Tourism keeps Victoria Falls running. Hotels, lodges, tour operators, travel agents and transfer drivers handle bookings, deposits and guest details every day. Most of that work is done by email and WhatsApp. That is exactly why these businesses are being targeted.
Good cybersecurity for hospitality businesses does not have to be complicated or expensive. This article is written for owners and staff of hospitality businesses. The most common attacks are explained in plain terms. Practical steps are then given that can be put in place this week, most of them at no cost.
Why hospitality businesses are targeted
Criminals look for places where money moves quickly and checks are light. Tourism businesses fit that description.
- Large deposits are paid by bank transfer, often from overseas clients.
- Bookings are confirmed by email and WhatsApp, not through a secure portal.
- Many suppliers, agents and partners are involved in a single trip.
- Staff change with the season, and devices and passwords are often shared.
- Guest Wi-Fi is often run on the same network as the office computers.
A single compromised mailbox can be used to redirect payments, deceive clients and damage a reputation built over many years.
The most common attacks
Invoice and payment fraud
An invoice is sent with “updated” bank details. It looks genuine because it often comes from a real supplier’s mailbox, or from an address that is almost identical. The money is paid into the criminal’s account, and the loss is usually discovered only when the real supplier asks for payment.
Mailbox takeovers
A staff member is tricked into entering a password on a fake login page. The criminal then signs in quietly and reads the mailbox for weeks. Rules are often created to forward or hide emails, so that replies from clients are never seen. The criminal waits for the right moment, then sends a payment request from the real account.
Email spoofing and look-alike domains
Emails can be made to look as if they come from your business, even if your mailbox is never touched. This is possible when the domain is not protected with SPF, DKIM and DMARC records. Look-alike domains are also used, such as an extra letter in the name or a different ending.
Fake booking platform and supplier messages
Messages that appear to come from booking platforms, airlines or payment providers are used to steal logins. Guests are sometimes contacted directly with a fake “payment link” for their stay. The guest pays, and the business is blamed.
WhatsApp account takeovers
A message is received asking for a verification code “sent by mistake”. Once the code is shared, the WhatsApp account is taken over. The account is then used to ask contacts for money or to send fake payment details. Our article on WhatsApp Business takeovers in Zimbabwe explains this in more detail.
Shared devices and open Wi-Fi
When one computer and one password are shared by the whole front office, nobody can tell who did what. When guest Wi-Fi is connected to the office network, office computers are exposed to anyone in the building.
A self-help checklist
The following steps reduce the risk significantly. Most of them can be done by the business owner or office manager.
- Verify every change of bank details by phone. Use a number already on file, never the number in the email. Make this a rule for all staff.
- Require two people for large payments. One person captures the payment and another approves it.
- Switch on multi-factor authentication for every email account, including shared mailboxes.
- Check mailbox rules and forwarding once a month. Remove any rule that nobody can explain.
- Protect your domain. Ask your provider to confirm that SPF, DKIM and DMARC are set up. A free check can be run with our Domain Health Check.
- Switch on WhatsApp two-step verification. Never share a verification code with anyone.
- Give each staff member their own login. Remove access on the day someone leaves.
- Separate guest Wi-Fi from office Wi-Fi. Guests should never be on the same network as reservations and accounts.
- Keep devices updated and use reputable security software on every computer.
- Back up booking and accounting data to a location that cannot be changed by ransomware.
- Train your staff. Most attacks start with one convincing message. Short, regular training is the most effective defence.
Warning signs to watch for
- A supplier or client suddenly changes bank details or asks for urgency.
- Replies to emails you never sent, or emails missing from your inbox.
- Clients say they received a payment request that you did not send.
- Login alerts from unfamiliar countries or devices.
- WhatsApp contacts say they received strange messages from your number.
What to do if it happens
Speed matters. The first hour often decides whether money can be recovered.
- Call your bank immediately and ask for the payment to be stopped or recalled.
- Change the affected passwords and sign out all active sessions.
- Remove any unknown mailbox rules, forwarding addresses and connected apps.
- Warn your clients and suppliers not to act on recent payment requests.
- Report the incident to the police and keep copies of all emails and messages.
- Notify POTRAZ if personal data was affected. Under Zimbabwe’s Cyber and Data Protection Act, breaches must be reported to POTRAZ within 24 hours. Affected people must be informed within 72 hours where the risk to them is high.
POTRAZ began compliance inspections on 1 September 2026, so incident handling is now a legal matter as well as a business one.
How Iteb Co can help
Iteb Co has an office in Victoria Falls and works with tourism and hospitality businesses across Zimbabwe. Our services include:
- Email security and domain protection
- Security awareness training and phishing simulations
- Managed IT support for lodges, hotels and tour operators
A Free Cybersecurity Assessment can be booked to identify the gaps in your email, domain and devices. For staff training, see our Security Awareness Training page, or contact our Victoria Falls team directly.