Can someone read your WhatsApp messages from another phone? How to check

There are three easy ways into your messages, and none of them involves cracking encryption:

• A linked device. WhatsApp, Signal, Telegram, iMessage, Google Messages and Messenger all let you use your account on a computer or tablet. Anyone who has your unlocked phone for a minute can add one, and it keeps reading along after they give the phone back.
• Your phone number. For WhatsApp, Telegram and Signal, your number is your login. Whoever gets the code sent to it can sign in as you.
• Your phone itself, or its backups. Other devices signed in to your Apple Account, a computer that syncs your messages, or a spy app someone installed.

Let's go through them one by one.

A linked device gets its own copy of every message. In WhatsApp and Signal, the sender's app encrypts each message separately for every device on your account: your phone, and also the laptop someone added. End-to-end encryption still works perfectly. It just counts that laptop as one of your ends.

It isn't only police. In February 2025, Google's threat intelligence team reported that Russia-linked hacker groups were sending Signal users booby-trapped QR codes, some disguised as group invites. Scanning one quietly linked the attacker's device to the victim's account.

The good news: linked devices show up in the app's settings, and you can remove them. WhatsApp also logs out a linked device after 30 days without use, and Google Messages unpairs after a few weeks. But someone who reads along every day keeps the link alive.

Open each app you use and look at its list of devices. Anything you don't recognise, log it out:

Do it in every app you use, not only the one you're worried about. A computer linked to your Telegram or Google Messages reads just as well as one linked to WhatsApp.

For WhatsApp, Telegram and Signal, your phone number is your account. Prove you have it, usually with a six-digit code by text message, and you're in. Telegram's own FAQ says it plainly: turn on two-step verification so that "the phone number alone will not be enough to log in to your account."

That's what the most common WhatsApp scam is built on. A message arrives, often from a friend's account that has already been taken over: sorry, I sent you a code by mistake, can you send it back? The code is yours, for your account. Send it and you're logged out, while someone else gets your new messages and writes to your contacts as you.

So never share a code that arrives on your phone, not even with a friend. WhatsApp says the same. And turn on the extra lock each app offers: two-step verification in WhatsApp (Settings > Account > Two-step verification) and Telegram (Settings > Privacy and Security > Two-Step Verification), and registration lock in Signal (Settings > Account > Registration Lock).

Your number can also be taken from you directly. In a SIM swap, criminals talk your mobile carrier into moving your number to their SIM card. In the UK, unauthorised SIM swaps rose by 1,055% in 2024, according to the fraud prevention service Cifas, and by another 38% in 2025.

And a number says a lot about you on its own. In many countries it's registered to your name, and in 2025 researchers confirmed 3.5 billion WhatsApp accounts simply by checking phone numbers. That's a big part of why we built a messenger without phone numbers.

On an iPhone, your iMessages can show up on other Apple devices signed in to your Apple Account: an old iPad, a shared family Mac, a laptop you forgot about. Check the list under Settings > [your name] and remove anything you don't use. Safety Check (Settings > Privacy & Security > Safety Check) goes further: it shows which devices, people and apps have access, and lets you cut them off in one step.

Then there are spy apps, often called stalkerware, which someone installs while they have your unlocked phone. According to the Coalition Against Stalkerware, warning signs include a battery that drains fast, spikes in data use, unexplained increases in Screen Time and strange notifications. The most telling sign, though, is a person who knows things about your messages that they shouldn't.

If you suspect a partner or ex installed something, be careful. The Coalition warns that removing it may be noticed and can make things more dangerous, and that it also deletes evidence. Talk to a support service first.

Run through this once, and again whenever something feels off:

1. 1Open the linked devices list in every messaging app you use, and log out anything you don't recognise.
2. 2Turn on two-step verification in WhatsApp and Telegram, and registration lock in Signal.
3. 3Never share a code that arrives on your phone, not even with a friend.
4. 4On an iPhone, run Safety Check and review the devices signed in to your Apple Account.
5. 5Give your phone a strong passcode, and don't hand it over unlocked.
6. 6Keep an eye out for the warning signs of spy apps.

Checking these settings works, but you have to remember to do it, in every app, again and again. We built Morse so that most of these doors don't exist in the first place:

• No linked devices. A Morse account lives on one phone. There's no web version, no desktop app and no second device to link, so nobody can quietly add one while they hold your phone.
• No phone number. Morse never asks for one, so there's no code by text message to trick out of you and no number to take over with a SIM swap. More on messaging without a phone number.
• Keys that stay on your phone. On the iPhone, Morse's keys are stored for that phone only, so a backup can't be read on any other device. On Android, Morse is left out of cloud backups altogether.
• A lock that really locks. With a PIN, Morse locks as soon as you leave it and closes its database, so a phone left unlocked on the table doesn't open your chats. And a panic button erases your account in one step, even from the unlock screen.

One honest limit: no app can protect what's on your screen from someone holding your unlocked phone while a chat is open, or from spyware that records the screen. A strong phone passcode is still your first lock.