SIM swap and account takeover: protecting the number your clients message
How a brokerage loses its WhatsApp number to a SIM swap, a phished code or a linked device — the settings that stop it, and what POPIA requires afterwards.
A step-by-step guide for FAIS-licensed brokerages moving off personal phones: choosing the number, capturing opt-in, writing templates and keeping records.
Most South African brokerages already run on WhatsApp. Clients send claim photos, ask for a certificate before a roadblock, and query a debit order there whether or not the brokerage has decided to be on the channel. The real question is different: is the brokerage using WhatsApp in a way that survives a FAIS audit, a POPIA complaint, or the resignation of a senior representative who owns half the book on a personal handset? Moving from scattered phones to a brokerage-controlled setup is a two-week project, not an IT programme. This is the order to do it in.
"WhatsApp Business" refers to three different things. Choosing the wrong one costs a brokerage months, because migrating a number later means downtime for clients.
| Option | What it is | Fit for a brokerage |
|---|---|---|
| Consumer WhatsApp | The personal app on a representative's phone | No. The record lives on a device the brokerage does not control. |
| WhatsApp Business app | Free app with a business profile, labels and quick replies, tied to one phone | Workable for a one- or two-person operation. Breaks down as soon as several people must answer the same number. |
| WhatsApp Business Platform | Meta's API, used through a business solution provider or a CRM | Yes for a team. One number, many handlers, message templates, and conversations retained at brokerage level. |
A phone number can only live in one of these at a time. A number already registered on the Business app can generally be migrated to the platform, but the move is one-way in practice, so decide before you advertise the number.
The number is an asset of the business, not of the person who answers it. Practical rules that save trouble later:
Two separate rulebooks apply, and brokerages routinely confuse them. Meta requires an opt-in before a business sends the first template message to a person. POPIA governs whether the brokerage may process the client's information for that purpose at all, and section 69 sets specific conditions for direct marketing by electronic communication. Servicing an existing policy is not the same thing as marketing a new one — that distinction is worth reading in full in our note on POPIA, consent and what a broker may send on WhatsApp.
What to put in place before you switch the number on:
Outside the 24-hour window opened by a client's own message, the brokerage can only send pre-approved templates. Meta classifies them as utility, marketing or authentication, and will re-categorise a template if the wording does not match the category claimed. Promotional language inside a "utility" template is the most common reason a brokerage's messages start being treated — and priced — as marketing.
| Template | Category | Note |
|---|---|---|
| Renewal is due on [date], here are your terms | Utility | State the policy and the date. No upsell in the same message. |
| Your debit order did not go through | Utility | The highest-value template a brokerage owns. See our lapse-risk sequence. |
| Claim received, this is your reference | Utility | Sets expectations and cuts inbound "any news?" traffic. |
| Documents requested for your application | Utility | Attach or request; keep the list short and specific. |
| We can now quote you on [product] | Marketing | Needs the section 69 basis and an objection route in the message. |
Five templates cover most of what a brokerage sends. Write them in plain language, have the compliance officer approve the wording once, and stop improvising.
A shared inbox is the point of the exercise. Inbound messages land in one queue; conversations are assigned to the representative who owns the client or picked up by whoever is free; the client record — policies, renewal dates, premium status, last contact — sits next to the thread so the reply is informed. Every message is attributed to a named person, which matters because advice given on WhatsApp is still advice rendered by a representative.
Record-keeping is where the FAIS General Code of Conduct bites. Client records must be kept in an appropriate electronic form, be readily accessible, and be available for inspection on request within the period the Code allows — with advice records retained for five years after the product terminates or the service is rendered. A conversation on a representative's personal phone meets none of that. A conversation in a brokerage system meets all of it without anybody doing extra work.
WhatsApp scores each business number on how recipients react. Blocks and "report" taps push the quality rating down and can cut the number of unique clients the brokerage may message per day. The defences are unglamorous:
Week one: choose and verify the number, complete business verification, agree opt-in wording with the compliance officer, and draft the five templates. Week two: connect the number to the shared inbox, import the client records so conversations have context, submit the templates for approval, and run a pilot with one team and a few hundred clients. Announce the number to the rest of the book only once the pilot team has answered a week of real traffic. Other brokerages in the region — and their counterparts covered across our Africa section — consistently find that the pilot surfaces process gaps, not technical ones.
They can, but the brokerage carries the risk: no record for a complaint or an FSCA inspection, no continuity when the person leaves, and client personal information sitting on an unmanaged device. Most brokerages move the book to a business number and keep personal numbers for colleagues only.
Usually yes. A number registered on the WhatsApp Business app can generally be migrated, and a landline can be verified by voice call. Plan a quiet window for the switch and tell clients nothing is changing on their side.
Apply the brokerage's existing retention policy for client communications, built on the FAIS record-keeping requirements — advice records are kept for five years after the product terminates or the service is rendered. The channel does not change the obligation.
No. When a client messages you, a 24-hour service window opens and the team can reply freely. Templates are for messages the brokerage starts, or for replies sent after the window has closed.
The WhatsApp setup is identical; the compliance frame is not. NAMFISA, NBFIRA and the IRA each have their own conduct and record-keeping expectations, and data-protection law differs by country. Map the requirements per licence before extending the same number across borders.
Shared WhatsApp inbox, client records, follow-ups and opportunities for the whole brokerage. 15-minute demo.
How a brokerage loses its WhatsApp number to a SIM swap, a phished code or a linked device — the settings that stop it, and what POPIA requires afterwards.
Registry papers, a display name clients recognise, two-step verification: what Meta checks before a brokerage number can scale, and what the badge is worth.
Meta bills WhatsApp per message delivered. Which of a broker’s messages are charged, which are free inside the service window, and how to budget a month.