No spyware. No exploit. No broken key. To read WhatsApp and Telegram conversations, German investigators added a device to the target’s account, and the messages landed with them just as they landed with the target. End-to-end encryption didn’t give way. It did its job, but for one extra recipient.

What happened

On September 2, the German site netzpolitik.org published an internal order from the Zollkriminalamt, the central customs criminal investigation office. Dated February 20, 2026, it states that messenger surveillance has been a permanent customs tool since August 1, 2025, after a pilot project launched at the end of 2023.

The text names WhatsApp, Telegram and Signal as examples, relies on “technical assistance from other federal agencies”, and doesn’t describe how it’s done.

The known concrete cases come from the police, and they involve WhatsApp and Telegram. In 2020, the Federal Criminal Police Office activated WhatsApp Web on one of its computers, by scanning the QR code with phones handed over voluntarily during a witness interview.

In 2022, police in Lower Saxony quietly opened an extra session on a suspect’s Telegram account. He spotted it and cut it off a few hours later. Too late, the history had already been copied.

For Signal, no actual surveillance by a German authority has been documented to date. The messenger appears in the order’s list of examples, and that’s it. The technique itself, though, is well documented against Signal elsewhere.

In February 2025, Google described Russia-linked groups trapping their targets with fake group invitation QR codes. In February 2026, Germany’s domestic intelligence service and the federal cybersecurity agency warned of a phishing campaign targeting Signal, probably state-directed, that grants access to the last 45 days of messages.

The practice is contested. In January 2026, the Federal Court of Justice ruled that quietly joining a Telegram account falls under source surveillance, a regime distinct from plain interception. The customs order, signed before that ruling was published, still relies on the 2020 decision. The authorities refuse to detail their methods and publish no figures. No statement from Signal or Meta on the matter could be found.

The encryption holds, the linked device leaks

Signal and WhatsApp encrypt every message for each of your devices. Your iPhone, your Mac, your iPad, each holds its own keys and each is a legitimate “end” of the conversation. Adding a device means adding an authorized recipient. Nothing gets forced, the circle just gets wider.

Picture someone getting a copy made of your mailbox key. The lock is intact, the mail carrier notices nothing, and someone else collects your mail every morning.

No antivirus will see a thing, because there’s nothing to detect. Just a normal feature, used by the wrong person. Even Apple’s Lockdown Mode, excellent against spyware, doesn’t block a device your own phone has authorized. It defuses booby-trapped parcels, it doesn’t turn away guests you let in yourself. We’d already seen Signal hold firm while iPhone notifications spoke for it. Same movie, different door.

There are three ways in. Physical access, your unlocked phone in someone else’s hands long enough to scan a QR code, during a seizure, an interview or with a nosy partner. The trap, a fake invitation QR code, a fake support message, a fake contest asking you for a code. And the intercepted SMS code, especially effective on Telegram. On Signal and WhatsApp, it re-registers the account on another phone, which logs you out and gets noticed.

Whether the intruder is an investigator, a foreign service or someone close to you, the defense is the same. The linked device shows up in a list, and that list, you can read.

What you do now

Signal on iPhone. Open Signal’s settings, linked devices section. Each line shows a name, the date it was linked and its last activity. If you’ve never linked a computer or tablet, the list should be empty.

Unlink anything you don’t recognize, the Mac you sold and the forgotten iPad included. Signal’s help puts it bluntly, if in doubt, remove all devices. Then, in the account settings, turn on Registration Lock. It requires your Signal PIN for any attempt to re-register your number elsewhere.

WhatsApp on iPhone. Settings tab, Linked Devices. Each line shows the device and its last activity. Tap each unknown device, then Log out, one by one. In the account settings, turn on two-step verification. If someone tries to re-register your number, WhatsApp will ask them for your code, a six-digit PIN or now a full password. Also add a passkey if the app offers one.

Since March 2026, WhatsApp can show a warning when a linking request looks suspicious. If you didn’t ask for anything, refuse. But the alert only fires on signs of suspicious behavior, not on every link.

On your Mac. Signal Desktop and the WhatsApp app are themselves linked devices. They don’t see the others, everything is managed from the iPhone. But a shared Mac, or one without FileVault, with these apps open, is a readable copy of your conversations. Google documented groups that stole Signal Desktop databases directly.

A Mac that should no longer read your messages, you unlink it from the iPhone. The one you keep deserves FileVault turned on and a session that doesn’t run as administrator. One trap on the WhatsApp side, if you log out on your main phone, linked devices stay active for fourteen days. Only logging out device by device cuts them off cleanly.

The rule that covers almost everything. Never scan a Signal QR code and never enter a WhatsApp linking code that isn’t showing on your own computer, at the very moment you’re linking it yourself. And reopen both lists at the slightest odd sign, messages marked as read that you never opened, a “support” message inside the app (Signal will never contact you that way), a QR code sent to you as an invitation.

Unlinking cuts access from then on. It doesn’t recall what the intruder already copied, the Lower Saxony suspect learned that the hard way. Hence the point of checking the list before you need to.

Read next, Domestic stalkerware, the jealous partner’s malware and Stop living as an administrator on your Mac.

Sources

• netzpolitik.org, Messenger-Überwachung, September 2, 2026, Zollkriminalamt order and police cases from 2020 and 2022.
• Joint BfV and BSI advisory on messenger phishing, February 6, 2026.
• Bundesgerichtshof, 3 StR 495/25, January 20, 2026.
• Google Threat Intelligence Group, February 19, 2025, hijacking of Signal linked devices.
• Privacy Guides, September 30, 2026, English-language summary.
• Signal, Linked Devices, official help.
• Signal, How to protect yourself on Signal, official help.
• Signal, Signal PIN, official help, Registration Lock.
• WhatsApp, check your linked devices, official help.
• WhatsApp, log out on your main device, official help, fourteen-day delay.
• Meta, New Anti-Scam Tools, March 11, 2026, suspicious linking warning.