Jasmine Birtles
Your money-making expert. Financial journalist, TV and radio personality.
How Messaging App Security Gaps Can Put Your Personal and Financial Information at Risk
Moneymagpie Team
22nd Oct 2026
Last week’s messages probably included a banking code, a delivery update and maybe a photo of a passport sent to a landlord. All of it went through the same few apps. Messaging app security rarely gets the attention that banking apps get, though the same codes and details end up in both. The apps are mostly well built. It’s the settings and what people do inside them, that leave the gaps. Eight of them are covered here, each with a quick fix.
- SIM swap logins
- Linked devices
- Unprotected backups
- Chats that aren’t encrypted
- Fake links and support messages
- Cloned voices
- Sensitive details in chat history
- Outdated apps
- Conclusion
SIM swap logins
Most messaging apps log in with a phone number and a texted code. If a scammer talks the carrier into moving that number to a new SIM, the code goes to them and they get the account. Moonlock blog on WhatsApp security for users lists this as one of the security gaps most users miss, because nothing looks wrong until a friend asks why they’ve just been messaged for money. The quick fix is to turn on two-step verification inside the app, which adds a PIN that a text code can’t bypass.
A PIN on the carrier account helps too and most carriers will add a port-out lock if asked. Ten minutes on the phone now is a lot easier than recovering an account later.
Linked devices
Many apps let one account run on a laptop or tablet as well as the phone. Scams have used that feature, with a message that asks the user to scan a QR code or enter a code ‘to verify’ something. The scammer’s device then sits quietly on the account and reads every chat.
The fix doesn’t take time or need much expertise. Go to the linked devices list in settings and log out from the ones that look unfamiliar. Most apps also send an alert when a new device is linked and that’s what you should always be careful about. Never scan a code though that comes in a message.
Unprotected backups
Picture a chat that’s fully encrypted between two phones. Then the phone backs it up to the cloud and the backup isn’t encrypted. Anyone who is able to secure access to that cloud account can go through the whole chat history.
Messaging app privacy in most big apps is ensured through encrypted backup options in the chat or backup settings. Sadly, most people keep it switched off. People set up backups years ago with a new phone and haven’t opened the setting since.
Chats that aren’t encrypted
Not every one of the secure messaging apps encrypts everything by default. Telegram’s normal chats aren’t end-to-end encrypted, for example. Only its Secret Chats are and those are one-to-one. Plain SMS isn’t encrypted either.
When sharing information that really matters to your privacy – for example banking details or a copy of an ID – the best is to use an app that offers encryption by default. Group chats are a separate question in some apps. Remember though that a lock on one conversation doesn’t mean the rest are automatically covered.
These are some of the settings that are worth checking in apps you use:
- Two-step verification turned on
- Message previews hidden on the lock screen
- Disappearing messages for sensitive chats
- Encrypted backups turned on
- An app lock or fingerprint requirement to open it
Fake links and support messages
A text arrives that looks like the bank. A delivery fee is waiting, or an account has been ‘frozen’. The link goes to a copy of the real site and the details typed in go straight to a scammer.
The fix is to never tap the link. These texts tend to arrive when someone is expecting a parcel, which is exactly why they work. Open the bank or delivery app directly, or type the address in by hand. It takes ten seconds. Scam texts can be forwarded to 7726 and reported at reportfraud.ftc.gov.
Cloned voices
A voice note comes in from a daughter or a boss, asking for money fast. A few seconds of audio from social media can be enough to copy a voice, so it can sound right. Video can be faked too, so a short clip doesn’t prove much either.
Stop and call the person back on the number already saved in the phone. A real daughter or boss won’t mind being asked. Families can also agree on a safe word in person and ask for it whenever a request involves money.
Sensitive details in chat history
Card numbers, photos of IDs and passwords tend to be sent in a hurry and forgotten. They stay in the chat history, in backups and on any phone that’s lost or stolen. That is where data privacy quietly slips.
A photo of a driver’s license sent to a landlord is a good example. It stays on the landlord’s phone and on every backup of it, long after the lease is signed. The simplest rule is to keep anything sensitive out of a chat. If it’s really unavoidable, turn on disappearing messages. You can delete the thread later and maybe request the other person to do the same citing privacy as the reason.
Outdated apps
Some messaging app vulnerabilities can be used without the user tapping anything. A booby-trapped image or file arrives, the app processes it and the phone is infected. Developers fix these flaws in updates, so a phone that’s behind is the easy target. Updates always seem to arrive at a bad moment, so people put them off for weeks.
Automatic updates for the apps and the operating system take the decision away. It’s one of the dullest fixes and one of the most useful. On an iPhone, Lockdown Mode is an option for anyone who is a likely target. Keep away from ‘modified’ versions of popular apps downloaded from outside the official stores, since they’re a well-known route for spyware.
Conclusion
The steps mentioned above don’t need technical skills. A few minutes in settings closes most of what attackers count on and the settings only need checking once in a while.
Disclaimer: MoneyMagpie is not a licensed financial advisor and therefore information found here including opinions, commentary, suggestions or strategies are for informational, entertainment or educational purposes only. This should not be considered as financial advice. Anyone thinking of investing should conduct their own due diligence.
Subscribe
Login
0 Comments
