Hacked Wave accounts: how fraudsters operate and how to protect yourself

The message has been doing the rounds on social media since late last week: Wave accounts emptied, sometimes of several hundred thousand CFA francs, without their holders having approved a single transaction.

The most widely shared account comes from journalist Ouley Mané. According to her, her husband’s account was debited by more than one million CFA francs in a transaction linked to a hidden number. She says Wave, when contacted, denied any responsibility. A police officer described a similar experience on TikTok, and several victims mention numbers that are said to be Ivorian.

Other accounts, reported by Senenews, describe an even more painful scenario: the salary transferred from the bank does arrive on Wave, then vanishes a few hours later. With the school year just starting, the month’s rent, food and school fees disappear with it.

Accounts emptied “without a code”: what do we actually know?

Several victims insist they never shared any code. At this stage, neither Wave nor the investigators have publicly explained these specific cases, and no official statement from the company had been reported as of 6 October.

Caution is therefore needed. But cases already tried in court or broken up by the police show that, in the vast majority of cases, the way in is not some spectacular technical flaw: it is the user, pushed into tapping a link, entering their details or handing over a code without understanding what they are approving.

The scheme uncovered in Côte d’Ivoire

A case uncovered by Côte d’Ivoire’s Platform for the Fight against Cybercrime (PLCC) helps explain how it works. A 35-year-old man was arrested in Yopougon, in Abidjan. For almost a year, he allegedly used fraudulent tools bought on Telegram, according to a Life TV report picked up by Exclusif.net.

The scheme, as described in the report, works in four steps:

• 1. A text message promises a Wave bonus or gift, with a link to open.
• 2. The link leads to a copy of the platform, which asks for personal details and account information.
• 3. The fraudsters receive this information in real time and immediately enter it in the real app.
• 4. The victim then receives a genuine confirmation code by text message, which the fake page asks them to copy in: the last key the fraudsters were missing.

The losses attributed to this network amount to 169,749,259 CFA francs. Investigators reportedly seized a vehicle, a computer and 41 smartphones. Also in Côte d’Ivoire, another network, broken up earlier around a fake “Wave gift”, accounted for 503 complaints and 231,257,725 CFA francs. No link has been established with the Senegalese victims, but the method itself needs no visa to travel.

What Wave says, and what consumer groups are asking for

Wave has not commented publicly on these new cases. Its security guidelines, however, are clear: access to the account is protected by a four-digit secret code, required for every transaction, and the company stresses that it never contacts customers to “secure” or “unblock” an account.

Nfamara Ibrahima Cissé, president of the Association of Clients and Members of Financial Institutions (ACIF), is for his part calling on Wave to compensate the victims. In his view, the company can be held responsible, since it runs and secures the platform. Traceability is at the heart of the debate: victims say customer service was unable to tell them where their money had gone.

Past cases show, however, that money leaves a trail. In 2023, five customers filed complaints with the Special Cybersecurity Division over losses ranging from 55,000 to 4,634,000 CFA francs, and in several cases investigators were able to trace the Wave outlet where the money had been withdrawn.

How to protect yourself starting today

• Never share your Wave secret code, or any code received by text message, even with someone claiming to be an agent: Wave will never ask you for it.
• Do not tap any link promising a Wave bonus, gift or refund. Genuine offers appear inside the app.
• Be wary of “transfer mistakes”: check your balance in the app, never on the strength of a text message, and never dial a code someone reads out to you.
• Hang up when you are being rushed: “your account is about to be blocked” and “you have an unpaid bill” are fraudsters’ favourite lines. Call customer service back yourself.
• Lock your phone with a code or fingerprint, and do not keep your Wave code in your notes or messages.
• Keep the app up to date: according to Wave, new versions include stronger anti-fraud protection.
• If you can, keep on Wave only what you need for the month rather than your whole salary.

Victim of a withdrawal? The right steps, in order

• 1. Immediately call Wave customer service on 200 600 (free from Senegal) or message it on WhatsApp from the app’s settings, to have the account and the code blocked.
• 2. Gather the evidence: screenshots of your Wave history, text messages and numbers received, the bank statement showing the transfer to Wave.
• 3. File a written complaint with Wave and keep the reference number or reply you receive.
• 4. Report it to the Special Cybersecurity Division or a police station: only an investigation can obtain the technical data of the transaction from the operator.
• 5. If the complaint goes nowhere, refer the case free of charge to the mediator of the Observatory of the Quality of Financial Services (OQSF), which covers electronic money: a written, signed request with supporting documents (toll-free number 800 880 880, oqsf.sn).
• 6. Change your secret code as soon as the account is unblocked, and warn your contacts if your number was used to scam them.

Who has to pay the money back?

That is the question victims worry about most. In practice, a transaction approved with the correct code is hard to dispute, since it was technically authorised from the account. When no code was given, the burden of proof becomes decisive, which is why keeping every trace matters so much.

Over seventeen years, the OQSF mediator has recovered nearly 7 billion CFA francs for customers, handling 475 cases in 2025. It is a free route, too little known, which in principle gives the mediator two months to propose a solution.