As account takeovers surge across Togo, the national cybersecurity incident response team, CERT.tg, has issued an urgent directive outlining three critical security measures to safeguard WhatsApp accounts.
Understanding the Attack Vector and Ecosystem Vulnerabilities
Threat actors routinely masquerade as trusted entities, creating panic or urgency to bypass operational security hygiene.
The Three Mandatory Safeguards Outlined by CERT.tg
To neutralize unauthorized SIM-swap and token-intercept tactics, CERT.tg mandates three immediate technical controls for every user on the platform.
- Two-Step Verification (2FA): Users must navigate to Settings > Account > Two-Step Verification to establish a persistent six-digit Personal Identification Number (PIN).
- Recovery Email Integration: The security protocol explicitly requires linking a valid recovery email address during the 2FA setup process.
- Absolute Credential Secrecy: CERT.tg labels this rule the most fundamental: never share a six-digit verification code or a custom PIN with anyone. Neither WhatsApp, administrative bodies, nor personal contacts will ever solicit these tokens. Any inbound request for these strings must be treated as a confirmed hostile compromise attempt—even if it appears to originate from a known contact whose profile is already under enemy control.
Incident Recovery Protocols for Compromised Endpoints
CERT.tg outlines a specific recovery sequence to force session termination.
Victims must attempt a fresh re-registration using their original phone number. The recovery playbook dictates selecting verification via voice call, ensuring the physical SIM card remains inserted in the device, and disabling Wi-Fi to force cellular data routing. If this programmatic recovery fails, technical assistance is available directly through CERT.tg by contacting +228 70 54 93 25 or visiting their official portal at cert.tg.
