This page adapts the habits from our pillar page Digital Hygiene to a work context. Every technical claim is sourced; the full list is on the Sources page.
Never share a registration PIN or verification code from a work messaging account
The ACSC's guidance on social engineering is explicit: "Do not share registration PINs or verification codes for social media or messaging applications, especially with other accounts claiming to be 'support' accounts. Always review new device register notifications." Once a code is shared, it no longer verifies anything except access — for whoever asked for it, including a colleague who appears to ask on behalf of a manager.
ACSC (Australian Cyber Security Centre, cyber.gov.au), "Social engineering", last updated 9 April 2026.A federal MP's office shows this isn't a hypothetical for business users
Australian press coverage of Senate Estimates testimony on 25 May 2026 described a federal MP and three staff members whose WhatsApp accounts were compromised around 6 March 2026 — a legitimate verification code obtained by deception, then a device linked so the attacker could act as the account holder. WhatsApp Web was subsequently blocked on the parliamentary network. The ACSC's own guidance describes the wider technique as targeting "high-profile" individuals for espionage — but the mechanism doesn't check a target's job title before it works, which is exactly why the same habits apply to a private-sector executive or a small business owner.
ACSC, "Security tips for social media and messaging services", last updated 9 April 2026 · Australian press coverage of Senate Estimates testimony, 25 May 2026.Review "new device" notifications on the messaging app you use for work
A device linked without your knowledge reads work messages continuously, with no further warning from the app. On WhatsApp: Settings → Linked Devices. On Telegram: Settings → Devices. On Signal: Settings → Linked Devices. A monthly check is enough for an active work line; remove anything you don't recognise and change the account's PIN.
ACSC, "Social engineering", last updated 9 April 2026 (recommended action: always review new device register notifications).Keep the work line separate from the personal line, on the same phone
A work line that's widely published (a website, B2B platforms, hiring forms) is mechanically more exposed to cold calls and to fraud attempts targeting businesses than a personal line kept for family and friends. A dual SIM phone (two cards, or a card plus an eSIM) keeps the two separate without carrying two devices.
Turn on a registration lock, and two-factor authentication on sensitive accounts
Signal and WhatsApp both offer a registration PIN or in-app lock in their account settings. On sensitive work accounts (company email, cloud tools, banking), two-factor authentication remains the first line of defence against a stolen or reused password.
WhatsApp Help Centre, "About two-step verification" · Signal Support, "Registration Lock".What Egidio already does for your team, continuously
The habits above take human action. Two features exist for the rest — the messages that arrive without warning, or the ones a colleague is unsure about.
Upfront scanning of the work messaging app Premium
WhatsApp, Telegram, Messenger, and more than 183 messaging apps are scanned automatically, with nothing to configure.
A second opinion on a specific message Premium
A message that makes a colleague uneasy, received on a channel Egidio doesn't natively monitor? Share it to Egidio (the phone's Share menu) for a second opinion, with the explanation.
An executive doesn't need to be a high-profile target to be exposed: using WhatsApp or Signal for work is enough. The same habits that apply to any personal account apply here — with one more work line to protect.
Frequently asked questions
Is a small business really affected by this kind of targeting?
The ACSC's guidance describes this technique in the context of espionage against high-profile targets. But the mechanism itself (a shared registration code, an unauthorised linked device) makes no distinction by company size: it works against any WhatsApp, Signal, or Telegram account used for work, including a freelancer's or a small business's.
Do I need a dedicated security tool for a work line?
The habits on this page (linked devices, QR codes, verification codes) cost nothing and cover the essentials. A tool like Egidio adds an automatic layer — messaging analysis and fraud call blocking — for the cases where vigilance alone isn't enough.