German Police Are Using Linked Devices to Read Messages from Messaging Apps Without Cracking the Encryption

A document by Netzpolitik reveals that German police are sneakily abusing the linked devices feature in messengers to access the messages of suspects using encrypted messengers like Signal without needing to crack the encryption.

German customs officials have been using the web client of different messengers like Telegram and WhatsApp and logging in with the suspect's phone number. Depending on how each messenger handles logging in with a phone number, it could allow an attacker to gain access through phishing the code once it's sent, or coaching someone to link a device to their account.

Telegram's implementation of phone number sign in sends a confirmation code to one of your already existing Telegram devices. This code can easily be phished.

WhatsApp's implementation is a bit better. It requires you to initiate the device linking from within the app, an attacker can't just send you a code unprompted. Still, it's highly possible to phish by coaching someone to go into the settings and type in the device linking code.

Signal only allows linked devices through a QR code. However, it's still possible to scan a QR code sent by an attacker without them having physical access to your device.

The document states that the German customs agency has been testing messenger surveillance since the end of 2023, and it has led to success in criminal investigations. They're light on details as to exactly what strategies German customs officials use, but there are plenty of ways to maliciously link a device to an account.

This type of surveillance became an official, permanent strategy available to all agents since August 2025.

The messengers affected include WhatsApp, Telegram, Threema, and Signal.

Signal is often touted as a highly secure messenger. Indeed, it boasts some of the most robust encryption messengers have to offer, and other messengers like WhatsApp even use the Signal protocol for their encryption.

Signal recently launched phone numberless accounts in beta on Android, allowing you to sign up without ever giving your number to Signal while paying a small one-time fee.

Your account will be protected by a new secure Account ID and Recovery key that you can save in your password manager, which you will need in order to log in. They also announced future support for passkeys.

Passkeys are phishing-resistant by design and not available outside of your password manager, so you can't be tricked into typing it in during a phishing attempt.

Telegram added passkey support in 2025, although you have to go out of your way to enable it.

WhatsApp now supports passkeys as well, so you can secure your account that way.

It's also a good idea to occasionally check your active sessions/devices in the settings in your messenger of choice and remove any devices you don't recognize.