This page isn't a dossier from the Threat Laboratory — it doesn't tell the story of one particular scam, it brings together lasting habits. Every technical claim is sourced; the full list is on the Sources page.
Check the 'linked devices' on your messaging apps every so often
WhatsApp, Telegram and Signal all let you connect a computer to your account using a QR code — useful, but a device linked without your knowledge reads your messages continuously, with no warning from the app. On WhatsApp: Settings → Linked Devices. On Telegram: Settings → Devices (or Privacy and Security → Active Sessions). On Signal: Settings → Linked Devices. Remove any device you don't recognise.
NCSC (National Cyber Security Centre, part of GCHQ), 'NCSC warns of messaging app targeting', 31 March 2026 (recommended action: regularly audit linked devices) · WhatsApp Help Centre, 'How to check devices linked to your account' · Telegram FAQ, devices section · Signal Support, 'Linked Devices'.Only scan a messaging QR code if you're the one linking a device
This is the exact mechanism the UK's National Cyber Security Centre (NCSC, part of GCHQ) documented in an alert dated 31 March 2026: phishing carried out via a malicious link or QR code, alongside the unauthorised addition of a linked device to a messaging account — without the victim ever noticing. Contacts the victim already knows are impersonated to help draw them in. The alert describes those targeted as 'high-risk individuals' — government officials and similar — and attributes the campaign to what it calls 'Russia-based actors', acting 'alongside international partners' the alert does not name. The habit holds for everyone, not only high-profile targets — and it also holds when it's your own unlocked phone someone asks to borrow 'just to scan', even briefly.
NCSC (National Cyber Security Centre, part of GCHQ), 'NCSC warns of messaging app targeting', 31 March 2026.Never share a verification code or PIN with anyone
A code sent to 'confirm your identity' is exactly what authorises a new device on your account — banking, messaging, or otherwise. The same NCSC alert lists the sharing of recovery and login codes among the mechanisms behind this campaign: once you've shared a code, it no longer verifies anything except access, for whoever asked for it.
NCSC, 'NCSC warns of messaging app targeting', 31 March 2026 (describes shared recovery/login codes as part of the campaign).Turn on an extra lock for your sensitive accounts
The NCSC's own alert recommends turning on two-factor authentication or a passkey wherever it's available, alongside regularly auditing which devices are linked to your account — Signal and WhatsApp both offer an in-app lock of this kind in their account settings. On your sensitive accounts more generally (banking, email), two-factor authentication is the first line of defence against a stolen password.
NCSC, 'NCSC warns of messaging app targeting', 31 March 2026 (recommended actions: two-factor authentication or passkeys where available; regular audit of linked devices).Never call back a number after a single ring
This is the wangiri set-up: a call that rings only once pushes you to call back out of reflex — and it's the callback that gets charged. The number that rang often has nothing to do with whoever picks up.
A call from a 'dedicated telemarketing' range is never a private individual
In the small number of countries where the regulator has created specific ranges for large-scale commercial calls (France, Spain and India, to date), a number from that range simply cannot, by design, be a loved one calling you.
At night, silence the notifications — not your vigilance
Calm is a form of hygiene too: night-time notifications fragment sleep, regardless of what they say.
What Egidio does for you, continuously
The habits above call for action on your part. Two of Egidio's features exist for exactly the rest — the messages that arrive without warning, or the ones you're unsure about.
Upfront analysis of your messaging apps Premium
WhatsApp, Telegram, Messenger and more than 183 messaging apps are analysed automatically, with nothing to set up — the same verification habit as the points above, but applied continuously, before you even have to think about it.
A second opinion on a specific message Premium
Got a message that doesn't feel right, received on a channel Egidio doesn't monitor natively, or simply shown to you by someone else? Share it to Egidio (your phone's Share menu): the app gives you a second opinion, with the reasoning behind it.
None of these habits replaces the others. Together, they cut down the number of moments where an important decision rests on human vigilance alone — yours, on a tired evening.
Depending on your situation
The same habits, adapted to a specific context:
At work →
The NCSC has warned of officials targeted via messaging apps — the habits for a work line.
For seniors →
The same traps, a different reaction time — simple habits for you or a parent.
For teens →
What you teach them matters more than what you monitor — the habits worth passing on, without reading their conversations.
Frequently asked questions
How do I know if someone else is reading my WhatsApp, Telegram or Signal messages?
Check the list of devices linked to your account in the app's settings ('Linked Devices' or 'Active Sessions'). Any device you don't recognise should be removed immediately.
Does Egidio's Zen Mode also switch off protection, not just notifications?
No. Zen Mode silences notifications at night, but protection stays active in the background, and a contact marked as priority can still reach you in an emergency. Learn more about Zen Mode →
Looking for one messaging app in particular? WhatsApp · Telegram · Messenger · Discord · Snapchat.