Calm is built before the problem arrives.

Never share a registration PIN or verification code — least of all with a "support" account

A code sent to "confirm your identity" is exactly what authorises a new device on your account. The Australian Cyber Security Centre (ACSC) puts it in those words in its guidance on social engineering: "Be aware that malicious actors may seek to access your end-to-end encryption by adding an unauthorised device or re-registering your account. Do not share registration PINs or verification codes for social media or messaging applications, especially with other accounts claiming to be 'support' accounts. Always review new device register notifications." Once you have shared a code, it no longer verifies anything except access — for whoever asked for it.

This is a technique with a track record, not a hypothetical

The ACSC's security guidance for social media and messaging services records that "…other incidents have involved malicious actors masquerading as support staff in order to attempt covert social media and messaging account access for espionage purposes", and repeats the instruction plainly: "Do not share passwords, registration codes or verification codes for social media and messaging accounts, especially with other accounts claiming to belong to vendor support staff." The stated context is espionage against high-profile targets, but the habit costs nothing and protects everyone: the mechanism does not check who you are before it works.

Australian press reporting of Senate Estimates testimony on 25 May 2026 described a case of precisely this shape: a federal MP and three staff members had WhatsApp accounts compromised around 6 March 2026 — a legitimate verification code obtained by deception, then a device linked so the attacker could act as the account holder — with WhatsApp Web blocked on the parliamentary network on 9 March. We report that incident as press-covered testimony, not as an ACSC finding: the ACSC pages cited here describe the technique, not this case.

Review "new device" notifications, and check your linked devices

The ACSC's instruction is a standing one — "Always review new device register notifications" — and it is worth pairing with a look at the list itself, because a device linked without your knowledge reads your messages continuously with no further warning from the app. On WhatsApp: Settings → Linked Devices. On Telegram: Settings → Devices (or Privacy and Security → Active Sessions). On Signal: Settings → Linked Devices. Remove anything you don't recognise, then change the account's PIN or password.

Only scan a messaging QR code if you're the one linking a device, and turn on an app lock

Linking a device is done by scanning a QR code, which is why a QR code you didn't ask for deserves the same suspicion as a code someone asks you to read out: scanning it can attach your account to someone else's computer. Scan one only when you are the person adding the device, on a screen you opened yourself. The habit also holds when it's your own unlocked phone someone asks to borrow "just to scan", even briefly. Then add the second lock: Signal and WhatsApp both offer a registration PIN or in-app lock in their account settings, and two-factor authentication on your other sensitive accounts (banking, email) is the first line of defence against a stolen password.

Never call back a number after a single ring

This is the wangiri set-up: a call that rings only once pushes you to call back out of reflex — and it's the callback that gets charged. The number that rang often has nothing to do with whoever picks up.

A call from a "dedicated telemarketing" range is never a private individual

In the small number of countries where the regulator has created specific ranges for large-scale commercial calls (France, Spain and India, to date), a number from that range simply cannot, by design, be a loved one calling you. Australia is not one of them — its protection works differently, through the Do Not Call Register and telco-level blocking — but the rule matters the moment a call reaches you from one of those countries.

At night, silence the notifications — not your vigilance

Calm is a form of hygiene too: night-time notifications fragment sleep, regardless of what they say.

Upfront analysis of your messaging apps Premium

WhatsApp, Telegram, Messenger and more than 183 messaging apps are analysed automatically, with nothing to set up — the same verification habit as the points above, but applied continuously, before you even have to think about it.

A second opinion on a specific message Premium

Got a message that doesn't feel right, received on a channel Egidio doesn't monitor natively, or simply shown to you by someone else? Share it to Egidio (your phone's Share menu): the app gives you a second opinion, with the reasoning behind it.

At work →

Account takeovers reported to the ACSC, and a federal MP's office affected the same way — the habits for a work line.

For seniors →

The same traps, a different reaction time — simple habits for you or a parent.

For teens →

What you teach them matters more than what you monitor — the habits worth passing on, without reading their conversations.