entity's exact legal name, before you open the form.
| What Meta is testing | What a brokerage usually supplies |
|---|---|
| The legal entity exists under the name you entered | Registry output: CIPC company or close-corporation documents in South Africa, a CAC certificate and status report in Nigeria, a BRS certificate of incorporation and CR12 in Kenya, BIPA papers in Namibia, a Registrar-General certificate in Ghana |
| The business address is real and belongs to you | A recent municipal or utility bill, bank statement or signed lease, dated within a few months, in the entity name and not the principal's personal name |
| The phone number belongs to the business | A telecoms invoice or bank statement showing the number, or a business document that carries it |
The most common rejection is a mismatch that looks trivial to a human. "Mbeki and Partners Insurance Brokers (Pty) Ltd" on the CIPC record and "Mbeki Partners Brokers" on the form is a mismatch. So is a suburb spelled differently, an old address the registry never got updated, or a trading name entered where the registered name was asked for. Fix the registry record first if it is out of date; every hour spent there saves a rejection cycle.
Meta expects the display name to relate to the business and to match how the brand appears on your own website — capitalisation, spacing and all. That collides with how brokerages are structured. Many trade under a name that differs from the registered entity, sit under a group brand, or hold their licence in a name nobody outside the firm has ever seen.
The practical rule: pick the name a client would read on your website, your quote documents and the sign on the door, make sure that exact string appears prominently on the site Meta will look at, and keep the licensing detail where it belongs. Under the FAIS General Code of Conduct a provider still has to disclose its full business or trade name, legal status and licence details to clients — and the WhatsApp business profile, with its description, address, email and website fields, is a sensible place to carry the FSP number and a link, rather than stuffing it into the display name and getting the name rejected. Brokerages in Nigeria and Kenya face the same split between the name registered with NAICOM or the IRA and the brand clients actually know.
Usually not as a goal in itself. A rejected Official Business Account request cannot be resubmitted for 30 days, and notability is not something a regional brokerage can manufacture honestly. What does pay back is everything underneath it: complete business verification, get the display name approved so clients see the firm rather than a number, and turn on two-step verification because it protects the number regardless.
Recognition comes from elsewhere anyway. A client who saved your number after receiving a quote sees their own saved contact name, not Meta's badge. That is why opt-in links and QR codes on your website, email signature and renewal letters do more for trust than the checkmark: the client initiates, the number lands in their address book with a name attached, and the conversation starts from a place they chose.
Once the account is live, most of this becomes a monitoring job. In ORIS the WhatsApp screen shows the connected number, display name, business name, verified-business state and quality rating side by side, so a principal can see at a glance whether the firm is presenting itself the way it intends and whether a template was rejected. To see what that looks like against your own setup, book a demo.
Yes. An unverified portfolio can register a number and message a limited number of unique contacts per day, which is enough for testing and a small pilot. Verification is what removes that ceiling and allows the account to grow, so start it early rather than when a renewal campaign is already blocked.
Not in itself. Business verification is run against the registered entity, while the display name is judged on its relationship to the business and its consistency with your website. Trouble starts when the two are swapped in the forms, or when the trading name appears nowhere Meta can check.
Meta does not commit to a turnaround, and reported experience varies widely depending on how clean the documents are. Plan for longer than a week and treat a request for additional documents as normal rather than as a rejection.
No. Messaging rules, template categories and opt-in requirements are identical with or without it. The badge affects how the account is presented, not what the platform permits, so it should never be the reason a compliance decision waits.
Work out which of the three gates failed before resubmitting anything. A verification rejection is almost always a document mismatch and can be corrected quickly; a display name rejection needs a different name or a change to your website; an Official Business Account rejection carries a 30-day wait and rarely succeeds on a second identical attempt.
Shared WhatsApp inbox, client records, follow-ups and opportunities for the whole brokerage. 15-minute demo.
How a brokerage loses its WhatsApp number to a SIM swap, a phished code or a linked device — the settings that stop it, and what POPIA requires afterwards.
Meta bills WhatsApp per message delivered. Which of a broker’s messages are charged, which are free inside the service window, and how to budget a month.
Half the premium reminders did not send. What a WhatsApp messaging limit counts, how tiers and quality rating work, and how to run a month-end batch safely.