This page isn't a dossier from the Threat Lab — it doesn't tell the story of one specific scam, it brings together lasting reflexes. Every technical claim is sourced; the complete list is on the Sources page.
Check the "linked devices" on your messaging apps from time to time
WhatsApp, Telegram, and Signal all let you connect a computer to your account with a QR code — convenient, but a device linked without your knowledge reads your messages continuously, with no warning from the app. On WhatsApp: Settings → Linked Devices. On Telegram: Settings → Devices (or Privacy and Security → Active Sessions). On Signal: Settings → Linked Devices. Remove any device you don't recognize.
FBI (Internet Crime Complaint Center, IC3) & CISA, Alert Number I-032026-PSA, March 20, 2026 · WhatsApp Help Center, "How to check devices linked to your account" · Telegram FAQ, devices section · Signal Support, "Linked Devices".Only scan a messaging QR code when you're the one linking a device
This is the exact mechanism the FBI and CISA documented in a joint alert on March 20, 2026: a message impersonating a known contact invites you to scan a QR code or follow a link, which secretly links your account to a device controlled by the attacker — no alert, no way to tell. The campaign they describe targeted current and former US government officials, military personnel, political figures, and journalists; the FBI and CISA attribute it directly to Russian Intelligence Services (RIS), and state that thousands of accounts have been compromised worldwide. The reflex applies to everyone, not only high-profile targets — and it also applies when it's your own unlocked phone someone asks to borrow "just to scan something," even briefly.
FBI (IC3) & CISA, joint alert "Russian Intelligence Services Target Commercial Messaging Application Accounts," Alert Number I-032026-PSA, March 20, 2026; follow-up update PSA260626, June 26, 2026.Never share a verification code or PIN with anyone
A code sent to "verify your identity" is actually meant to authorize a new device on your account — banking, messaging, or otherwise. This is the second mechanism described in the same FBI/CISA alert: a fake, automated "support" account contacts the target directly and asks for a PIN or a two-factor verification code. No genuine support account ever needs that code from you.
FBI (IC3) & CISA, Alert Number I-032026-PSA, March 20, 2026 (fake automated "support"-account mechanism).Turn on an extra lock for your sensitive accounts
On messaging apps, setting a PIN lock for the app is one of the basic digital-hygiene steps behind the FBI/CISA alert's general guidance to strengthen account authentication — Signal offers this as Registration Lock, and WhatsApp as two-step verification, both in the app's account settings. On your sensitive accounts more broadly (banking, email), enabling multi-factor authentication remains the strongest first line of defense against a stolen password.
FBI (IC3) & CISA, Alert Number I-032026-PSA, March 20, 2026 (general guidance on strengthening account authentication).Never call back a number after a single ring
This is the wangiri playbook: a call that rings just once tempts you to call back out of reflex — and it's the callback that gets billed. The number that rang often has nothing to do with the number that picks up.
A call from a dedicated telemarketing range is never a private individual
In the small number of countries where the regulator has created specific ranges for large-scale commercial calling (France, Spain, and India to date), a number from that range cannot, by construction, be a friend or family member calling you.
At night, silence the noise — not your vigilance
Calm is a form of hygiene too: nighttime notifications fragment sleep, regardless of what they say.
What Egidio already does for you, continuously
The reflexes above take action on your part. Two Egidio features exist precisely for everything else — the messages that arrive without warning, or the ones you're unsure about.
Upfront scanning of your messaging apps Premium
WhatsApp, Telegram, Messenger, and more than 183 messaging apps are scanned automatically, with nothing to configure — the same checking reflex as the points above, but applied continuously, before you even have to think about it.
A second opinion on a specific message Premium
A message that makes you uneasy, received on a channel Egidio doesn't natively monitor, or one someone simply showed you? Share it to Egidio (your phone's Share menu): the app gives you a second opinion, with the explanation.
None of these reflexes replaces the others. Together, they reduce the number of moments where an important decision rests on human vigilance alone — yours, on a tired evening.
Depending on your situation
The same reflexes, adapted to a specific context:
At work →
A federal alert documents executives targeted via WhatsApp and Signal — the reflexes for a work line.
For seniors →
The same traps, a different reaction time — simple reflexes for you or a parent.
For teens →
What you teach them matters more than what you monitor — the reflexes worth passing on, without reading their conversations.
Frequently asked questions
How can I tell if someone else is reading my WhatsApp, Telegram, or Signal messages?
Check the list of devices linked to your account in the app's settings ("Linked Devices" or "Active Sessions"). Any device you don't recognize should be removed immediately.
Does Egidio's Zen Mode also turn off protection, not just ringtones?
No. Zen Mode silences incoming solicitations at night, but protection stays active in the background, and a contact marked as a priority can still reach you in an emergency. Learn more about Zen Mode →
Looking for one messaging app in particular? WhatsApp · Telegram · Messenger · Discord · Snapchat.