SIM swap and account takeover: protecting the number your clients message
How a brokerage loses its WhatsApp number to a SIM swap, a phished code or a linked device — the settings that stop it, and what POPIA requires afterwards.
Half the premium reminders did not send. What a WhatsApp messaging limit counts, how tiers and quality rating work, and how to run a month-end batch safely.
It is the 25th, the unpaid-premium report is out, and someone in the office queues a reminder to eleven hundred clients. Four hundred go out. The rest sit there with an error nobody in the brokerage can decode. Nothing is broken and nobody has been banned — the firm has simply run into two separate ceilings that the WhatsApp Business Platform applies to every business on it, and neither of them appears anywhere in the brokerage's own procedures.
This is the part of setting up WhatsApp Business for a brokerage that only becomes visible once the book is big enough to matter, which is to say once it is worth doing at all.
A messaging limit is the maximum number of unique client phone numbers you can deliver messages to, outside an open customer service window, in a moving 24-hour period. Three things follow from that definition, and each one surprises somebody.
For a brokerage this is mostly good news. Conversational service — claims, queries, document collection — is essentially unconstrained. It is the batch, the month-end premium reminder run, that meets the ceiling.
Meta's documentation sets out the progression as follows.
| Tier | Unique recipients per 24 hours | How you get there |
|---|---|---|
| Starting | 250 | Where every newly created business portfolio begins |
| Second | 2,000 | Verify the business, be verified by a partner, or deliver 2,000 messages to unique numbers outside service windows over a moving 30-day period using high-quality templates |
| Third | 10,000 | Automatic scaling |
| Fourth | 100,000 | Automatic scaling |
| Top | Unlimited | Automatic scaling |
Two details in that table cause most of the confusion in broking firms. First, the limit is calculated and set at business portfolio level and shared across every business phone number in the portfolio — so a group with a short-term number, a life number and a funeral number does not get three allowances. Second, the increases are automatic rather than requested: Meta looks at whether you are sending high-quality messages across your numbers and templates and whether you used at least half your current limit in the last seven days, and it can raise the tier within six hours of you qualifying. A firm that never uses more than a third of its allowance will sit on the same tier indefinitely, wondering why nothing moves.
Every business number and every template carries a quality rating — high, medium or low — derived from how recipients reacted over roughly the last seven days, with recent messages weighted more heavily. The inputs that matter are the ones the client controls: blocking the number, reporting the business, and simply not opening what you send. Meta's template quality guidance is explicit that low read rates count against a template alongside negative feedback.
Three habits push a brokerage's rating down faster than anything else:
If a number's rating stays flagged, the messaging limit can drop by a level — which is how a firm that was comfortably sending ten thousand finds itself back at two thousand in the middle of a renewal season.
There is a second ceiling that has nothing to do with your tier. Meta applies a per-recipient cap on marketing template messages: if a person has already received a certain volume of marketing on WhatsApp that day — from any business — further marketing templates to them are simply not delivered, and the sender gets error 131049, "this message was not delivered to maintain healthy ecosystem engagement". Meta does not publish the number, and it is not a penalty against your account. Utility and authentication templates are not subject to it.
The practical consequence for a broker is worth stating plainly, because it changes how you categorise messages. A premium reminder, a renewal notice, a failed debit order notice and a claim update are genuinely utility content: they concern an existing policy and a transaction the client is already in. Categorised correctly, they are not competing with a retailer's promotion for space in the client's inbox. Written as a sales pitch and submitted as marketing, the same message can silently fail to arrive on exactly the day it mattered. If you are unsure which side a message falls on, the template categories are worth reading before you draft rather than after a rejection.
The uncomfortable truth is that messaging limits mostly punish behaviour that was already a bad idea. A brokerage that sends fewer, better-targeted, correctly categorised messages to clients who asked to hear from it will climb the tiers automatically and never think about any of this again. One that treats WhatsApp as a bulk SMS gateway will keep meeting the ceiling, and eventually meet it from below.
No. The limit only counts business-initiated messages sent outside an open customer service window. Once a client messages you, the 24-hour window is open and your replies in that window are outside the limit entirely. This is why conversational service work — claims, queries, document collection — almost never runs into it, and why batches do.
No. Messaging limits are calculated at business portfolio level and shared across all the business phone numbers in that portfolio. Splitting a large send across numbers in the same portfolio to dodge a ceiling does not work, and spreading poor-quality sending across several numbers can drag the quality rating on all of them.
Beyond the first step, you do not ask — it happens automatically. Verifying the business moves a new portfolio off the starting tier; after that, Meta raises the limit when you are sending high-quality messages across your numbers and templates and have used at least half your current limit in the preceding seven days, with the increase applied within about six hours of qualifying. Consistently under-using your allowance keeps you where you are.
Do not retry immediately — the cap belongs to the recipient and will still be in force. Check whether the message really needed to be a marketing template: policy and claim communications about an existing contract usually belong in a utility template, which is not subject to the per-recipient marketing cap. If it genuinely is marketing, reduce how often you send it and improve who receives it.
Rating reflects recipient feedback over a rolling recent period, so it improves as newer, better-received sends replace the bad ones — but it will not recover if you keep sending the same template to the same list. Pause that template, rewrite it, tighten the audience to clients with a live relationship and a clear opt-in, and let a few good cycles pass before scaling volume again.
Shared WhatsApp inbox, client records, follow-ups and opportunities for the whole brokerage. 15-minute demo.
How a brokerage loses its WhatsApp number to a SIM swap, a phished code or a linked device — the settings that stop it, and what POPIA requires afterwards.
Registry papers, a display name clients recognise, two-step verification: what Meta checks before a brokerage number can scale, and what the badge is worth.
Meta bills WhatsApp per message delivered. Which of a broker’s messages are charged, which are free inside the service window, and how to budget a month.